✕
Request a Demo
Rewterz
Rewterz Threat Alert – Lazarus APT Group – IOCs
March 4, 2022
Rewterz
Rewterz Threat Alert – Avaddon Ransomware – Active IOCs
March 7, 2022

Rewterz Threat Alert – Conti Ransomware is Actively Exploiting Microsoft Vulnerabilities

Severity

High

Analysis Summary

Conti ransomware was discovered in December 2019 and is delivered via TrickBot. It’s been utilized against large companies and government institutions across the world, especially in North America. Conti steals important files and information from targeted networks and threatens to disseminate it unless the ransom is paid. Conti ransomware enhances performance by utilizing “up to 32 simultaneous encryption operations,” and is very likely directly controlled by its controllers. This ransomware can target network-based resources while ignoring local files. This feature has the noticeable impact of being able to create targeted harm in an environment in a way that might hinder incident response actions.

Conti Ransomware is actively exploited the following vulnerabilities:

CVE-2021-1675 

Microsoft Windows could allow a remote attacker to gain elevated privileges on the system, caused by a flaw in the Print Spooler component. By persuading a victim to open specially-crafted content, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

CVE-2022-21882

Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the Win32k component. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to execute arbitrary code with higher privileges.

Image

Impact

  • File Encryption
  • Cyber Espionage
  • Privilege Escalation

Affected Vendors

  • Microsoft

Affected Products

  • Microsoft Windows Server 2008 SP2 x32
  • Microsoft Windows Server 2008 SP2 x64
  • Microsoft Windows 7 SP1 x32
  • Microsoft Windows 7 SP1 x64

Indicators of Compromise

CVE

  • CVE-2021-1675
  • CVE-2022-21882

Remediation

  • Search for IOCs in your environment.
  • Block all threat indicators at your respective controls
  • According to the Security Researcher, here’s a method to check the CVE-2021-1675& CVE-2022-21882

For patches and security updates visit:

CVE-2021-1675

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2021-1675

CVE-2022-21882

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21882