Unpatched VPN makes Travelex latest victim of “REvil” ransomware
In April of 2019, Pulse Secure issued an urgent patch to a vulnerability in its popular corporate VPN software—a vulnerability that not only allowed remote attackers to gain access without a username or password but also to turn off multi-factor authentication and view logs, usernames, and passwords cached by the VPN server in plain text. Now, a cybercriminal group is using that vulnerability to target and infiltrate victims, steal data, and plant ransomware.
Travelex, the foreign currency exchange and travel insurance company, appears to be the latest victim of the group. On New Year’s Eve, the company was hit by Sodinokibi ransomware, also known as REvil. The ransomware operators contacted the BBC and said they want Travelex to pay $6m (£4.6m). They also claimed to have had access to Travelex’s network for six months and to have extracted five gigabytes of customer data—including dates of birth, credit card information, and other personally identifiable information.
“In the case of payment, we will delete and will not use that [data]base and restore them the entire network,” the individual claiming to be part of the Sodinokibi operation told the BBC. “The deadline for doubling the payment is two days. Then another seven days and the sale of the entire base.”
Security researcher Kevin Beaumont found that Travelex had seven unpatched Pulse Secure servers. An exploit for the vulnerability has been available on Internet bulletin boards since August of 2019.
Big game hacks
Travelex is not the only victim being hit with big ransom demands. Since January 1, seven victims have been added to the REvil scoreboard:
REvil is starting the year strong, asking for some serious cash. We are working on a blog describing just how bad it is, hoping to launch end of the month.
cc @GossiTheDog pic.twitter.com/0Katzxd7aW
— rik van duijn (@rikvduijn) January 6, 2020
The Sodinokibi/REvil ransomware campaign emerged last spring. It was first identified by Cisco Talos in April of 2019 in an attack that exploited an Oracle WebLogic server vulnerability. The ransomware itself exploits a vulnerability in Windows’ Win32k component that allows elevation of its privileges, allowing it to kill a list of processes that could keep it from encrypting files, wipe the contents of some folders, and encrypt the contents of others—including network shares.
The malware also sends back basic information about the infected system. But REvil does not itself have any means of self-propagation. Instead, the attackers have used various methods of access to install and launch the malware with increasing levels of sophistication, including spam campaigns, attacks on Remote Desktop Protocol services, and in several cases the exploitation of managed service providers, to attack their customers.
Based on data from the Shodan security search engine, there are still over a thousand vulnerable Pulse Secure servers being operated by organizations in the US, despite warnings from the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency in October. More attacks like the one that hit Travelex seem inevitable.
