{"id":44489,"date":"2021-12-17T22:02:00","date_gmt":"2021-12-17T22:02:00","guid":{"rendered":"http:\/\/8bd287ee-6cbd-4a53-85b1-7887638f3af4"},"modified":"2021-12-17T22:02:00","modified_gmt":"2021-12-17T22:02:00","slug":"log4j-conti-ransomware-attacking-vmware-servers-and-tellyouthepass-ransomware-hits-china","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/log4j-conti-ransomware-attacking-vmware-servers-and-tellyouthepass-ransomware-hits-china\/","title":{"rendered":"Log4j: Conti ransomware attacking VMware servers and TellYouThePass ransomware hits China"},"content":{"rendered":"

Researchers with security firm Advanced Intelligence have discovered the Conti ransomware group exploiting VMware vCenter Server instances through the Log4j vulnerabilities<\/a>. <\/p>\n

In a report on Friday<\/a>, the security company said it discovered multiple members of Conti discussing ways to take advantage of the Log4j issue, making them the first sophisticated ransomware group spotted trying to weaponize the vulnerability. <\/p>\n

AdvIntel said the current exploitation “led to multiple use cases through which the Conti group tested the possibilities of utilizing the Log4J2 exploit.” <\/p>\n

“Most importantly, AdvIntel confirmed that the criminals pursued targeting specific vulnerable Log4J2 VMware vCenter for lateral movement directly from the compromised network resulting in vCenter access affecting US and European victim networks from the pre-existent Cobalt Strike sessions,” the researchers said. <\/p>\n

They noted that their research of ransomware logs shows Conti made over $150 million in the last six months. AdvIntel laid out a timeline of events for Conti’s interest in Log4j starting on November 1, when the group sought to find new attack vectors. Throughout November, Conti redesigned its infrastructure as it sought to expand and by December 12, they identified Log4Shell as a possibility. <\/p>\n

By December 15, they began actively targeting vCenter networks for lateral movement. <\/p>\n

\"screen-shot-2021-12-17-at-5-00-39-pm.png\"<\/span>