Re:The Dever Ransomware Experience
by SlavikCA on Monday February 24, 2020 @12:45AM
(#22401960)
I had a similar incident at my home lab:
- I had Windows Server 2016 with few Hyper-V VMs running
- RDP was exposed to the Internet
I remember I was working on that computer, and the screen got locked, like someone pressed Win+L. So, I logged in and saw the folder on my desktop called, if remember correctly "Process Explorer 2" or something similar. The screen got locked on me again after a few seconds.
I immediately realized the computer got infected. But after a few minutes, I had a very important meeting and only came back to investigate after about 3 hours.
Results:
- most of the files on the computer were encrypted. But files, which were in use (should I say "locked"?) - stayed. For example, VM disk images stayed unencrypted (but not metadata). That's how I saved one VM, which was somewhat important for me.
- I had Synology NAS with btrfs connected via SMB to that Windows Server and few folders got encrypted. But because I have daily snapshots - I restored that in few minutes.
After that incident, I reinstalled Windows Server (this time 2019) and started to pay more attention to the security, installed winlogbeats and found, that RDP is getting brute-forces at about 400 000 attempts / week from ~55 000 IPs.
So, I installed fail2ban analog for Windows: https://github.com/DigitalRuby/IPBan and now I'm getting about 600 failed attempts/week
- I had Windows Server 2016 with few Hyper-V VMs running
- RDP was exposed to the Internet
I remember I was working on that computer, and the screen got locked, like someone pressed Win+L. So, I logged in and saw the folder on my desktop called, if remember correctly "Process Explorer 2" or something similar. The screen got locked on me again after a few seconds. I immediately realized the computer got infected. But after a few minutes, I had a very important meeting and only came back to investigate after about 3 hours.
Results:
- most of the files on the computer were encrypted. But files, which were in use (should I say "locked"?) - stayed. For example, VM disk images stayed unencrypted (but not metadata). That's how I saved one VM, which was somewhat important for me.
- I had Synology NAS with btrfs connected via SMB to that Windows Server and few folders got encrypted. But because I have daily snapshots - I restored that in few minutes.
After that incident, I reinstalled Windows Server (this time 2019) and started to pay more attention to the security, installed winlogbeats and found, that RDP is getting brute-forces at about 400 000 attempts / week from ~55 000 IPs. So, I installed fail2ban analog for Windows: https://github.com/DigitalRuby/IPBan and now I'm getting about 600 failed attempts/week
Here is the screenshot of how the number of RDP attempts decreased after enabling IPBan: https://hsto.org/webt/oq/q1/ir/oqq1irnzeagwsqnbfpe4gbl9f_o.j...