We are monitoring a REvil 'supply chain' attack outbreak, which seems to stem from a malicious Kaseya update. REvil binary C:\Windows\mpsvc.dll is side-loaded into a legit Microsoft Defender copy, copied into C:\Windows\MsMpEng.exe to run the encryption from a legit process.
-
Show this thread
-
agent.exe (dropper): d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e mpsvc.dll: 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd
4 replies 19 retweets 45 likesShow this thread -
Attack chain contains code that attempts to disable Microsoft Defender Real-Time Monitoring, Script Scanning, Controlled Folder Access, etc. via PowerShellpic.twitter.com/xgLbt5pvG2
4 replies 9 retweets 52 likesShow this thread -
Replying to @markloman
FYI - this will *not* work if customers have enabled Tamper Protection. Not even local admin or system can disable Defender AV when Tamper Protection is enabled.
1 reply 0 retweets 3 likes -
Replying to @ITguySoCal @markloman
unless of course they have some skill or just read my tweets......
1 reply 0 retweets 4 likes -
Replying to @jonasLyk @markloman
I read through your tweets and I didn’t see anything about bypassing Tamper protection?
2 replies 0 retweets 1 like
Jonas L Retweeted Jonas L
there i not only bypass tamper protection, i instead make it load my driver instead- and it still look as the correct driver loaded. It combines nicely with:https://twitter.com/jonasLyk/status/1396276140084445192 …
Jonas L added,
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.