We are monitoring a REvil 'supply chain' attack outbreak, which seems to stem from a malicious Kaseya update. REvil binary C:\Windows\mpsvc.dll is side-loaded into a legit Microsoft Defender copy, copied into C:\Windows\MsMpEng.exe to run the encryption from a legit process.
-
Show this thread
-
agent.exe (dropper): d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e mpsvc.dll: 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd
4 replies 19 retweets 45 likesShow this thread -
Attack chain contains code that attempts to disable Microsoft Defender Real-Time Monitoring, Script Scanning, Controlled Folder Access, etc. via PowerShellpic.twitter.com/xgLbt5pvG2
4 replies 9 retweets 52 likesShow this thread -
Replying to @markloman
FYI - this will *not* work if customers have enabled Tamper Protection. Not even local admin or system can disable Defender AV when Tamper Protection is enabled.
1 reply 0 retweets 3 likes -
Replying to @ITguySoCal @markloman
unless of course they have some skill or just read my tweets......
1 reply 0 retweets 4 likes -
Replying to @jonasLyk @markloman
I read through your tweets and I didn’t see anything about bypassing Tamper protection?
2 replies 0 retweets 1 like -
Replying to @ITguySoCal @markloman
Jonas L Retweeted Jonas L
Jonas L added,
Jonas L @jonasLykWIN32 paths inherently unreliable for linking a running process to the filename used to spawn it. Letter based drive association are per LUID, per process and in no way static. Thats part of why NT paths are used for loading drivers. They have their own problems though. pic.twitter.com/SkTEJvXG9cShow this thread1 reply 1 retweet 2 likes -
thx :) it is what I enjoy to make
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.