A brand new knowledge extortion group tracked as Mad Liberator is concentrating on AnyDesk customers and runs a faux Microsoft Home windows replace display screen to distract whereas exfiltrating knowledge from the goal gadget.
The operation emerged in July and though researchers observing the exercise didn’t seen any incidents involving knowledge encryption, the gang notes on their knowledge leak website that they use AES/RSA algorithms to lock information.
Supply: BleepingComputer
Focusing on AnyDesk customers
In a report from cybersecurity firm Sophos, researchers say {that a} Mad Liberator assault begins with an unsolicited connection to a pc utilizing AnyDesk distant entry utility, which is well-liked amongst IT groups managing company environments.
It’s unclear how the risk actor selects its targets however one principle, though but to be confirmed, is that Mad Liberator tries potential addresses (AnyDesk connection IDs) till somebody accepts the connection request.
Supply: Sophos
As soon as a connection request is authorized, the attackers drop on the compromised system a binary named Microsoft Home windows Replace, which exhibits a faux Home windows Replace splash display screen.
Supply: Sophos
The one function of the ruse is to distract the sufferer whereas the risk actor makes use of AnyDesk’s File Switch software to steal knowledge from OneDrive accounts, community shares, and the native storage.
Through the faux replace display screen, the sufferer’s keyboard is disabled, to stop disrupting exfiltration course of.
Within the assaults seen by Sophos, which lasted roughly 4 hours, Mad Liberator didn’t carry out any knowledge encryption within the post-exfiltration stage.
Nevertheless, it nonetheless dropped ransom notes on the shared community directories to make sure most visibility in company environments.
Supply: Sophos
Sophos notes that it has not seen Mad Liberator work together with the goal previous to the AnyDesk connection request and has logged no phishing makes an attempt supporting the assault.
Relating to Mad Liberator’s extortion course of, the risk actors declare on their darknet website that they first contact breached companies providing to “help” them repair their safety points and get well encrypted information if their financial calls for are met.
If the victimized firm doesn’t reply in 24 hours, their identify is revealed on the extortion portal and are given seven days to contact the risk actors.
After one other 5 days because the ultimatum has been issued handed and not using a ransom cost, all stolen information are revealed on the Mad Liberator web site, which at the moment lists 9 victims.
