Dive Brief:
- Federal authorities on Wednesday warned that Ghost ransomware has compromised organizations as recently as January by exploiting older vulnerabilities to attack internet-facing services that rely on outdated software and firmware.
- The China-linked threat group, also known as Cring, has targeted a range of critical infrastructure providers including schools, healthcare providers, governments and manufacturers since 2001, according to an advisory led by the FBI and Cybersecurity and Infrastructure Security Agency.
- The threat group has leveraged vulnerabilities in Fortinet FortiOS, Adobe ColdFusion, Microsoft SharePoint and Microsoft Exchange, according to the joint advisory.
Dive Insight:
The advisory is part of an ongoing series of warnings from CISA and the FBI about financially motivated groups targeting key industries.
Ghost threat actors are known to upload web shells to compromised servers and leverage Windows Command Prompt or PowerShell to download Cobalt Strike, according to the advisory. The attackers typically only spend a few days on targeted networks, often deploying ransomware on the day of the initial compromise.
The threat group exploited older vulnerabilities, including CVE-2018-13379, CVE-2010-2861, CVE-2021-31207, CVE-2021-34473 and others.
Authorities recommend security teams take the following actions to protect against attacks:
- Segment networks to restrict lateral movement.
- Mandate phishing-resistant multifactor authentication for access to privileged accounts and email service accounts.
- Monitor for unauthorized use of PowerShell.
- Disable unused ports to limit exposure.
