Threat Signal Report

New Threat Actor Leverages ProxyShell Exploit to Serve Ransomware

description-logo Description

FortiGuard Labs is aware of a report that a new threat actor, "Tortillas," is leveraging the ProxyShell exploit to deliver ransomware. Based on the traits, the ransomware served by tortillas appears to be a Babuk ransomware variant. ProxyShell consists of three Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) used in a chain that enables the attacker to remotely run malicious code on the targeted system as a result. The security flaws were patched by Microsoft in April and May 2021.


Why is this Significant?

This is significant because a previously undocumented threat actor "tortillas" is now taking advantage of the Proxyshell exploit chain to deliver a ransomware. While Microsoft released a fix for all three vulnerabilities used in ProxyShell in April and May 2021, more and more threat actors have since adopted ProxyShell in their attacks. In late August of this year, Lockfile ransomware was delivered through the ProxyShell and PetitPotam vulnerabilities. In September, the Conti ransomware gang reportedly added ProxyShell to their modus operandi.


FortiGuard Labs previously released two Threat Signals associated with ProxyShell. See the Appendix for a link to "Vulnerable Microsoft Exchange Servers Actively Scanned for ProxyShell" and "Brand New LockFile Ransomware Distributed Through ProxyShell and PetitPotam."


What is the Ransomware that is Deployed by Tortillas in this Attack?

The deployed ransomware appears to be a Babuk ransomware variant based on traits. For example, this particular ransomware adds .babyk file extension, typical of Babuk ransomware, to the files it encrypts. FortiGuard Labs also observed that this malware shares similar mutexes to Babuk.


The Babuk variant also steals data as part of a double extortion tactic. Upon encrypting the files and stealing data from the compromised machine, the Babuk variant instructs the victim to pay US $10,000 worth of Monero cryptocurrency to the attacker's wallet address for file decryption and for not releasing the stolen data to the public.


What is the Tortillas Threat Actor?

Tortillas appears to be a new threat actor whose activities have not been previously documented. FortiGuard Labs will monitor the threat actor and provide updates if any significant activities are observed.


Has Microsoft Released a Patch for ProxyShell?

Yes. Microsoft released a patch for CVE-2021-31207 in May. While CVE-2021-34473 and CVE-2021-34523 were disclosed in July 2021, Microsoft released a patch in April 2021 without disclosing them.


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage for the Babuk variant sample used in this attack:


MSIL/Agent.JBV!tr


FortiGuard Labs provide the following IPS coverage for this attack:

MS.Exchange.Server.CVE-2021-34473.Remote.Code.Execution

MS.Exchange.MailboxExportRequest.Arbitrary.File.Write

MS.Exchange.Server.Common.Access.Token.Privilege.Elevation


FortiEDR detects and blocks ProxyShell attacks out of the box without any prior knowledge or special configuration beforehand.


All known network IOC's related to this threat are blocked by the FortiGuard WebFiltering Client.


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.