GandCrab Ransomware Found Targeting MySQL Databases

Security researchers saw a spate of attacks targeting Windows servers running MySQL databases to infect them with the GandCrab ransomware (detected by Trend Micro as Ransom.Win32.GANDCRAB.SMILC). The attacks, which were first uncovered last May 19 via honeypots, entail scanning internet-facing MySQL databases and checking if they're running on Windows operating systems. Malicious SQL commands are then executed to upload a file that will retrieve and help execute the ransomware.

According to Sophos’ Andrew Brandt, who observed the intrusions, the scanning activities search for unsecure or misconfigured MySQL databases or firewalls. This includes attacks on MySQL servers that have exposed port 3306, the default port that MySQL uses.

Brandt noted that the versions/samples of GandCrab involved in the attacks were already downloaded over 2,300 times. While the numbers are relatively low, the attack still poses significant security risks. MySQL is a ubiquitous database technology with a reported market share of over 50%.

[Executive Brief: Ransomware as a Service Offered in the Deep Web: What This Means for Enterprises]

GandCrab itself has used different attack vectors since it was first seen using exploit kits like Rig and GrandSoft. GandCrab’s operators have used malvertisements on file-sharing websites, newly developed exploit kits like Fallout, JavaScript malware, and spam attachments to deliver the ransomware. The range of attack vectors makes it a prevalent ransomware threat — GandCrab was the most detected ransomware family in North America in 2018.

This is not surprising, as GandCrab’s authors reportedly peddle the ransomware as a service in the cybercriminal underground. This means GandCrab’s affiliates can distribute their version of the ransomware beyond exploit kits and spam. More recently, cybercriminals were seen targeting hosts installed with vulnerable Confluence collaboration software.

GandCrab isn’t the first to target MySQL databases. An iteration of the notorious Cerber, for instance, also targets database programs and encrypts related files. There are also the cyberextortioncampaigns that targeted poorly secured MongoDB databases. The attacks involve identifying publicly and remotely accessible MongoDB databases, deleting their contents, then extorting their owners. 

[RELATED NEWS: MegaCortex Ransomware Spotted Attacking Enterprise Networks]

While ransomware may not be as pervasive as it was before, GandCrab’s latest activity shows how the stakes are getting higher. Ransomware attacks — as shown by LockerGoga and separate incidents in U.S. counties — are increasingly becoming more targeted, and its impact more significant. Given how ransomware would sometimes need only a single weak link to infect an enterprise’s online infrastructure, organizations should adopt defense-in-depth practices such as regularly backing up data; keeping the system updated and patched; securing the use of system administration tools; and ensuring that the database is properly configured. MySQL, for instance, has several guidelines and recommendations on how to secure it.

Trend Micro Ransomware Solutions

Enterprises can benefit from a multilayered approach to best mitigate the risks brought by ransomware. At the endpoint level, Trend Micro™ Smart Protection Suites deliver several capabilities like high-fidelity machine learning, behavior monitoring and application control, and vulnerability shielding that minimize the impact of this threat. Trend Micro Deep Discovery™ Inspector detects and blocks ransomware on networks, while the Trend Micro Deep Security™ solution stops ransomware from reaching enterprise servers — whether physical, virtual, or in the cloud.  Trend Micro Deep SecurityVulnerability Protection, and TippingPoint provide virtual patching that protects endpoints from threats that exploit unpatched vulnerabilities to deliver ransomware. Email and web gateway solutions such as Trend Micro Deep Discovery Email Inspector and InterScan™ Web Security prevent ransomware from ever reaching end users.

These solutions are powered by Trend Micro XGen™ security, which provides a cross-generational blend of threat defense techniques against a full range of threats for data centerscloud environmentsnetworks, and endpoints. Smart, optimized, and connected, XGen powers Trend Micro’s suite of security solutions: Hybrid Cloud Security, User Protection, and Network Defense. 

HIDE

Like it? Add this infographic to your site:
1. Click on the box below.   2. Press Ctrl+A to select all.   3. Press Ctrl+C to copy.   4. Paste the code into your page (Ctrl+V).

Image will appear the same size as you see above.