UNC2596勒索软件集团（也称为古巴）正在滥用Microsoft Exchange中发现的漏洞，以妥协公司终点，收获数据 ，并最终部署ColdDraw恶意软件。
来自Mandiant的网络安全专家陷入了勒索软件集团的步道 ，并说它主要是在美国和加拿大搜寻公司。
专家报告指出，该小组至少自2021年8月以来一直使用Proxyshell和Proxylogon漏洞来种植各种Web壳 ，远程访问木马（大鼠）和后门 ，以折磨的系统 。
你可能喜欢
勒索软件黑客的目标是一个新的Windows安全缺陷来击中企业
幽灵勒索软件已在70多个国家 /地区袭击公司，联邦调查局和CISA警告
主要的俄罗斯黑客小组将重点转移到我们和英国的目标
Techradar需要您！
我们正在研究读者如何使用具有不同设备的VPN ，以便我们可以改善内容并提供更好的建议 。这项调查不应花费超过60秒的时间。感谢您参加 。
>>单击此处在新窗口中开始调查 <<
Among the backdoors used, CobaltStrike and NetSupport Manager seem to be the most popular choices, but they often use home-grown products, dubbed “Bughatch”, “Wedgecut ”, “Burntcigar ”, or “Eck”. Some of these are used as reconnaissance tools, others to terminate processes and escalate privileges.
The difference between UNC2596 and other ransomware groups out there, is that this group does not send exfiltrated data towards cloud services. Instead, they use private infrastructure.
A growing ransomware actor
The Cuba ransomware group was reportedly formed in late 2019, and after a relatively slow start, picked up its pace in 2020 and 2021. In May 2021, the group teamed up with Hancitor malware spammers, successfully phishing out passwords for corporate networks with malicious DocuSign files.
In late 2021, the FBI issued an advisory about the group which claimed the group breached 49 critical infrastructure organizations in the US (the Cuba leak website had fewer than 30 victims listed). Its operations earned it almost $44 million, the law enforcement agency added. However, it demanded $74 million.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.Read more
> Ransomware attacks are levelling up extortion tactics
> 俄罗斯黑客正在勒索奖励奖励
> IT工人认为勒索软件和恐怖主义一样严重
尽管有赎金的要求 ，即无薪和报酬，与勒索软件游戏中一些最大的玩家相比 ，该小组的数百万美元数百万 。
例如 ，来自EMSISOFT的网络安全研究人员表示，去年有105份古巴勒索软件提交 ，而Conti已有600多个。
通过：BleepingComputer
本文来自作者[admin]投稿，不代表东辰文化立场，如若转载，请注明出处：http://mzwhys.cn/cshi/202506-821.html
评论列表（4条）
我是东辰文化的签约作者“admin”！
希望本篇文章《Microsoft Exchange服务器以古巴勒索软件为目标》能对你有所帮助！
本站[东辰文化]内容主要涵盖：生活百科,小常识,生活小窍门,知识分享
本文概览： UNC2596勒索软件集团（也称为古巴）正在滥用Microsoft Exchange中发现的漏洞，以妥协公司终点，收获数据，并最终部署ColdDraw恶意软件。 ...