BlackKingdom Ransomware
BlackKingdom is a new ransomware tool seen encrypting files in human-operated attacks on Microsoft Exchange servers affected by the ProxyLogon vulnerabilities.
Summary
BlackKingdom is a new ransomware tool seen encrypting files in human-operated attacks on Microsoft Exchange servers affected by the ProxyLogon vulnerabilities.
Affected platforms
The following platforms are known to be affected:
Microsoft Exchange Server 2019 Versions: all prior to CU8 15.2.792.10 / CU7 15.2.721.13
Microsoft Exchange Server 2016 Versions: all prior to CU19 15.1.2176.9 / CU18 15.1.2106.13
Microsoft Exchange Server 2013 Versions: all prior to CU23 15.0.1497.12
Microsoft Exchange Server 2010 Versions: all prior to SP3 RU32 14.3.513.0
Threat details
Introduction
BlackKingdom (stylised as Black KingDom in some variants) is a newly observed human-operated ransomware tool actively targeting the ProxyLogon vulnerabilities in Microsoft Exchange servers.
Delivery
At the time of publication, BlackKingdom has only been observed being delivered as a secondary payload in human-operated attacks on vulnerable Exchange servers. These campaigns begin with the attackers deploying public ProxyLogon exploits against exposed systems before dropping a webshell once they've gained access. They then execute a large PowerShell command - via the webshell - which decodes into a script, that then downloads a BlackKingdom EXE file.
Activities
Once installed, BlackKingdom will attempt to terminate any services or processes with SQL in their name. It then generates an encryption key and uploads it along with system information to an account on the Mega file sharing platform. If this fails, BlackKingdom will instead use a hardcoded key.
All reachable non-systems files, including those on mounted drives, are then encrypted. Any files that are open are also deleted to prevent any possibility of recovery. BlackKingdom will also attempt to delete any Windows Event logs once encryption is complete.
Remediation advice
If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:
- Critical data is frequently saved in multiple backup locations.
- At least one backup is kept offline at any time (separated from live systems).
- Backups and incident recovery plans are tested to ensure that data can be restored when needed.
- User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
- Infected systems are disconnected from the network and powered down as soon as practicable.
- Any user account credentials that may have been compromised should be reset on a clean device
- Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.
Additionally, to prevent and detect an infection, NHS Digital advises that:
- Secure configurations are applied to all devices.
- Security updates are applied at the earliest opportunity.
- Tamper protection settings in security products are enabled where available.
- Obsolete platforms are segregated from the rest of the network.
- IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
- Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
- Administrative accounts are only used for necessary purposes.
- Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
- Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.
Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.
Indicators of compromise
Last edited: 25 March 2021 11:43 am