Behind the attacks appears to be a new ransomware gang called LockFile that was first seen in July, which shows some resemblance and references to other groups in the business was reported by bleeping computer.

LockFile attacks have been recorded mostly in the U.S. and Asia, its victims including organizations in the following sectors: financial services, manufacturing, engineering, legal, business services, travel, and tourism.

Security researchers at Symantec, a division of Broadcom, said that the actor’s initial access on the network is through Microsoft Exchange servers.

Symantec’s analysis of the attack did not reveal the exact method but they provided an IP address (209.14.0[.]234) that security researcher Kevin Beaumont saw in attacks that exploited the ProxyShell vulnerability since August 13. Beaumont also published a detailed blog post about multiple actors exploiting ProxyShell. 

Next, the attacker takes over the organization’s domain controller by leveraging the new PetitPotam method, which forces authentication to a remote NTLM relay under LockFile’s control.

Discovered by security researcher Gilles Lionel in July, PetitPotam has a few variations that Microsoft kept trying to block. At this point, the official mitigations and updates do not completely block the PetitPotam attack vector.

LockFile threat actor seems to rely on publicly available code to exploit the original PetitPotam (tracked as CVE-2021-36942) variant.

Once the attackers successfully take over the domain controller, they effectively have control over the entire Windows domain and can run any command they wish.

Symantec says in a blog post today that the ransom note from LockFile ransomware is very similar to the one used by the LockBit ransomware group.

Furthermore, it looks like the new gang also makes a not-so-subtle reference to the Conti gang in the contact email address they leave for the victim: contact@contipauper[.]com.

The post PetitPotam attack used by Lockbit gang to hijack Windows domains appeared first on CyberHood Sentinel.

Gilles Lionel a French Researcher discovered that PrtitPotam is a new method that can be used to conduct and NTLM relay attack. The POC was displayed along with the script used to perform the attack.

The new attack uses the Microsoft Encrypting File System Remote Protocol (EFSRPC) to force a device, including domain controllers, to authenticate to a remote NTLM relay controlled by a threat actor.

Once a device authenticates to a malicious NTLM server, a threat actor can steal hash and certificates that can be used to assume the identity of the device and its privileges.

Mitigation for Domain Controllers

Microsoft published a security advisory with recommendations for organizations that needs to protect its assets against this attack.

The attackers are targeting the NTLM authentication enabled on the domain and are using Active Directory Certificate Services (AD CS) with Certificate Authority Web Enrollment or Certificate Enrollment Web Service.

Microsoft recommends disabling NTLM where it is not necessary, e.g. Domain Controllers, or to enable the Extended Protection for Authentication mechanism to protect credentials on Windows machines.

The company also recommends on networks with NTLM enabled that services allowing NTLM authentication to use signing features such as SMB signing that’s been available since Windows 98.

PetitPotam is about abusing the EfsRpcOpenFileRaw function of the MS-EFSRPC API to pass on authentication requests, leaving the door open for other attacks.

Microsoft’s advisory is clear about the action to prevent NTLM relay attacks but does not address the abuse of the MS-EFSRPC API, which would need a security update to fix.

It is noted by the various security researchers that EFSRPC protocol is not even mentioned in the Microsoft advisory.

The post Mitigations for new PetitPotam NTLM relay attack appeared first on CyberHood Sentinel.