Connect with us

Hi, what are you looking for?


TellYouThePass ransomware revived in Linux, Windows Log4j attacks

Log4j logo

TellYouThePass ransomware revived in Linux, Windows Log4j attacks

Threat actors have revived an old and relatively inactive ransomware family known as TellYouThePass, deploying it in attacks against Windows and Linux devices targeting a critical remote code execution bug in the Apache Log4j library.

KnownSec 404 Team’s Heige first reported these attacks on Twitter on Monday after observing that the ransomware was dropped on old Windows systems using exploits abusing the flaw tracked as CVE-2021-44228 and known as Log4Shell.

Heige’s report was confirmed by the Sangfor Threat Intelligence Team, who successfully captured one of the TellYouThePass ransomware samples deployed in attacks using Log4Shell exploits mostly impacting Chinese targets, according to Curated Intelligence.

As they further discovered (findings that CronUP’s Germán Fernández also confirmed), the ransomware has a Linux version that harvests SSH keys and moves laterally throughout victims’ networks.

“It is worth noting that this is not the first time that Tellyouthepass ransomware has used high-risk vulnerabilities to launch attacks,” Sangfor researchers said. “As early as last year, it had used Eternal Blue vulnerabilities to attack multiple organizational units.”

Other security researchers [12] have also analyzed one of the ransomware samples deployed in these attacks and tagged it as “likely belonging” to the TellYouThePass family.

According to submission stats to the ID Ransomware service, TellYouThePass ransomware has seen a massive and sudden spike in activity after Log4Shell proof-of-concept exploits were released online.

Advertisement. Scroll to continue reading.
TellYouThePass ransomware submissions
TellYouThePass ransomware submissions (ID Ransomware)

Log4Shell exploited in ransomware attacks

TellYouThePass is not the first ransomware strain deployed in Log4Shell attacks since financially-motivated attackers began injecting Monero miners on compromised systems and state-backed hackers started exploiting it to create footholds for follow-on activity.

BitDefender first reported they found a new ransomware family (tagged by some as a wiper) they dubbed Khonsari being installed directly via Log4Shell exploits.

The Microsoft 365 Defender Threat Intelligence Team also saw Khonsari ransomware payloads dropped on self-hosted Minecraft servers.

Last but not least, Conti ransomware operators have also added a Log4Shell exploit to their arsenal to move laterally through targets’ networks, gain access to VMware vCenter Server instances, and encrypt virtual machines.

In related news, CISA ordered Federal Civilian Executive Branch agencies today to patch their systems against the Log4Shell vulnerability within the next six days, until December 23.

The cybersecurity agency has also recently added the flaw to its Known Exploited Vulnerabilities Catalog, which also requires expedited action from federal agencies to mitigate the bug until December 24.

Source link

Click to comment

Leave a Reply


Loan And Finance

Electric vehicles are becoming increasingly popular as gas prices skyrocket. In fact, automakers plan to pivot to largely electric lineups in the coming decade,...

Top Stories

The past week in the decentralized finance (DeFi) ecosystem was dominated by Terra’s collapse and its aftermath on various ecosystems it was connected. Now...


Why it matters: Opportunities to increase RAM performance typically come from the extreme memory profile (XMP) set by the manufacturer or enthusiasts with enough...

Top Stories

What is a DAO? A DAO, or decentralized autonomous organization, is an online-based organization that exists and operates with no single leader or governing...


Source: Nintendo Sequels are usually perceived in one of two ways. Either they greatly improve on those who came before them, making their predecessors...

Top Stories

The dramatic story of the Terra (LUNA) crash — referred to by some as the Lehman Brothers of crypto — has taken yet another remarkable...


You May Also Like


Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...