In the last few years ransomware attacks have been significantly on the rise. This infamous trend began by targeting end point users’ machines, such as personal desktop and laptops. Later, it evolved and broadened the attack surface to target mobile phones and servers.
Web Servers Not Immune to Ransomware Attacks
Web server ransomware is not new. In fact we witnessed first evidence of it back at 2015 and most recently in the well-known attack aimed at the South Korean web hosting company NAYANA. Unfortunately, today ransomware targeted at web servers is even more popular especially given the availability of open source malware easily found in public repositories such as GitHub. Most recently we have seen reports of a new web server ransomware called Ronggolawe, the code name for AwesomeWare ransomware (file name: AwesomeWare.php) (see Figure 1).
Figure 1: AwesomeWare ransom page
This particular ransomware was uploaded to GitHub a year ago by the bug7sec group. This group also uploaded few more interesting pieces of code such as backdoor shells, a vulnerability scanner and a login bypass tool. According to their Facebook page they are “Business Consultants” from Jakarta, Indonesia. Since this ransomware is open source we can find it incorporated into other dubious projects either modified based on malicious intent or used as is[1].
AwesomeWare Attack Vector
With personal desktops or mobile phones ransomware is usually delivered via a phishing email containing a malicious link or attachment. However, with web servers this method is futile and attackers needed to adapt the attack vector in order to infect their target. There are numerous ways for an attacker to run malicious code on a web server, but two of the most common methods are malicious file upload (MFU) or remote code execution (RCE). Both are based on security vulnerabilities in the web server application code base or in a third party library it uses.
Looking at sites infected by AwesomeWare (using Google dork) we can see that most use popular CMS platforms like Magento, WordPress, Joomla, etc. These platforms are highly susceptible to web attacks that leverage RCE and MFU due to their support for third party extensions and wide popularity.
How AwesomeWare Works
Once the attacker gets the malicious code on the server it can be used to either encrypt or decrypt the files in the server (see Figure 2).
Figure 2: AwesomeWare control panel
If the attacker chooses to infect and encrypt the server two things happen. First, AwesomeWare changes the “.htaccess” file to redirect users to a new file named “shor7cut.php” and generates the file which contains the ransom note with the attacker contact details (see Figure 3).
Figure 3: .htaccess manipulation and ransom page generation (click to enlarge image)
Then AwesomeWare scans the application’s directories and encrypts the files in them using PHPs “mcrypt_encrypt” function creating a cipher text compatible with AES (Rijndael block size = 128).
Figure 4: AwesomeWare encryption function
After files are encrypted AwesomeWare changes their extension to “.shor7cut”.
Figure 5: File extension change
Attacks Blocked by Imperva Incapsula
Imperva Incapsula WAF detects and blocks a wide variety of malicious file uploads and remote code execution attacks. It contains both platform specific rules (e.g. for Magento, WordPress, Joomla, Apache Struts, etc.) which are highly accurate as well as more generic rules to catch zero day attacks and variations of known attacks.
Since the Incapsula WAF blocks such attacks out of the box (the Imperva SecureSphere WAF does as well) we looked two months back at Incapsula WAF data and noticed an unusual surge in malicious file upload attacks over the past few weeks (see Figure 6).
Figure 6: Malicious File Upload (MFU) attacks trend (click to enlarge image).
Data from August shows that by using one of our generic rules, Imperva Incapsula WAF blocked 14,000 MFU attacks from over 2,800 unique source IPs and protected 1,800 applications from being infected (see Figure 7).
Figure 7: Malicious File Upload (MFU) attackers’ IPs from Imperva Incapsula data – August 2017 (click to enlarge image).
Some of the attacks were trying to exploit a known vulnerability in the Magento Webforms module in order to upload suspicious PHP files:
- BUG7SEC-TEAM/b4ngs4t.php
- BUG7SEC-TEAM/jmbuts.php
Given the name of files, it’s not a leap to assume these attacks are connected to the aforementioned bug7sec group, the same group that authored the AwesomeWare ransomware.
To gather more information about the attacks we used our IP forensics system and detected that the attackers are using an automated tool (mostly cURL) to carry out the attacks from Google Cloud service. While searching the web we also found two tools (this and this) related to the bug7sec team exploiting Magento vulnerabilities including the Webforms module.
Additional Resources
Ransomware attacks continue to grow and attackers are expanding into new territories and vectors to maximize profits. Web servers are not immune to such attacks particularly when open source ransomware is publicly available. Organizations would be wise to have a WAF solution in place to block ransomware attacks like these out of the box to keep web servers protected and intact. Access the resources below to learn more about ransomware and ransomware protection.
Deception-based Ransomware Protection: What It Is and Why You Need it
Insider’s Guide to Defeating Ransomware
Imperva Incapsula WAF and Imperva SecureSphere WAF
[1] https://github.com/alintamvanz/webshell
Try Imperva for Free
Protect your business for 30 days on Imperva.
