Ransomware Group policies enable ransomware spread LockBit 2.0 ransomware can spread across a local network through group policies created on a hijacked domain controller. Hugh Aver July 30, 2021 The creation of ransomware became an underground industry some time ago, with technical support service, press centers, and advertising campaigns. As with any other industry, creating a competitive product requires continual improvement. LockBit, for example, is the latest in a series of cybercrime groups advertising the ability to automate infection of local computers through a domain controller. LockBit follows the Ransomware as a Service (RaaS) model, providing its clients (the actual attackers) with infrastructure and malware, and receiving a share of the ransom. Breaking in to the victim’s network is the contractor’s responsibility, and as far as the ransomware’s distribution across the network, LockBit has designed a fairly interesting technology. LockBit 2.0’s distribution After the attackers gain access to the network and reach the domain controller, Bleeping Computer reports, they run their malware on it, creating new user group policies, which are then automatically pushed to each device on the network. The policies first disable the operating system’s built-in security technology. Other policies then create a scheduled task on all Windows machines to run the ransomware executable. Bleeping Computer cites researcher Vitali Kremez as saying that the ransomware uses the Windows Active Directory API to perform Lightweight Directory Access Protocol (LDAP) queries to get a list of computers. LockBit 2.0 then bypasses User Account Control (UAC) and runs silently, without triggering any alerts on the device being encrypted. Apparently, this represents the first-ever spread of mass-market malware through user group policies. In addition, LockBit 2.0 delivers ransom notes rather whimsically, by printing the note on all printers connected to the network. How can I protect my company from similar threats? Keep in mind that a domain controller is really a Windows server, and as such, it needs protection. Kaspersky Security for Windows Server, which comes with most of our endpoint security solutions for business and protects servers running Windows from most modern threats, should be part of your arsenal. Ransomware spreading through group policies represents the last stage of an attack, however. Malicious activity should become apparent much earlier on, for example when attackers first enter the network or attempt to hijack the domain controller. Managed Detection and Response solutions are particularly effective at detecting the signs of that type of attack. Most important, cybercriminals often use social engineering techniques and phishing e-mail to get initial access. To keep your employees from falling for such tricks, improve their cybersecurity awareness with regular training.
Read next How to protect your credit card from a young gamer In computer games, where does the money go — and what can you do about it?
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.
Tips Nine reasons to set up a VPN on your router Get the most speed, reliability, and convenience out of your VPN by putting it on your router. Here’s a look at the real benefits of specific VPN setup scenarios for your whole home network.
Tips Fact and fiction about hidden Wi-Fi network names Hiding your Wi-Fi network name might seem like a smart security move, but in practice it does more harm than good. Let’s take a look at how it works, what side effects it can have, and how to properly secure your home Wi-Fi.