Does IceFire Ransomware Portend a Broader Shift From Windows to Linux? (darkreading.com) 28
An anonymous reader shares this report from Dark Reading:
In recent weeks, hackers have been deploying the "IceFire" ransomware against Linux enterprise networks, a noted shift for what was once a Windows-only malware.
A report from SentinelOne suggests that this may represent a budding trend. Ransomware actors have been targeting Linux systems more than ever in cyberattacks in recent weeks and months, notable not least because "in comparison to Windows, Linux is more difficult to deploy ransomware against, particularly at scale," Alex Delamotte, security researcher at SentinelOne, tells Dark Reading....
"[M]any Linux systems are servers," Delamotte points out, "so typical infection vectors like phishing or drive-by download are less effective." So instead, recent IceFire attacks have exploited CVE-2022-47986 — a critical remote code execution (RCE) vulnerability in the IBM Aspera data transfer service, with a CVSS rating of 9.8.
Delamotte posits a few reasons for why more ransomware actors are choosing Linux as of late. For one thing, she says, "Linux-based systems are frequently utilized in enterprise settings to perform crucial tasks such as hosting databases, Web servers, and other mission-critical applications. Consequently, these systems are often more valuable targets for ransomware actors due to the possibility of a larger payout resulting from a successful attack, compared to a typical Windows user."
A second factor, she guesses, "is that some ransomware actors may perceive Linux as an unexploited market that could yield a higher return on investment."
While previous reports had IceFire targetting tech companies, SentinelLabs says they've seen recent attacks against organizations "in the media and entertainment sector," impacting victims "in Turkey, Iran, Pakistan, and the United Arab Emirates, which are typically not a focus for organized ransomware actors."
A report from SentinelOne suggests that this may represent a budding trend. Ransomware actors have been targeting Linux systems more than ever in cyberattacks in recent weeks and months, notable not least because "in comparison to Windows, Linux is more difficult to deploy ransomware against, particularly at scale," Alex Delamotte, security researcher at SentinelOne, tells Dark Reading....
"[M]any Linux systems are servers," Delamotte points out, "so typical infection vectors like phishing or drive-by download are less effective." So instead, recent IceFire attacks have exploited CVE-2022-47986 — a critical remote code execution (RCE) vulnerability in the IBM Aspera data transfer service, with a CVSS rating of 9.8.
Delamotte posits a few reasons for why more ransomware actors are choosing Linux as of late. For one thing, she says, "Linux-based systems are frequently utilized in enterprise settings to perform crucial tasks such as hosting databases, Web servers, and other mission-critical applications. Consequently, these systems are often more valuable targets for ransomware actors due to the possibility of a larger payout resulting from a successful attack, compared to a typical Windows user."
A second factor, she guesses, "is that some ransomware actors may perceive Linux as an unexploited market that could yield a higher return on investment."
While previous reports had IceFire targetting tech companies, SentinelLabs says they've seen recent attacks against organizations "in the media and entertainment sector," impacting victims "in Turkey, Iran, Pakistan, and the United Arab Emirates, which are typically not a focus for organized ransomware actors."
Patch your servers Linux admins (Score:1)
Linux ransomware ought not to be allowed (Score:1)
... Before I can get a good Photoshop replacement on Linux.
Re: (Score:2)
A lot of people assume that Linux is "safe" just because it's "Linux", but in reality it has vulnerabilities just like every OS does. The real reason Windows is targeted so frequently is because of it's large market-share and because there aren't 1000 different versions. That complacency makes Linux an easy target in some cases. Let's also not forget that most phone-based operating systems are Linux-based, so in that sense, "Linux Malware" is hardly rare.
Sure Linux has vulnerabilities. But I wonder how many of the ransomware-affected Linux machines were running with SELinux in enforcing mode.
Note I'm not pondering how many servers, in total, are running with SELinux in enforcing. I'm wondering how effective it is in preventing this sort of thing.
Re: (Score:2)
Probably quite effective, but more in the way that it prevents say Apache which might have been able to encrypt a directory from being able to SSH sideways to another machine to repeat.
Unless you've enabled httpd exec ...
Re: (Score:2)
My take on this is one platform has a common attack surface, and active directory makes life easier for the attacker due to its call-home model.
Most Linux setups in the enterprise disallow call-home to the AD analogue/management/admin machines.
To me this makes a massive difference when it comes to the blast radius of a compromised box.
Re: (Score:1)
The real reason Windows is targeted so frequently is because of it's large market-share and because there aren't 1000 different versions.
The real reason Windows is targeted so frequently is because it's so damned easy to compromise. We found this out when Linux was dominating web services, yet Windows still accounted for almost 100% of web server compromises. Windows is just way, way, WAY easier to compromise because of its truly shitty codebase. I doubt that will ever change.
There are probably several reasons why Linux is being increasingly targeted, but increasing popularity is likely at the very bottom of the list. It was already popular
Re:Linux is just an OS (Score:4, Insightful)
A lot of people assume that Linux is "safe" just because it's "Linux"
No. Linux is safe because it doesn't hide how it works. It's philosophy prioritizes security over ease of use.
The real reason Windows is targeted so frequently is because of it's large market-share and because there aren't 1000 different versions.
When you play with numbers you can see what you want to see. There are more servers running Linux than Windows.
It's funny how I can install the same software on all those 1000 different versions not to mention the BSD's and their derivatives.
That complacency makes Linux an easy target in some cases. Let's also not forget that most phone-based operating systems are Linux-based, so in that sense, "Linux Malware" is hardly rare.
Do you own shares in Microsoft? What complacency? What are you talking about?
Re: (Score:2)
No, it doesn't (Score:2)
You are conflating Linux on servers, which is incredibly common, with Linux on the desktop, where it isn't.
Re: (Score:1)
You are conflating Linux on servers, which is incredibly common, with Linux on the desktop, where it isn't.
The kernel is the same in both instances. The same software can run on both desktop and server, though the server often is run headless.
Probably like a lot of recent situations (Score:2)
I wouldn't be surprised if they're first phishing non-technical users, then using credentials / access gained from that to get at more privileged systems where they can then leverage local privilege escalation exploits.
In which case these issues would be as much about auditing / managing / limiting which accounts really need access to critical systems as anything else. Does your CEO really need the ability to log into your control systems?
Question, (Score:2)
Re: (Score:1)
Re: (Score:2)
Well it's a different Software distribution model (Score:2)
While on many operating system environments users are downloading installers from dubious websites or "App-Stores" with no quality standards, software distribution on most Linux-systems is a lot different.
There you have your distribution. Most end users will never have to install software from outside that distribution. You have your package manager and it contains a curated set of software. There are typically minimal standards set by your distribution, which keeps out deliberate malware. Nobody enters "so
Re: Well it's a different Software distribution mo (Score:2)
If you have end-users installing applications on their desktops, you've recreated the very worst part of Windows XP "security" in Linux (every user an admin)! Congratulations!
Re: (Score:2)
Re: (Score:2)
IceFire exploit was removed in Faspex 4.4.2 (Score:1)
to funny! (Score:2)
Boob factor (Score:2)
As more and more incompetent boobs use Linux to do more and more childish stupid shit, it will be more successuflly targetted by malware. Its present saving grace (the same thing that protects "big iron") is that the incompetent children are relegated to playing their childish endeavours at the childrens table using childrens toys. The malware stays where it is most effective -- targetting the children and their silly games.
The interesting thing is that the problem is not the Operating System but rather t