CACTUS Ransomware Exploits Qlik Sense Vulnerabilities in Targeted Attacks

A CACTUS ransomware campaign has been observed exploiting recently disclosed security flaws in a cloud analytics and business intelligence platform called Qlik Sense to obtain a foothold into targeted environments.

“This campaign marks the first documented instance […] where threat actors deploying CACTUS ransomware have exploited vulnerabilities in Qlik Sense for initial access,” Arctic Wolf researchers Stefan Hostetler, Markus Neis, and Kyle Pagelow said.

The cybersecurity company, which said it’s responding to “several instances” of exploitation of the software, noted that the attacks are likely taking advantage of three flaws that have been disclosed over the past three months –

• CVE-2023-41265 (CVSS score: 9.9) – An HTTP Request Tunneling vulnerability that allows a remote attacker to elevate their privilege and send requests that get executed by the backend server hosting the repository application.
• CVE-2023-41266 (CVSS score: 6.5) – A path traversal vulnerability that allows an unauthenticated remote attacker to transmit HTTP requests to unauthorized endpoints.
• CVE-2023-48365 (CVSS score: 9.9) – An unauthenticated remote code execution vulnerability arising due to improper validation of HTTP headers, allowing a remote attacker to elevate their privilege by tunneling HTTP requests.

It’s worth noting that CVE-2023-48365 is the result of an incomplete patch for CVE-2023-41265, which along with CVE-2023-41266, was disclosed by Praetorian in late August 2023. A fix for CVE-2023-48365 was shipped on November 20, 2023.

In the attacks observed by Arctic Wolf, a successful exploitation of the flaws is followed by the abuse of the Qlik Sense Scheduler service to spawn processes that are designed to download additional tools with the goal of establishing persistence and setting up remote control.

This includes ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink. The threat actors have also been observed uninstalling Sophos software, changing the administrator account password, and creating an RDP tunnel via Plink.

The attack chains culminate in the deployment of CACTUS ransomware, with the attackers also using rclone for data exfiltration.

The Ever-Evolving Ransomware Landscape#

The disclosure comes as the ransomware threat landscape has become more sophisticated, and the underground economy has evolved to facilitate attacks at scale via a network of initial access brokers and botnet owners who resell access to victim systems to several affiliate actors.

According to data compiled by industrial cybersecurity firm Dragos, the number of ransomware attacks impacting industrial organizations declined from 253 in the second quarter of 2023 to 231 in the third quarter. In contrast, 318 ransomware attacks were reported across all sectors for the month of October 2023 alone.

Despite ongoing efforts by governments across the world to tackle ransomware, the ransomware-as-a-service (RaaS) business model has continued to be an enduring and lucrative pathway to extort money from targets.

Black Basta, a prolific ransomware group that came onto the scene in April 2022, is estimated to have raked in illegal profits to the tune of at least $107 million in Bitcoin ransom payments from more than 90 victims, per new joint research released by Elliptic and Corvus Insurance.

A majority of these proceeds were laundered through Garantex, a Russian cryptocurrency exchange that was sanctioned by the U.S. government in April 2022 for facilitating transactions with the Hydra darknet marketplace.

What’s more, the analysis uncovered evidence tying Black Basta to the now-defunct Russian cybercrime group Conti, which discontinued around the same time the former emerged, as well as QakBot, which was used to deploy the ransomware.

“Approximately 10% of the ransom amount was forwarded on to Qakbot, in cases where they were involved in providing access to the victim,” Elliptic noted, adding it “traced Bitcoin worth several million dollars from Conti-linked wallets to those associated with the Black Basta operator.”

Original Source