{"id":20983,"date":"2022-02-16T21:21:56","date_gmt":"2022-02-16T21:21:56","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=20983"},"modified":"2022-02-17T20:52:23","modified_gmt":"2022-02-17T20:52:23","slug":"critical-infrastructure-ransomware-attacks-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/critical-infrastructure-ransomware-attacks-vulnerabilities\/","title":{"rendered":"Feds Warn About Critical Infrastructure Ransomware Attacks, Vulnerabilities"},"content":{"rendered":"

Ransomware<\/a> attacks on critical infrastructure<\/a> and a surge in exploited vulnerabilities<\/a> are getting the attention of U.S. cybersecurity agencies, which highlighted the threats in a pair of warnings issued in recent days.<\/p>\n

The FBI and U.S. Secret Service issued a detailed advisory<\/a> on the BlackByte Ransomware as a Service (RaaS) group, which has attacked critical infrastructure industries in recent months, among them government, financial and food and agriculture targets.<\/p>\n

And the Cybersecurity and Infrastructure Security Agency (CISA) added 15 more vulnerabilities<\/a> to its list of actively exploited vulnerabilities.<\/p>\n

The warnings come amid rising global tensions<\/a> over the possibility of a Russian invasion of Ukraine, which itself has been the subject of a number of U.S. cybersecurity advisories<\/a> in recent weeks, the latest a dramatic revelation of Russian cyber attacks against U.S. defense firms<\/a>.<\/p>\n

Also read: Top Vulnerability Management Tools<\/a><\/p>\n

BlackByte Ransomware Attack Methods, IoCs<\/h2>\n

The FBI-Secret Service warning came just ahead of news that the NFL’s San Francisco 49ers had also been hit by BlackByte ransomware.<\/p>\n

The ransomware encrypts files on compromised Windows host systems, including physical and virtual servers, the advisory noted, and the executable leaves a ransom note in all directories where encryption occurs, including ransom payment instructions for obtaining a decryption key.<\/p>\n

Some victims said the attackers used a known Microsoft Exchange Server vulnerability<\/a> to gain access to their networks, then deployed tools to move laterally across the network and escalate privileges before exfiltrating and encrypting files.<\/p>\n

“In some instances, BlackByte ransomware actors have only partially encrypted files,” the advisory said. “In cases where decryption is not possible, some data recovery can occur.”<\/p>\n

A newer version of the ransomware encrypts files without communicating with any external IP addresses. The advisory provided a detailed look at BlackByte indicators of compromise (IoC) and suspicious files and commands to look for.<\/p>\n

BlackByte Ransomware Protection Steps<\/h2>\n

The agencies offered some sound cybersecurity advice for BlackByte that applies pretty generally:<\/p>\n