Full Report
In this blog, we’re going to focus on how Shodan helps us unveil some of the infrastructure that supports ransomware actors.
Analysis Summary
# Tool/Technique: Unsecured VNC & LOLBins (Ransomware Infrastructure)
## Overview
This technique involves identifying and exploiting exposed Virtual Network Computing (VNC) instances that lack authentication. Threat actors, particularly ransomware affiliates, use these exposed interfaces to execute Living-off-the-Land Binaries (LOLBins) to download first-stage payloads and establish a foothold within a target network.
## Technical Details
- **Type**: Technique / Attack Infrastructure
- **Platform**: Windows (primarily, due to LOLBin usage), Cross-platform (VNC)
- **Capabilities**: Remote Code Execution (RCE), payload delivery, automated mass-scanning, and command-and-control (C2) staging.
- **First Seen**: Ongoing; significantly highlighted in Conti leaks (2021-2022).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1133 - External Remote Services**: Exploiting unsecured VNC instances.
- **TA0002 - Execution**
- **T1059.001 - Command and Scripting Interpreter: PowerShell**
- **T1059.003 - Command and Scripting Interpreter: Windows Command Shell**
- **TA0011 - Command and Control**
- **T1105 - Ingress Tool Transfer**: Using `bitsadmin` or `certutil` to download malware.
## Functionality
### Core Capabilities
- **Unauthenticated Access**: Exploiting VNC servers configured with no password, allowing direct desktop interaction.
- **LOLBin Execution**: Using pre-installed system tools to bypass security filters. Key tools include:
- `bitsadmin`: For background file transfers.
- `powershell`: For script execution and memory-resident malware.
- `cmd`: For basic system reconnaissance.
- `ftp` / `nslookup`: For data exfiltration or basic connectivity checks.
### Advanced Features
- **Automation via Shodan**: Attackers use Shodan’s API to programmatically find vulnerable IPs, reducing the manual effort required for initial access.
- **Staging Infrastructure**: Using open directories on compromised or leased servers to host ransomware binaries (e.g., Cobalt Strike beacons).
## Indicators of Compromise
- **File Names**: `bitsadmin.exe`, `powershell.exe` (when used with suspicious flags like `-ExecutionPolicy Bypass` or `-WindowStyle Hidden`).
- **Network Indicators**:
- Connections to Shodan scanning ranges.
- Unusual inbound traffic on Port `5900` (default VNC).
- Defanged C2/Open Directory Examples: `hxxp[:]//[IP_Address]/payload.exe`.
- **Behavioral Indicators**:
- Unexpected `bitsadmin` jobs created by the `SYSTEM` or `Network Service` accounts.
- VNC processes spawning `cmd.exe` or `powershell.exe`.
## Associated Threat Actors
- **Conti Group**: Confirmed via leaked internal training manuals and "pentester guides."
- **BlackCat (ALPHV)**: Known for sophisticated affiliate TTPs involving similar initial access vectors.
- **Ransomware Affiliates**: Various opportunistic actors who automate the "spray and pray" method via Shodan.
## Detection Methods
- **Signature-based detection**: Monitoring for specific command-line arguments (e.g., `bitsadmin /transfer`).
- **Behavioral detection**:
- Flagging any VNC process that initiates an outbound connection to an unknown IP.
- Monitoring for "headless" VNC sessions or sessions originating from known VPS provider IP ranges.
- **Shodan Monitoring**: Defensive teams can use Shodan to search for their own IP space to ensure no unauthorized VNC or RDP banners are exposed.
## Mitigation Strategies
- **Authentication**: Ensure all remote access tools (VNC, RDP) require strong, multi-factor authentication (MFA).
- **Network Hardening**: Place VNC behind a VPN; never expose management ports directly to the internet.
- **Attack Surface Management**: Regularly scan organizational IP ranges using tools like Shodan or Censys to identify "shadow IT" exposures.
- **Execution Prevention**: Use AppLocker or Windows Defender Application Control (WDAC) to restrict the use of LOLBins like `bitsadmin` to authorized users/scripts only.
## Related Tools/Techniques
- **Cobalt Strike**: Frequently deployed as a second-stage payload via these methods.
- **Censys / Zoomeye**: Alternative search engines used for infrastructure discovery.
- **Traitorware**: The use of legitimate security or admin tools (like Splunk or VNC) against the environment.