Popular Content

Showing content with the highest reputation on 07/09/19 in Posts

  1. 1 point
    .id-C8DAE7D0.[[email protected]].html - this is the format of Dharma Ransomware (detailed description + link to English translation in the title of the article). These extortionists have been robbing users for 2.5 years with impunity and law enforcement agencies are shamefully inactive.
  2. 1 point
    What are the following files? C:\Windows\System32\antimalware.exe C:\Windows\system32\silcollector.cmd C:\Windows\system32\TSMSISrv.dll That last file (TSMSISrv.dll) may be the stage 2 payload from the malicious version of CCleaner (5.33) that was released after Piriform's systems were compromised. Keep in mind that there is also a legitimate Windows file with this same name, however I don't think it's normally in this location. Your files are not infected. They're encrypted. Most ransomware will delete itself after all of the files on the computer are encrypted. In this case, since the compromise was more than likely via RDP, an attacker simply logged in to the server after brute forcing credentials to an account (more than likely one with admin rights) and manually copied the ransomware to the server and executed it, and they don't like to leave traces of their compromise behind (beyond the encrypted files and ransom notes) so they generally delete everything they copied to the system themselves. Since this is almost certainly RDP compromise, I'll paste some basic steps to getting started securing RDP below: First I recommend temporarily disabling all port rules in your firewall (closing all open ports) until you can do a full audit of your firewall configuration and determine which ports need to remain open. There are some basic recommendations below to help get you started with the port audit. If you are managing a company network, then some form of IPS/IDS is highly recommended to monitor the network for intrusions. If you already have such a system in place, then I recommend a full audit of any rules you have configured to make sure that the device is providing adequate monitoring. It is also recommended to have someone with penetration testing experience verify that the IPS/IDS is properly alerting when there are intrusion attempts. Also, quickly change all passwords on any workstations and/or servers that are connected to the same network as the compromised system. Also be sure to change passwords on any online accounts, as well as any routers or switches (or other devices that have network-accessible administration functions). I recommend that every account have a different password, that passwords be no shorter than 25 characters and be made up of a random combination of uppercase letters, lowercase letters, numbers, and symbols. Obviously passwords like that are difficult (if not impossible) to remember, so a password manager may be required in order to aid in managing passwords. KeePass is probably the simplest password manager, and stores password databases locally instead of on some "cloud" server. If something capable of automatically filling in passwords (or sharing passwords between multiple devices/users) is necessary then there are reasonable passwords managers from LastPass, bitwarden, 1Password, Dashlane, etc. Note that unlike KeePass, these password managers work as extensions added to web browsers (or apps on mobile phones), and they store password databases online. When auditing your firewall configuration and preparing to reopen ports, I recommend never opening ports globally unless absolutely necessary. I also recommend requiring anyone who needs access to sensitive services (RDP, Windows Networking, etc) to connect to the network via a VPN so that you don't have to open ports for those services in the firewall, and then only open the VPN port in the firewall for IP addresses that need access to it. If someone who needs access has a dynamic IP, then many firewalls these days support something like Single Packet Authorization or Port Knocking to dynamically open ports for unknown IP addresses.
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up