Skip to main content
SolarWinds MSP
  • Login
  • Support
  • Partnerships
    • Partnerships Overview
    • Solution Provider Program
    • Technology Alliance Program
    • Distributor Program
SolarWinds MSP
  • Products
    • SolarWinds N-central Automate what you need. Tackle complex networks. Try this remote monitoring and management solution built to help maximize efficiency and scale.
    • SolarWinds RMM Start fast. Grow at your own pace. Try this powerful but simple remote monitoring and management solution.
    • SolarWinds EDR Defend against ransomware, zero-day attacks, and evolving online threats with Endpoint Detection and Response
    • SolarWinds Backup Manage data protection for servers, workstations applications, documents and Microsoft 365 from one SaaS dashboard.
    • Mail Protection & Archiving Protect users from email threats and downtime.
    • Password Management Easily adopt and demonstrate best practice password and documentation management workflows.
      • Passportal Demo
    • PSA & Ticketing Manage ticketing, reporting, and billing to increase helpdesk efficiency.
    • Remote Support Help support customers and their devices with remote support tools designed to be fast and powerful.
  • Solutions

    I'm looking for...

    • Security Solutions
    • Monitoring Solutions
    • Efficiency Solutions
  • Resources
    • Blog
    • Webcasts & Events
    • Ask the N-central Experts
    • Daily Live Demos
    • RMM Foundations Training
    • Upcoming Events
    • Upcoming Webcasts
    • Resource Center
    • COVID-19 Resources
    • Resource Library
      • Case Studies
      • Product Information
      • eBooks
      • White Papers
      • Infographics
    • SolarWinds MSP Free Tools
    • GDPR Resource Center
    • Security Resource Center
    • MSP Institute Webinar Series
    • MSP Advice Project
  • About
    • Contact
    • Customer Success
    • Worldwide sales and support
    • Careers
    • Awards and Recognition
    • Get A Quote
    • Newsroom
      • Press Releases
      • In The News
      • Media Contacts
      • COVID-19 Response
    • Leadership Team
    • Legal
      • Cookie Policy
      • Privacy Notice
      • Software Services Agreement
      • Terms of Use
      • Backup Fair Use Policy
    • Security
      • SolarWinds Security Statement
      • Vendor Data Protection Requirements
    • Support
  • IT Departments
  • Contact Sales
    • Get A Quote
    • General Inquiry
  • TRY NOW
    • SolarWinds RMM
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Passportal
    • SolarWinds N-central
    • SolarWinds Mail Assure
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
  • Request a Quote
  • Try Now
    • SolarWinds RMM
    • SolarWinds N-central
    • SolarWinds Backup
    • MSP Manager
    • SolarWinds Mail Assure
    • SolarWinds Passportal
    • SolarWinds Risk Intelligence
    • SolarWinds Take Control
Request quote
Filter Blogs
  • Filter by:
  • MSP Business
    • Automation
    • Backup & Disaster Recovery
    • Security-series
    • Best Practices
    • Business
    • Business Growth
    • Business Risk
    • Cloud Computing
    • Customer Service
    • Cybersecurity
    • Cybersecurity Awareness Month
    • Data
    • GDPR
    • Internet of Things
    • IT Support
    • ITSM
    • LOGICcards
    • Machine Learning
    • Mail
    • Managed Services
    • Marketing
    • Mobile
    • Networking
    • Operations
    • Podcast
    • Product
    • PSA
    • Remote Management
    • Research & Trends
    • Risk Intelligence
    • Security
    • Security Vlog
    • Service Desk
    • Services & Support
    • The Head Nerds
    • Tips & Advice
    • Training
Home Blog MSP Business Security Et Tu, Admin? A New Ransomware Attack Using Admin Accounts
Security

Et Tu, Admin? A New Ransomware Attack Using Admin Accounts

By Tim Brown
1 May, 2019

A disturbing new trend in cyberattacks has started to become prevalent. Recently, a beverage manufacturer was hit by a ransomware virus; however, what’s new here is it was remotely installed using an administrator account. While ransomware has traditionally been delivered by email, this could signal a new attack vector we need to protect against. 

This isn’t an entirely new attack. The perpetrators used systems already on the machines to launch the attack. These are known as “living off the land” attacks, which have become increasingly common. Doing this allows them to sneak past security controls by using pre-set, trusted components in a system. Attacks like these can be hard to defend against, but there are steps you can take to reduce your risk of a successful attack. 

Before I get into that, I want to walk you through the recent attack. 

The nitty gritty of the recent BitPaymer attack

Researchers at Trend Micro found the attack started with a compromise on the system. They haven’t specifically reported when or how that compromise occurred, but this initial compromise allowed the perpetrators to kick off the rest of the attack. Next, they used PowerShell Empire, an agent that can be used after exploiting a system, to tunnel into specific machines. From there, they compromised administrator accounts, and used them to install the BitPaymer ransomware using PsExec, a tool currently owned by Microsoftthat allows users to remotely execute processes on a machine. 

BitPaymer avoids detection using alternate data streams (ADS). ADS is a component of NTFS, the Windows NT file share system, and allows people to create a second data stream in a file that’s usually hidden (although there are multiple tools for reading alternate data streams). Cybercriminals often use ADS to hide malware within legitimate files, making it hard for some security tools to detect. 

Protecting your customers

While this style of attack makes it challenging to detect the threat, there are steps you can take to help protect your customers. 

