Microsoft experts examined real attempts to exploit BlueKeep and warned users about the growing threat of cyberattacks based on this vulnerability. As the experts found out, the criminals created a new exploit, which is already used to spread malware-crypto miners.
The BlueKeep Vulnerability (CVE-2019-0708) is found in the Remote Desktop Service (RDS) for Windows 7, Windows Server 2008, and Windows Server 2008 R2. It allows you to execute third-party code on your computer and automatically distribute malware within the infrastructure.A patch for this bug was published in May, however, according to information security analysts, the number of vulnerable machines is still in the hundreds of thousands.
“It’s well worth organisations triple checking what RDP exposure they have facing the internet. It’s still well over half a million BlueKeep vulnerable systems as of fresh scanning this week, including many of the world’s biggest orgs and MSPs”, — for example, posted an independent researcher Kevin Beaumont on Twitter.
Kevin Beaumon reported about attempts of mass use of BlueKeep back in late October. He noticed a series of critical errors on the chanotypes that were created specifically to attract BlueKeep malware. As it turned out, the failures were triggered by a new exploit created on the basis of the Metasploit module.
A further investigation, which Microsoft experts and independent researcher Marcus Hutchins connected to, revealed that attackers were trying to install cryptocurrency mining software on vulnerable computers. The exploit used is unstable, which causes numerous critical RDS errors. At the same time, experts emphasize that one should not underestimate the possible successful attacks that remain behind the scenes.
Analysts have linked the crypto-jacker campaign to a series of similar attacks in September. One management server unites all incidents. According to experts, criminals are experimenting with payload delivery systems, and the BlueKeep exploit has expanded the arsenal of attackers in early October.
A significant part of the incidents occurred in France (18%), Russia (16%) and Italy (10%).
Unlike previous, fully automated campaigns using BlueKeep, the October attack organizers manually downloaded the exploit to vulnerable computers. Next, the malware executed a series of PowerShell scripts in order to deploy the miner and gain a foothold on the machine.
Read also: Wordfence experts talked about a massive WP-VCD threat aimed at hacking WordPress
Experts predict that in the future, criminals will use a new exploit to deliver other types of malware. Experts have already found a way to fix the problems that caused critical errors on compromised computers.
“Users urgently need to update the software, paying particular attention to the RDP applications of vendors and other third-party organizations. Such systems often fall outside the scope of the scan, and until users find all such programs, criminals will be able to use BlueKeep without leaving obvious traces in the infrastructure”, – emphasized Microsoft researchers.
