The Rapid Response Team of cybersecurity firm Sophos discovers how neglecting “ghost” account credentials could lead to cyberattacks. One of the recent incidents involved the Nefilim or Nemty ransomware, which utilizes data theft with encryption.

In Sophos’ article “Nefilim Ransomware Attack Uses ‘Ghost’ Credentials,” said Nefilim, which figured in two cyberattacks, was able to target more than 100 systems. Through its investigation, Sophos responders traced the initial intrusion to an admin account with high-level access that attackers had compromised more than four weeks before they released the ransomware.

During this time, the attackers were able to quietly move through the network, steal credentials for a domain admin account, and find and exfiltrate hundreds of gigabytes of data, before unleashing the ransomware that revealed their presence. The hacked admin account that enabled this belonged to an employee who had passed away around three months previously. The company had kept the account active because it was used for a number of services.

Sophos named CVE numbering authority

Sophos announces new open AI developments in cybersecurity

Nefilim ransomware was first reported in March 2020. Like other ransomware families such as Dharma, Nefilim mainly targets vulnerable Remote Desktop Protocol (RPD) systems as well as exposed Citrix software. It is one of a growing number of ransomware families, alongside DoppelPaymer and others that engage in so-called “secondary extortion,” with attacks that combine encryption with data theft and the threat of public exposure.

Domain admin access
 
“If it wasn’t for the ransomware that flagged the presence of intruders, how long might the attackers have had domain admin access to the network without the company knowing?” said Peter Mackenzie, manager, Sophos Rapid Response. “Staying on top of account credentials is basic. We see far too many incidents where accounts have been set up, often with considerable access rights, that are then forgotten about, sometimes for years. Such ‘ghost’ accounts are a prime target for attackers.

In the second, unrelated attack, Sophos responders found that intruders had created a new user account and added it to the target’s domain admin group in Active Directory. With this new domain admin account, the attackers were able to delete approximately 150 virtual servers and encrypt the server backups using Microsoft Bitlocker — all without setting off alerts.

“If an organization really needs an account after someone has left the company, they should implement a service account and deny interactive logins to prevent any unwanted activity,” Mackenzie said. “Or, if they don’t need the account for anything else, disable it and carry out regular audits of Active Directory.”

Sophos said the danger is not just keeping outdated and unmonitored accounts active, it is also giving employees greater access rights than they need. Fewer accounts need to be a domain admin than most people think. No account with privileges should be used by default for work that doesn’t require that level of access. Users should elevate to using the required accounts when needed and only for that task. Further, alerts should be set so that if the domain admin account is used or if a new admin account is created, someone knows.