Hackers are targeting vulnerable Microsoft SQL Server (MSSQL) databases, using brute-force attacks to deliver ransomware and Cobalt Strike payloads.
Spotted by security firm Securonix, the attacks are part of the DB#JAMMER campaign, which stands out for its high level of sophistication in terms of the attacker's use of tooling infrastructure and payloads.
“Some of these tools include enumeration software, RAT payloads, exploitation and credential-stealing software, and finally ransomware payloads. The ransomware payload of choice appears to be a newer variant of Mimic ransomware called FreeWorld,” the Securonix Threat Research team noted in a report.
The attackers gain initial access to the victim host by brute-forcing the MS SQL server, using it to enumerate the database and leveraging the xp_cmdshell configuration option to run shell commands and conduct reconnaissance.
The next stage of the attack involves taking steps to weaken system defenses, including disabling Windows Firewall, network security protection and RDP authentication.
The researchers have also observed the threat actor executing commands from an SMB-delivered binary, svr.exe, which appears to be a Cobalt Strike command and control payload. The attackers then attempted to establish RDP persistence via a reverse proxy and tunneling solution called Ngrok, which allows for bypassing the firewall by running a service on the host.
A network port scanner and the Mimikatz credential dumping tools were also deployed to attempt lateral movement to other systems on the network. In the final stage, the attack downloaded a file called “5000.exe,” which dropped a variant of Mimic ransomware called FreeWorld onto the system.
As countermeasures, the researchers advise using strong passwords, limiting the use of the xp_cmdshell stored procedure, leveraging a trusted platform such as a VPN, monitoring common malware staging directories, especially “C:\Windows\Temp,” and deploying additional process-level logging such as Sysmon and PowerShell logging for additional log detection coverage.
