From malware.news
Ransomware is used widely in cyberattacks to disrupt the victim’s organization. Over the last two years, many attackers have evolved their ransomware tactics to include data exfiltration. This tactic is known as “double-extortion”: attackers demand ransom for the data decryption in addition to the ransom to prevent public release of the stolen data. ThreatLabz monitors these threat actors and analyzes the attack sequences of double extortion attacks. AtomSilo is a new player on the scene, and in this blog, we’ll break down the details of their attacks.
Introduction
AtomSilo ransomware emerged around September 2021, with their tactics including exfiltrating and publishing their first victim’s data.
We’ll break down one of their attacks, which started with initial access through exploiting a vulnerability in Atlassian’s Confluence collaboration software. The ransomware operators planted a back door using legitimate software via a dll side loading technique. The backdoor allowed remote code execution of Windows Shell commands through WMI (Windows Management Interface), which operators exploited using compromised administrative accounts before dropping AtomSilo.