LockBit 2.0: How This RaaS Operates and How to Protect Against It

unit42.paloaltonetworks.com · Undated · Licence: TRAM repository license; underlying reports not cleared for redistribution

Read the original ↗

CVEs this report names

4 CVEs

CVE-2021-34473Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing Application T1053.005Scheduled Task+3 more · 9 reports
>99.9%Top 0.01%
89.4priority
CVE-2021-34523Microsoft Exchange Server Privilege Escalation Vulnerability
Microsoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing Application9 reports
>99.9%Top 0.01%
89.3priority
CVE-2020-0787Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability
Microsoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1059Command and Scripting Interpreter T1068Exploitation for Privilege Escalation1 report
42.5%Top 1.3%
82.1priority
CVE-2021-20028SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability
SonicWall · Secure Remote Access (SRA)KEVRansomwareCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter1 report
30.1%Top 1.8%
78.4priority

Where it names them

CVE-2021-34473

Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.

Original ↗

CVE-2021-34523

The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.

Original ↗

CVE-2020-0787

The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.

Original ↗

CVE-2021-20028

Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.

Original ↗

Techniques drawn from this report

2 links, in kill-chain order

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2020-0787

MITRE CTID mapping of the KEV entry

ion for Privilege Escalation The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.

Original ↗

Privilege Escalation Exploitation for Privilege Escalation T1068 for CVE-2021-34523

Labelled by dataset annotators

ion for Privilege Escalation The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.

Original ↗