Recently, researchers warned of the first mass-hacking campaign exploiting the BlueKeep exploit, the attack aimed at installing a
The popular expert Marcus Hutchins analyzed data shared by Beaumont and confirmed that attacks the honeypot systems were hit by attackers leveraging the BlueKeep exploits to deliver a Monero Miner.
“Kevin kindly shared the crash dump with us and following this lead, we discovered the sample was being used in a mass exploitation attempt. Due to only smaller size kernel dumps being enabled, it is difficult to arrive at a definite root cause.” reads a blog post published by Hutchins.
“Finally, we confirm this segment points to executable shellcode. At this point we can assert valid BlueKeep exploit attempts in the wild, with shellcode that even matches that of the shellcode in the BlueKeep metasploit module!”
Microsoft Defender ATP Research Team is now warning of more destructive BlueKeep attacks that could hit very soon organizations with unpredictable consequences.
The vulnerability, tracked as CVE-2019-0708, impacts the Windows Remote Desktop Services (RDS) and was addressed by Microsoft with May 2019 Patch Tuesday updates. BlueKeep is a wormable flaw that can be exploited by malware authors to create malicious code with WannaCry capabilities.
As explained by Microsoft, this vulnerability could be exploited by malware with
“Microsoft had already deployed a behavioral detection for the BlueKeep Metasploit module in early September, so Microsoft Defender ATP customers had protection from this Metasploit module by the time it was used against Beaumont’s
A new wave of attacks could exploit the vulnerability to spread more dangerous and destructive malware, like ransomware or spyware. Below the Tweet published by Microsoft:
Researchers at Microsoft observed an increase in RDP service crashes from 10 to 100 daily starting on September 6, 2019, when the BlueKeep Metasploit module was released.
The researchers also observed a similar increase in memory corruption crashes starting on October 9, 2019, while independent researchers started observing crashes on their
Experts discovered that the first
“After extracting indicators of compromise and pivoting to various related signal intelligence, Microsoft security researchers found that an earlier coin mining campaign in September used a main implant that contacted the same
“This indicated that the same attackers were likely responsible for both coin mining campaigns—they have been actively staging coin miner attacks and eventually incorporated the BlueKeep exploit into their arsenal.”
Microsoft confirmed that attackers are leveraging an exploit module released for the Metasploit penetration testing platform.
Microsoft added that the miner payload used in these attacks infected machines in France, Russia, Italy, Spain, Ukraine, Germany, the United Kingdom, and many other countries.
“These attacks were likely initiated as port scans for machines with vulnerable internet-facing RDP services. Once attackers found such machines, they used the BlueKeep Metasploit module to run a PowerShell script that eventually downloaded and launched several other encoded PowerShell scripts.” concludes Microsoft.
“The new exploit attacks show that BlueKeep will be a threat as long as systems remain unpatched, credential hygiene is not achieved, and overall security posture is not kept in check,”
Microsoft also published a threat analytics report that provides an overview of the threat and an analysis of the techniques and tools used by the threat. It also provides worldwide impact information, mitigation recommendations, and detection information.
(SecurityAffairs – Bluekeep, malware)