Ransomware Deployment Attempts Via TeamViewer | Huntress

Category	Details
Threat Actors	Unknown actor, possibly related to LockBit 3.0 Ransomware campaigns.
Campaign Overview	Limited ransomware deployment on two endpoints via TeamViewer access; minimal reconnaissance or lateral movement.
Target Regions (Or Victims)	Specific endpoints within organizations; no specific geography mentioned.
Methodology	– Initial access via TeamViewer. – Execution of ransomware using DOS batch files and DLLs. – Limited to endpoint activity without lateral spread.
Product Targeted	Endpoints running TeamViewer with inadequate monitoring or outdated access management.
Malware Reference	Ransomware executable: LB3_Rundll32_pass.dll, associated with LockBit 3.0.
Tools Used	– TeamViewer for initial access. – Batch files to execute DLLs. – Ransomware binaries (LB3.exe, ZZZZZZZ).
Vulnerabilities Exploited	Misuse of remote access software (TeamViewer) due to weak access controls.
TTPs	– Remote access abuse (T1133). – Ransomware execution via command shell (T1059.003). – Data encrypted for impact (T1486).
Attribution	Similarities to LockBit 3.0 ransomware as highlighted in VMware’s research from October 2022.
Recommendations	– Audit and monitor remote access tools. – Implement strong authentication for administrative access. – Keep endpoint security software updated.
Source	Huntress Blog

---

Read full article: Read More

Disclaimer: The above summary has been generated by an AI language model.