IT Brew: Stopping ‘Venus’ Ransomware Starts at Firewall Configuration

On November 30, NetSPI Security Consultant, Derek Wilson, was featured in the IT Brew article called Stopping ‘Venus’ Ransomware Starts at Firewall Configuration. Read the preview below or view it online.

+++

Ransomware of the “Venus” variety has hit at least one hospital, leading the US Health Sector Cybersecurity Coordination Center (HC3) to remind security pros to lock down the attackers’ way in: Remote Desktop Services.

“As the ransomware appears to be targeting publicly-exposed Remote Desktop Services, even those running on non-standard TCP ports, it is vital to put these services behind a firewall,” reads an HC3 report from early November.

Microsoft’s Remote Desktop Protocol (RDP) enables remote connections to other computers, most frequently over TCP port 3389.

While adjusting the firewall for remote services may seem like a straightforward process—allow a few machines to use port 3389 and no one else—misconfigurations happen. To account for mistakes, network-level access control also calls for additional defenses, like penetration testing and detection analytics, according to industry pros who spoke with IT Brew.

Remote control. Like other employers who sent their workforces home in 2020, hospitals have remote-access scenarios requiring RDP. Maybe a vendor has to “remote in” to provide updates to some legacy equipment, which brings the device onto the internet, exposing it.

With enough time (and password tries), an attacker can guess the RDP login credentials and “talk” to the device.

A Sophos survey in early 2022 found that 66% of surveyed healthcare organizations were hit by malware during the previous year, on par with the global average.

Venus ransomware appears to have begun operating in August 2022, hacking the RDP service to encrypt devices and terminate 39 processes associated with database servers and Microsoft Office applications, said the HC3 advisory.

While placing the RDP services behind a firewall is “vital,” according to HC3, mistakes happen.

• A network engineer may intend to expose a device to the internet for only a short period of time…and then get distracted. “They forget about closing the hole that they poked to make this thing work,” said Derek Wilson, senior information security analyst at the penetration-testing company NetSPI.

You can read the full article at IT Brew!