New LockFile ransomware gang uses ProxyShell and PetitPotam exploits

A new ransomware gang named LockFile targets Microsoft Exchange servers exploiting the recently disclosed ProxyShell vulnerabilities.

A new ransomware gang named LockFile targets Microsoft Exchange servers using the recently disclosed ProxyShell vulnerabilities. The popular security expert Kevin Beaumont was one of the first researchers to report that the LockFile operators are using the Microsoft Exchange ProxyShell and the Windows PetitPotam vulnerabilities to take over Windows domains.

ProxyShell is the name of three vulnerabilities that could be chained by an unauthenticated remote attacker to gain code execution on Microsoft Exchange servers.

The three vulnerabilities used in ProxyShell attacks are:

CVE-2021-34473 – Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)CVE-2021-34523 – Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)CVE-2021-31207 – Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)

The vulnerabilities are exploited remotely through Microsoft Exchange’s Client Access Service (CAS) running on port 443 in IIS.

The vulnerabilities were discovered by security Researcher Tsai orange from Devcore, the issues were awarded $ 200,000 during the April 2021 Pwn2Own hacking contest. On Thursday, Orange Tsai gave a talk at the Black Hat conference and shared details about the Microsoft Exchange vulnerabilities.

Tsai explained that the ProxyShell attack chain targets multiple components in the Microsoft Exchange, including the Autodiscover service which is used by client applications to configure itself with minimal user input.

Threat actors started actively scanning for the Microsoft Exchange ProxyShell remote code execution flaws after researchers released technical details at the Black Hat hacking conference.

Threat actors first compromise a Microsoft Exchange server, then exploit the flaws to drop web shells that could be used to install and execute other malicious payloads.

After exploiting an Exchange server, the threat actors dropped web shells that could be used to upload other programs and execute them.

Security experts from Symantec reported that Lockfile gang first compromise the Microsoft Exchange servers then uses the PetitPotam vulnerability to take over a domain controller.

“The LockFile ransomware was first observed on the network of a U.S. financial organization on July 20, 2021, with its latest activity seen as recently as August 20. LockFile has been seen on organizations around the world, with most of its victims based in the U.S. and Asia.” states Symantec. “Indications are that the attackers gain access to victims’ networks via Microsoft Exchange Servers, and then use the incompletely patched PetitPotam vulnerability to gain access to the domain controller, and then spread across the network. It is not clear how the attackers gain initial access to the Microsoft Exchange Servers.”

The victims of the Lockfile ransomware gang are in the manufacturing, financial services, engineering, legal, business services, and travel and tourism sectors.

The ransom note used by the Lockfile gang is similar to the one used by the LockBit ransomware operators and reference the Conti gang in the email address used (contact@contipauper[.]com).

Once encrypted the files, the ransomware will append the .lockfile extension to the encrypted file’s names.

In order to mitigate the exposure to the LockFile infections, admins should install the security updates that address Microsoft Exchange ProxyShell vulnerabilities and the Windows PetitPotam NTLM Relay vulnerability.

Experts pointed out that the Windows PetitPotam flaws only received incomplete updates anyway an unofficial patch was released by 0patch.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Lockfile ransomware)