Full Report
Huntress analysts continue to observe access to endpoints via legacy TeamViewer installations, and/or compromised TeamViewer credentials.
Analysis Summary
# Incident Report: Ransomware Deployment via Compromised TeamViewer Installations
## Executive Summary
Huntress SOC analysts identified and mitigated two separate ransomware deployment attempts originating from compromised TeamViewer sessions. The threat actors used the legitimate remote access software to gain entry and attempt to execute LockBit 3.0 (LockBit Black) variants. While some canary files were encrypted, installed security software and rapid intervention prevented lateral movement and full-scale environmental encryption.
## Incident Details
- **Discovery Date:** January 17, 2024 (Report Published)
- **Incident Date:** December 21, 2023
- **Affected Organization:** Not disclosed (multiple disparate customers)
- **Sector:** Various
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** December 21, 2023, 16:22:15 (Endpoint A) and 20:03:23 (Endpoint B)
- **Vector:** External Remote Service (TeamViewer)
- **Details:** The threat actor connected to both endpoints via TeamViewer using a source device named "WIN-8GPEJ3VGB8U." Access was likely gained via compromised credentials or exploiting legacy, unmonitored installations.
### Lateral Movement
- **Details:** No lateral movement was observed. The threat actor remained localized to the initial entry points, attempting immediate ransomware deployment.
### Data Exfiltration/Impact
- **Details:** No evidence of data exfiltration was reported. Impact was limited to the encryption of a small number of ransomware canary files on the local disks.
### Detection & Response
- **Detection:** Huntress SOC alerted on ransomware canary file encryption and malicious process execution.
- **Response:** Security software on Endpoint B automatically quarantined the ransomware payloads (`LB3_Rundll32_pass.dll` and `LB3.exe`). SOC analysts intervened to contain the endpoints and prevent further access.
## Attack Methodology
- **Initial Access:** T1133 - External Remote Services (TeamViewer).
- **Persistence:** Utilization of existing TeamViewer installations.
- **Privilege Escalation:** Not explicitly detailed; likely utilized existing administrative permissions of the compromised TeamViewer session.
- **Defense Evasion:** Use of `rundll32.exe` to execute malicious DLLs; attempted execution of multiple different file types (EXE, DLL, BAT) to bypass security controls.
- **Credential Access:** Likely gained via credential stuffing or reuse (indicated by the lack of brute force evidence).
- **Discovery:** None observed beyond the local desktop.
- **Lateral Movement:** None observed.
- **Collection:** None observed.
- **Exfiltration:** None observed.
- **Impact:** T1486 - Data Encrypted for Impact (LockBit 3.0).
## Impact Assessment
- **Financial:** Minimal; limited to incident response labor costs.
- **Data Breach:** None; no data exfiltration detected.
- **Operational:** Minimal; limited to two endpoints being taken offline for remediation.
- **Reputational:** Minimal.
## Indicators of Compromise
- **Network Indicators:** Connections from source endpoint name `WIN-8GPEJ3VGB8U`.
- **File Indicators:**
- `C:\Users\user\Desktop\PP.bat`
- `C:\Users\user\Desktop\LB3_Rundll32_pass.dll`
- `C:\Users\user\Desktop\LB3.exe`
- `C:\Users\user\Desktop\ZZZZZZZ`
- **Behavioral Indicators:** `rundll32.exe` calling a DLL from a user desktop folder with a `-pass` argument.
## Response Actions
- **Containment:** Affected endpoints were isolated from the network.
- **Eradication:** Malicious files (`.bat`, `.exe`, `.dll`) were quarantined and deleted. TeamViewer sessions were terminated.
- **Recovery:** Compromised TeamViewer accounts were secured/disabled, and systems were restored from known good states where canary files were encrypted.
## Lessons Learned
- **Visibility Gaps:** Legacy applications (TeamViewer installed in 2018) remained active and unmonitored for years, providing a "silent" backdoor.
- **Credential Hygiene:** The use of the same source machine to hit different customers suggests a commonality in how credentials were harvested or reused.
- **Efficacy of Canaries:** Canary files provided the early warning needed to stop the attack before lateral movement occurred.
## Recommendations
- **Asset Inventory:** Conduct a thorough audit of all remote access software (TeamViewer, AnyDesk, ScreenConnect, etc.).
- **Decommission Legacy Software:** Remove any remote access tools that are not actively required for business operations.
- **Enforce MFA:** Ensure Multi-Factor Authentication is mandatory for all remote access sessions.
- **Conditional Access:** Restrict TeamViewer access to specific known IP addresses or authorized administrative accounts only.
- **Endpoint Hardening:** Block the execution of `rundll32.exe` or `cmd.exe` from common user-writable directories like `\Desktop\` or `\Downloads\`.