  1. Guard admin privileges with your life: Adhere to the “principle of least privilege” as much as you can. As an MSP, make sure to restrict admin privileges to a “need-to-use” basis—both within techs in your business and also on the customer end. This also applies to specific types of applications and services. You open your customers to risk if you run a service at the root level that doesn’t need root access. 
  2. Treat admins as “crown jewels”: I’ve mentioned before that reducing your customers’ cyberattack risks involves defining the business’s most important resources and protecting them like the British government protects the crown jewels. Users with admin privileges are part of these crown jewels. For these users, you need to “increase the pain” by placing additional safeguards around their accounts, such as requiring multifactor authentication, monitoring their actions, and ensuring they’re using secure networks when working remotely (or requiring them to use a VPN). This allows you to focus your efforts on 20% of users while allowing you to conserve resources on the other 80%. Also, remove accounts once employees leave. Hackers can easily compromise admin accounts for employees who have left, especially if security rules weren’t as stringent at the time. 
  3. Use a security monitoring tool: This attack could have been prevented (or at least mitigated) using some form of active security monitoring. For example, a cloud-based SIEM tool, like SolarWinds® Threat Monitor, can help you detect anomalies in your environment before they wreak havoc. You may want to ramp up the monitoring profiles on admin users and investigate any strange actions. For example, if you notice multiple failed login attempts on an admin account, investigate whether it’s from a legitimate user or malicious actors. 
  4. Leverage your RMM tool: Additionally, you should use an RMM tool like SolarWinds RMM or N-central® to the fullest. You can set up checks in the system to alert you to unusual behavior. For example, you could set the system up to alert you if any unusual changes to administrator accounts occurs or if new admin accounts are created. If this change wasn’t initiated by you or someone in your organization, you can take actions to remediate the issue. You could also consider adding checks on specific internal tools, like PowerShell. 

Well-managed and secure

I’ve always said a well-managed environment is a secure environment. Keeping track of your admin accounts and implementing least privilege can help you mitigate the chances of a ransomware attack launching from a compromised admin account. And if you have monitoring in place, you can further reduce your risk. 

These types of attacks won’t go away—in fact, they’re only likely to increase. So make sure you’re prepared by vigilantly managing your customers’ environments. 

 

You might also like...
Automation

What the Head Nerds Were Up to in 2020

Security

January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be

Security

December 2020 Patch Tuesday—A quiet(er) finish to a busy year in vulnerabilities

Security

Documentation Management API and Why It’s Important for the MSP Business

Security

What Is FIPS-140-2 Standard and When Is It Required?

Security

Malware-as-a-Service: A Crucial Reason Why Security Has Grown More Complex

Want to stay up to date?

Get the latest MSP tips, tricks, and ideas sent to your inbox each week.

Loading form....

If the form does not load in a few seconds, it is probably because your browser is using Tracking Protection. This is either an Ad Blocker plug-in or your browser is in private mode. Please allow tracking on this page to request a subscription.

Note: Firefox users may see a shield icon to the left of the URL in the address bar. Click on this to disable tracking protection for this session/site

Recent Posts
  • What the Head Nerds Were Up to in 2020
  • RMM and PSA Tools: How to Make the Most of Both
  • How to Empower an IT Help Desk Team for Success
  • Six Tips That Will Make Managing Your MSP Company Easier
  • January 2021 Patch Tuesday: One Actively Exploited Vulnerability and a Few Likely to Be
Categories:
  • Security (230)
  • Tips & Advice (122)
  • Best Practices (94)
  • Managed Services (86)
  • Backup & Disaster Recovery (83)
  • The Head Nerds (75)
  • Business Growth (75)
  • IT Support (42)
  • Business (39)
  • Automation (37)
  • Cybersecurity (37)
  • Operations (34)
  • Mail (33)
  • Remote Management (28)
  • ITSM (25)
  • Data (21)
  • Cloud Computing (21)
  • Networking (21)
  • Marketing (14)
  • PSA (11)
  • Product (11)
  • Services & Support (5)
  • Service Desk (5)
  • Mobile (4)
  • Risk Intelligence (4)
  • Internet of Things (3)
  • Customer Service (3)
  • GDPR (2)
  • Research & Trends (2)
  • Training (2)
  • Business Risk (1)
  • LOGICcards (1)
Show moreless
SolarWinds MSP

Products
  • SolarWinds RMM
  • SolarWinds N-central
  • SolarWinds Backup
  • SolarWinds EDR
  • SolarWinds MSP Manager
  • SolarWinds Mail Assure
  • SolarWinds Risk Intelligence
  • SolarWinds Take Control
  • SolarWinds Passportal
  • All Products Use Cases
Solutions
  • Security Solutions
  • Monitoring Solutions
  • Efficiency Solutions
  • Identify which RMM solution is right for me
  • Drive Efficiency with Automation
  • Manage my MSP Business More Efficiently
  • Manage my IT Department More Efficiently
  • Layered Security
  • Cross-Platform Support
  • Data-Driven Insights
About
  • About Us
  • Careers
  • Newsroom
  • Leadership Team
  • Upcoming Events
  • Subscription Preferences
  • SolarWinds
  • SolarWinds Trust Center
  • COVID-19 Response
Support
  • SolarWinds RMM
  • Solarwinds N-central
  • SolarWinds Backup
  • SolarWinds Mail Assure
  • SolarWinds Take Control
  • SolarWinds MSP Manager
  • Solarwinds Risk Intelligence
  • Solarwinds Threat Monitor
  • SolarWinds Passportal
  • SolarWinds Take Control Downloads
  • Backup & Recovery Downloads
  • Service Status

Footer 2

  • Legal Documents
  • Privacy
  • California Privacy Rights
  • Security Information
  • Sitemap

© SolarWinds MSP Canada ULC and SolarWinds MSP UK Ltd.
All Rights Reserved.