Skip to main content

Cring Ransomware

Cring is a newly observed ransom tool delivered via targeted attacks on vulnerable FortiGate VPN gateways.

Threat ID:
CC-3818
Category:
Ransomware
Threat Severity:
Medium
Published:
13 April 2021 4:02 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Cring is a newly observed ransom tool delivered via targeted attacks on vulnerable FortiGate VPN gateways.

Affected platforms

The following platforms are known to be affected:

Versions: all supported

Microsoft Windows

Threat details

Introduction

First observed in early 2021, Cring (also known as Crypt3r, Ghost, Phantom, or Vjiszy1lo) is a ransomware toll operated by a currently unknown attacker, who is using it in campaigns targeting exposed VPN products.

Delivery

Cring is delivered in human-operated attacks against vulnerable Fortinet systems. The group behind the attacks initially gain access to the underlying network by exploiting CVE-2018-13379, a path traversal vulnerability affecting FortiGate virtual private network (VPN) gateways.

They then deploy the mimikatz credential harvester to obtain administrator credentials, before using these in conjunction with the Cobalt Strike penetration testing platform to propagate to connected devices. Only once this is done will they attempt to install Cring.

Activities

Once installed on a target system, Cring will attempt to terminate a number of recovery and databases services, as well as any processes related to Microsoft Office. It will also terminate the SstpSvc, used to create VPN connections, likely to prevent any interference from administrators during encryption.

If successful, Cring then extracts any files with extensions matching a hardcoded list as well as any files or folders with names starting with “backup” or “Backup”. It then encrypts all files matching a separate list using an AES-128 implementation, the key for which is then encrypted using RSA-8192.

Remediation advice

If a device on your network becomes infected with ransomware it will begin encrypting files, which may also include remote files on network locations. The only guaranteed way to recover from a ransomware infection is to restore all affected files from their most recent backup. To limit the impact of a ransomware infection, NHS Digital advises that:

  • Critical data is frequently saved in multiple backup locations.
  • At least one backup is kept offline at any time (separated from live systems).
  • Backups and incident recovery plans are tested to ensure that data can be restored when needed.
  • User account permissions for modifying data are regularly reviewed and restricted to the minimum necessary.
  • Infected systems are disconnected from the network and powered down as soon as practicable.
  • Any user account credentials that may have been compromised should be reset on a clean device
  • Where infected systems cannot be quarantined with confidence, then an affected organisation should disconnect from national networks to limit propagation.

Additionally, to prevent and detect an infection, NHS Digital advises that:

  • Secure configurations are applied to all devices.
  • Security updates are applied at the earliest opportunity.
  • Tamper protection settings in security products are enabled where available.
  • Obsolete platforms are segregated from the rest of the network.
  • IT usage policies are reinforced by regular training to ensure all users know not to open unsolicited links or attachments.
  • Multi-factor authentication (MFA) and lockout policies are used where practicable, especially for administrative accounts.
  • Administrative accounts are only used for necessary purposes.
  • Remote administration services use strongly encrypted protocols and only accept connections from authorised users or locations.
  • Systems are continuously monitored, and unusual activity is investigated, so that a compromise of the network can be detected as early as possible.

Please note that NCSC maintains guidance for securely configuring a wide range of end user device (EUD) platforms. For further details refer to their end user device security guidance pages.

Indicators of compromise

Network indicators

IP addresses

  • 129.227.156[.]216
  • 129.227.156[.]214
  • 198.12.112[.]204
  • 45.67.231[.]128
Host indicators

Filepaths

  • %temp%\execute.bat

MD5 hashes

  • 317098d8e21fa4e52c1162fb24ba10ae
  • 44d5c28b36807c69104969f5fed6f63f
  • c5d712f82d5d37bb284acd4468ab3533

Last edited: 14 April 2021 2:57 pm