Hackers Abuse TeamViewer to Launch Ransomware Attacks

Hackers exploit TeamViewer because it gives remote access to systems and allows threat actors to control them.

This can be used for several illicit purposes like illegal data access, system manipulation, and virus distribution. 

Besides this, the widespread use of TeamViewer makes it an attractive target for threat actors who are actively seeking to exploit vulnerabilities and conduct social engineering attacks.

Cybersecurity researchers at Huntress recently identified that threat actors have been actively abusing the TeamViewer to launch ransomware attacks.

Free Webinar

Fastrack Compliance: The Path to ZERO-Vulnerability

Compounding the problem are zero-day vulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month. Delays in fixing these vulnerabilities lead to compliance issues, these delay can be minimized with a unique feature on AppTrana that helps you to get “Zero vulnerability report” within 72 hours.

Register for Free

Hackers Abuse TeamViewer

The SOC analysts at Huntress recently alerted about  2 endpoints hit by ransomware with minimal impact, no threat actor reconnaissance or lateral movement. However, security software managed to prevent threat actor’s actions.

TeamViewer enabled threat actor access to endpoints A and B. Logs reveal a common source endpoint name connecting to both with timestamps for sessions:- 

• A (7½ mins)
• B (10+ mins)

Past incidents involved TeamViewer for crypto miner deployment and curl.exe for data exfiltration.

In endpoint ‘A,’ legitimate admin accesses were noted, and endpoint ‘B,’ with the last TeamViewer login three months prior, saw the threat actor’s access in a 10-minute session. 

For data exfiltration, the previous incidents have linked TeamViewer to threat actors deploying crypto miners and employing curl.exe.

The first ransomware distribution on both endpoints began with a DOS batch file, “PP.bat,” launched from the user’s desktop.

In turn, the above-mentioned batch file ran the following “rundll32.exe” command:-

• rundll32  C:\Users\user\Desktop\LB3_Rundll32_pass.dll,gdll -pass <32-char password>

Endpoint A’s ransomware impact was restricted solely to that endpoint. On B, security software blocked the threat actor, leading to multiple failed attempts to encrypt files. 

The log messages revealed the quarantine of a DLL file that prompted the threat actor to make useless attempts to launch another file that was eventually quarantined.

However, the key security relies on tracking assets by encompassing physical and virtual endpoints and installed apps.

IOCs

• WIN-8GPEJ3VGB8U – threat actor endpoint name, retrieved from TeamViewer connections_incoming.txt log
• LB3_Rundll32_pass.dll (from endpoint A) SHA256: 60ab8cec19fb2d1ab588d02a412e0fe7713ad89b8e9c6707c63526c7768fd362

Try Kelltron’s cost-effective penetration testing services to evaluate digital systems security. available.