Ransomware spreads through weak remote desktop credentials

Stolen or weak remote desktop credentials are routinely used to infect point-of-sale systems with malware, but recently they’ve also become a common distribution method for file-encrypting ransomware.

In March, researchers discovered a ransomware program dubbed Surprise that was being installed through stolen credentials for TeamViewer, a popular remote administration tool. But the trend had started long before that, with some ransomware variants being distributed through brute-force password guessing attacks against Remote Desktop Protocol (RDP) servers since 2015.

While this method of infection was initially used by relatively obscure ransomware programs, recently it has been adopted by an increasing number of cybercriminals, including those behind widespread ransomware programs such as Crysis.

Security researchers from antivirus firm Kaspersky Lab have discovered a new ransomware program that affected hospitals and other organizations in Brazil. The researchers have named the threat Trojan-Ransom.Win32.Xpan and say it’s the creation of a gang called TeamXRat, which previously specialized in remote access trojans (RATs).

According to Kaspersky Lab, the TeamXRat attackers peform brute-force attacks against internet-connected RDP servers and then manually install the Xpan ransomware on the hacked servers.

“Connecting remote desktop servers directly to the Internet is not recommended and brute forcing them is nothing new; but without the proper controls in place to prevent or at least detect and respond to compromised machines, brute force RDP attacks are still relevant and something that cybercriminals enjoy,” the Kaspersky researchers said in a blog post. “Once the server is compromised, the attacker manually disables the Antivirus product installed on the server and proceeds with the infection itself.”

Brazil has more compromised RDP servers being sold on the underground market than any other country. It is followed by Russia, Spain, the U.K. and the U.S.

Fortunately in the case of Xpan, the ransomware authors made an error in their encryption implementation that allowed Kaspersky Lab to develop a method of recovering affected files without paying the ransom. There’s no downloadable decryption tool, but Xpan victims are advised to contact the security company’s support department and ask for assistance.

Encryption implementation errors are not unusual in ransomware programs, especially in new ones. However, ransomware developers are typically quick to fix the flaws and sooner or later their program will end up using strong and unbreakable encryption.