GandCrab has infected a slew of companies by targeting their MSP’s

Third-party vendor hacks, where hackers attack a company by compromising one of their business associates, have been a problem for a while. Now, the hackers behind GandCrab ransomware have gotten into the act, exploiting a year-old SQL injection vulnerability in a common remote IT support software solution to infect organizations with GandCrab through their MSP’s. ZDNet reports:

The vulnerability used by the hackers impacts the Kaseya plugin for the ConnectWise Manage software, a professional services automation (PSA) product used by IT support firms.

The Kaseya VSA plugin allows companies to link data from the Kaseya VSA remote monitoring and management solution to a ConnectWise dashboard.

Many small IT firms and other types of managed service providers (MSPs) use the two applications to centralize data from their clients and manage customer workstations from a remote central location.

Kaseya issued a patch for the vulnerability shortly after it was discovered in late 2017, but apparently, some MSP’s never installed it. Notably, the number of MSP’s who had not updated as of January 2019, when GandCrab hackers began exploiting the flaw, was relatively small in light of the popularity of the app; Kaseya reported that fewer than 130 MSP’s out of thousands were impacted. However, the first reported victim was allegedly a “local mid-sized MSP with about 80 clients,” all of whom were infected. If we were to assume that all of the impacted MSP’s had about the same number of clients, it’s easy to see the potential of this attack method to rapidly infect hundreds, perhaps thousands of new victims.

This particular incident illustrates how important it is for organizations to stay on top of software updates, as they frequently contain security patches. However, prompt software updates alone won’t inoculate against all cyber threats, and particularly not GandCrab.

GandCrab is the ransomware that keeps evolving

Cyber security is a continual game of Spy vs. Spy; the moment one vulnerability is shored up, hackers find a new one to exploit. GandCrab is the poster child for this dynamic cyber threat environment. GandCrab first emerged about a year ago and has dominated the infosec news cycle since, primarily because the hackers behind it are continually enhancing and refining it.

In addition to exploiting multiple software vulnerabilities, GandCrab has spread through JBoss and WebLogic server flaws, malicious emails, malvertising, by disguising itself as legitimate software or a cracked utility, and brute-force password-cracking attacks. GandCrab even took advantage of Valentine’s Day last week, sending out “love letters” that weren’t so loving.

Once infected, it’s notoriously difficult to rid machines of GandCrab. Bitdefender released a free decrypter for GandCrab last October, but it doesn’t work with the latest versions, starting with GandCrab 5.0.4. Some organizations turn to data recovery firms, but this can backfire. GandCrab is distributed using a ransomware-as-a-service (RaaS) model – with a twist. In addition to partnering with other hackers, GandCrab offers “discount codes” to unscrupulous data recovery firms. Here’s how the scheme works:

1. Instead of paying the ransom, an organization infected with GandCrab hires a dishonest data recovery firm to recover its files.
2. The data recovery firm logs onto its GandCrab portal, enters a special code, and pays a discounted ransom to retrieve the victim’s files.
3. The data recovery firm returns the files to the victim and charges a significant markup for their “services.” The victim ends up paying more than if they’d simply paid the ransom themselves.

Protect yourself against GandCrab

Proactive cyber security measures can prevent GandCrab infections and other cyber attacks. In addition to ensuring that your organization employs robust cyber security defenses, protocols, and procedures, vet the cyber security posture of your third-party business partners. Back up all of your systems and data so that you can restore them after a ransomware infection, another cyber attack, or a natural disaster. If you enlist the services of a data recovery firm, ask for references, do a web search on the company’s name to look for complaints, and make sure they explain how they intend to recover your data.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.