#Sophos won t update code
#Sophos won t update windows

Don't make life easy for cybercriminals.' If organizations have these devices anywhere on their network, they can be sure that cyberattackers will be attracted to them.

This is a stark reminder that IT administrators benefit from having an accurate inventory of all their connected assets and cannot leave out-of-date critical business systems facing the public internet. 'But, regardless of what the status is - in use or inactive - unpatched internet-facing servers or other devices are prime targets for cyberattackers scanning a company's attack surface for vulnerable entry points. Often the most vulnerable devices are inactive or ghost machines, either forgotten about or overlooked when it comes to patching and upgrades,' Brandt said. The surprising thing is that this server was in active daily use. 'In the incident we researched, the target was a services company, and all it took to break in was one internet-facing machine running old, out-of-date and unpatched software.

The hackers were also able to get access to timesheets and accounting data for payroll before breaching the internet-facing server in minutes and executing the ransomware 79 hours later.ДЄndrew Brandt, principal researcher at Sophos, said the Cring ransomware isn't new, but it's uncommon. Then, they waited two and a half days, came back into the company's network, gave themselves Admin privileges and posted a sardonic ransom note.

#Sophos won t update code

They grabbed a file called 'password properties,' and wrote garbled code on top of their 'footprints' to cover their tracks. Three minutes later, they were able to exploit a vulnerability in the outdated Adobe program that allowed them to get their hands on files from servers that weren't supposed to be publicly available. The hackers used their automated tools to browse 9,000 pathways into the company's systems in 75 seconds. Sophos was able to tie the group using the Cring ransomware to hackers in Belarus and Ukraine that used automated tools to break into the servers of an unnamed company in the services sector. Sophos released a report in September highlighting one specific incident where Cring operators exploited a vulnerability in an 11-year-old installation of Adobe ColdFusion 9 to take control of a ColdFusion server remotely. This and previous attacks also showcase the continued adoption and use of Cobalt Strike beacons by various threat actors, which often make the post-exploit phase easier for attackers to manage.' This can often make it more tricky for network hunters and defenders to see anything malicious until it's too late.

#Sophos won t update windows

'While Cring has operators that have used Mimikatz on systems to gain credentials, there's also evidence of native Windows process usage, which potentially blends in with otherwise legitimate activity. This should be a wake-up call for system owners everywhere who are using end-of-life or otherwise unsupported systems that are exposed to the internet at large,' Nikkel said. 'In a previous incident, Cring operators exploited a two-year-old FortiGate VPN vulnerability to target end-of-life Microsoft and Adobe applications.

Every remote worker should consider a virtual private network to stay safe online.Д®xperts like Digital Shadows Sean Nikkel told ZDNet that what makes Cring interesting is that so far, they appear to specialize in using older vulnerabilities in their attacks.