Microsoft warns of hackers using BitLocker for ransom attacks
Microsoft has issued an alert about a new threat from a hacker group dubbed DEV-0270, also known as Nemesis Kitten. The group misuses BitLocker to encrypt files on compromised devices.
Ransom attacks
DEV-0270 is said to be a spin-off from an Iranian hacking group also known as Phosphorus. Whoever is behind the new threat, the attackers use various vulnerabilities to infiltrate Windows devices and entire networks and then launch a ransomware attack (via Bleeding computer). So the hackers want to extort ransom money for the release of their victims’ data. “DEV-0270 exploits high severity vulnerabilities to gain access to devices and has been known to exploit newly discovered vulnerabilities early on,” Microsoft said in the alert posted in the Security Blog was published.
Search for vulnerable systems
For the Microsoft Security Threat Intelligence team, one factor, in particular, was new and ominous in discovering the group’s activity: the attackers initially targeted victims, their servers, and devices for vulnerabilities in Microsoft Exchange Server, Fortinet FortiGate SSL-VPN, and Apache -Log4j are vulnerable and then use Windows’ own BitLocker security tool to harm their victims. “DEV-0270 leverages living-off-the-land binaries (LOLBINs) for credential detection and access throughout the attack chain. This extends to abusing the built-in BitLocker tool to encrypt files on compromised devices .” The use of BitLocker and DiskCryptor by Iranian actors was first discovered in early May this year.
The attackers elevate system-level privileges, which also allows them to disable Microsoft Defender and other antivirus software to evade their detection. “The threat group commonly uses native WMI, net, CMD, and PowerShell commands and registry configurations to maintain stealth and operational security,” Microsoft explained. “They also install and disguise their custom binaries as legitimate processes to hide their presence.”
To protect yourself from these attackers, Microsoft recommends installing all patches offered, checking passwords for security, and carrying out regular data backups.
Research Snipers is currently covering all technology news including Google, Apple, Android, Xiaomi, Huawei, Samsung News, and More. Research Snipers has decade of experience in breaking technology news, covering latest trends in tech news, and recent developments.
