A brand new information extortion group tracked as Mad Liberator is focusing on AnyDesk customers and runs a pretend Microsoft Home windows replace display screen to distract whereas exfiltrating information from the goal system.
The operation emerged in July and though researchers observing the exercise didn’t seen any incidents involving information encryption, the gang notes on their information leak web site that they use AES/RSA algorithms to lock recordsdata.
Supply: BleepingComputer
Concentrating on AnyDesk customers
In a report from cybersecurity firm Sophos, researchers say {that a} Mad Liberator assault begins with an unsolicited connection to a pc utilizing AnyDesk distant entry utility, which is common amongst IT groups managing company environments.
It’s unclear how the risk actor selects its targets however one concept, though but to be confirmed, is that Mad Liberator tries potential addresses (AnyDesk connection IDs) till somebody accepts the connection request.
Supply: Sophos
As soon as a connection request is accepted, the attackers drop on the compromised system a binary named Microsoft Home windows Replace, which reveals a pretend Home windows Replace splash display screen.
Supply: Sophos
The one function of the ruse is to distract the sufferer whereas the risk actor makes use of AnyDesk’s File Switch device to steal information from OneDrive accounts, community shares, and the native storage.
In the course of the pretend replace display screen, the sufferer’s keyboard is disabled, to stop disrupting exfiltration course of.
Within the assaults seen by Sophos, which lasted roughly 4 hours, Mad Liberator didn’t carry out any information encryption within the post-exfiltration stage.
Nevertheless, it nonetheless dropped ransom notes on the shared community directories to make sure most visibility in company environments.
Supply: Sophos
Sophos notes that it has not seen Mad Liberator work together with the goal previous to the AnyDesk connection request and has logged no phishing makes an attempt supporting the assault.
Concerning Mad Liberator’s extortion course of, the risk actors declare on their darknet web site that they first contact breached companies providing to “assist” them repair their safety points and get well encrypted recordsdata if their financial calls for are met.
If the victimized firm doesn’t reply in 24 hours, their identify is revealed on the extortion portal and are given seven days to contact the risk actors.
After one other 5 days for the reason that ultimatum has been issued handed with no ransom fee, all stolen recordsdata are revealed on the Mad Liberator web site, which at present lists 9 victims.
