Pierluigi Paganini November 08, 2019

Microsoft is warning once again of more BlueKeep attacks that could deliver disruptive payloads and urges organizations to patch their systems.

Recently, researchers warned of the first mass-hacking campaign exploiting the BlueKeep exploit, the attack aimed at installing a cryptocurrency miner on the infected systems. The popular expert Kevin Beaumont observed some of its EternalPot RDP honeypots crashing after being attacked.

The popular expert Marcus Hutchins analyzed data shared by Beaumont and confirmed that attacks the honeypot systems were hit by attackers leveraging the BlueKeep exploits to deliver a Monero Miner.

“Kevin kindly shared the crash dump with us and following this lead, we discovered the sample was being used in a mass exploitation attempt. Due to only smaller size kernel dumps being enabled, it is difficult to arrive at a definite root cause.” reads a blog post published by Hutchins.

“Finally, we confirm this segment points to executable shellcode. At this point we can assert valid BlueKeep exploit attempts in the wild, with shellcode that even matches that of the shellcode in the BlueKeep metasploit module!”

Microsoft Defender ATP Research Team is now warning of more destructive BlueKeep attacks that could hit very soon organizations with unpredictable consequences.

The vulnerability, tracked as CVE-2019-0708, impacts the Windows Remote Desktop Services (RDS) and was addressed by Microsoft with May 2019 Patch Tuesday updates. BlueKeep is a wormable flaw that can be exploited by malware authors to create malicious code with WannaCry capabilities.

As explained by Microsoft, this vulnerability could be exploited by malware with wormable capabilities, it could be exploited without user interaction, making it possible for malware to spread in an uncontrolled way into the target networks.

“Microsoft had already deployed a behavioral detection for the BlueKeep Metasploit module in early September, so Microsoft Defender ATP customers had protection from this Metasploit module by the time it was used against Beaumont’s honeypot.” reads the post published by Microsoft. “The module, which appears to be unstable as evidenced by numerous RDP-related crashes observed on the honeypot, triggered the behavioral detection in Microsoft Defender ATP, resulting in the collection of critical signals used during the investigation.”

A new wave of attacks could exploit the vulnerability to spread more dangerous and destructive malware, like ransomware or spyware. Below the Tweet published by Microsoft:

Researchers at Microsoft observed an increase in RDP service crashes from 10 to 100 daily starting on September 6, 2019, when the BlueKeep Metasploit module was released.

The researchers also observed a similar increase in memory corruption crashes starting on October 9, 2019, while independent researchers started observing crashes on their honeypots starting on October 23, 2019.

Experts discovered that the first cryptojacking campaign observed in September uses the same C2 infrastructure of the one detected in October, suggesting the involvement of the same threat actor.

“After extracting indicators of compromise and pivoting to various related signal intelligence, Microsoft security researchers found that an earlier coin mining campaign in September used a main implant that contacted the same command-and-control infrastructure used during the October BlueKeep Metasploit campaign, which, in cases where the exploit did not cause the system to crash, was also observed installing a coin miner,” continues Microsoft.

“This indicated that the same attackers were likely responsible for both coin mining campaigns—they have been actively staging coin miner attacks and eventually incorporated the BlueKeep exploit into their arsenal.”

Microsoft confirmed that attackers are leveraging an exploit module released for the Metasploit penetration testing platform.

Microsoft added that the miner payload used in these attacks infected machines in France, Russia, Italy, Spain, Ukraine, Germany, the United Kingdom, and many other countries.

“These attacks were likely initiated as port scans for machines with vulnerable internet-facing RDP services. Once attackers found such machines, they used the BlueKeep Metasploit module to run a PowerShell script that eventually downloaded and launched several other encoded PowerShell scripts.” concludes Microsoft.

“The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check,”

Microsoft also published a threat analytics report that provides an overview of the threat and an analysis of the techniques and tools used by the threat. It also provides worldwide impact information, mitigation recommendations, and detection information.

Pierluigi Paganini

(SecurityAffairs – Bluekeep, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]