New Cring Ransomware Virus Attacks Fortinet VPN Gateways – Bits Media

Kaspersky Lab specialists have published a report on the new ransomware Cring, whose operators exploit a vulnerability in older versions of Fortinet VPN gateways.

Cring operators exploit CME-2018-13379 vulnerability in Fortinet SSL VPN devices to gain access to victim networks. Then, using the modified Mimikatz utility, they receive logins and users passwords with administrative privileges and infect the IT infrastructure of the attacked company.

“Among the victims of the new viral campaign were industrial corporations from Europe. In at least one case, the infection led to the temporary cessation of production, Since servers, used in production, were encrypted by the virus ", - reported in the report.

After receiving access to the server in an attacked company, attackers load the Cring virus-skeletter via the PowerShell script.. The virus turns off some services and closes the applications, To remove file locks and completely encrypt the data on the server. for instance, He stops the services of backup systems, as well as database service.

For encryption, RSA-8192 and AES-128 algorithms are used.. After the end of the encryption process, files appear in the directories !!!!!Readme.rtf и Dereadme!!!.TXT with a request. The files are indicated, that the "usual purchase size" is 2 BTC, However, in case of infection of large -scale infrastructure, the size of the ransom increases.

The vulnerability of CME-2018-13379 in Fortinet devices was closed in May 2019 of the year. Representatives of the company called on all users of its products immediately update the gateways, If this was not done before.

Recently, several American universities recently reported
On the leak of personal and financial data in the hands of operators of the Clop-Sipper virus. Hackers took advantage of the vulnerability in solving data transfer by Accallion File Transfer Appliance.