Kickidler Exploited in Ransomware

Summary

Ransomware gangs are employing Kickidler, legitimate employee monitoring software, for malicious purposes. They gain access through poisoned Google Ads, leading to a trojanized program that installs a backdoor. This allows the deployment of Kickidler, enabling access to keystrokes, screen recordings, and ultimately, sensitive data like cloud backup credentials.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

Ransomware attacks, they’re not just a threat, they’re a constant one. And they’re getting sneakier. Forget the old brute-force methods, malicious actors are now leveraging legitimate tools and exploiting vulnerabilities in ways that are frankly, quite disturbing.

Recently, we’ve seen groups like Qilin and Hunters International misusing Kickidler, which is employee monitoring software. Yes, you read that right. They’re turning a tool designed for productivity into a weapon for reconnaissance, credential harvesting, and amplifying the potential damage of their attacks. So, how are they doing this, exactly?

Weaponizing Employee Monitoring

Kickidler, you see, boasts features like real-time screen viewing, keystroke logging, and time tracking – all perfectly reasonable for monitoring employee productivity, or ensuring compliance. But it’s these very capabilities that cybercriminals are now exploiting to sneak into targeted networks. Think about the access these features offer!

The typical attack starts with a poisoned Google Ad. A user, maybe searching for something like RVTools (a handy Windows utility for managing VMware vSphere deployments), clicks on a seemingly innocent ad. Boom, redirect to a fake website hosting a trojanized version of the software. It’s insidious, isn’t it? Once that’s downloaded and executed, it acts as a loader, installing a PowerShell-based backdoor called SMOKEDHAM. And that backdoor facilitates the deployment of Kickidler onto the victim’s machine. Game over, right?

The Art of Espionage and Data Theft

Now, picture this: Kickidler is installed. The attackers, they’ve got a window into everything. User activity is monitored, keystrokes are captured, screens are recorded, sensitive information is flowing straight into their hands. They use this info to escalate their access, targeting valuable resources like VMware ESXi environments and, crucially, cloud backups.

And that focus on cloud backups is particularly concerning. Lots of organisations, in order to protect against ransomware attacks which compromise domain credentials, are now decoupling backup system authentication from Windows domains. On the other hand, Kickidler’s ability to capture keystrokes and web pages allows attackers to sidestep this entire defence. Getting access to the credentials, which are necessary to compromise off-site cloud backups. Clever, and terrifying.

I remember reading about one case where a company thought they were safe because their backups were offsite and secured with multi-factor authentication. What they didn’t account for was an attacker sitting on a compromised workstation, patiently logging keystrokes until they snagged the backup credentials. They basically had the keys to the kingdom and didn’t even know it.

The Bigger Picture: RMM Abuse

Look, the exploitation of Kickidler, it’s a symptom of a larger problem. It highlights a broader trend of ransomware groups abusing legitimate remote monitoring and management (RMM) software. The Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have all warned about this. These tools, used to bypass security controls and gain unauthorized access to systems, often without needing administrative privileges. It’s a loophole they’re exploiting, and it’s working.

So, How Do We Fight Back?

Protecting against RMM-based attacks? It takes a multi-layered approach.

• Be Suspicious of Online Ads: Watch out for those ads for software. Especially if they pop up unexpectedly, or seem too good to be true. Check the website, verify its legitimacy, before you download anything. I’ve seen so many people fall for this simple trick.
• Keep Your Software Updated: Make sure everything is up-to-date with the latest security patches. Operating systems, applications, everything. Don’t neglect this, it’s low hanging fruit for attackers.
• Beef Up Endpoint Security: Invest in robust endpoint detection and response (EDR) solutions. They’ll help you detect and mitigate malicious activity. You should already have this in place.
• Audit Your Software Regularly: Find and remove any unauthorized or suspicious RMM software. Who knows what’s lurking on your network?
• Control Your Applications: Use application whitelisting to prevent unauthorized programs from running. It’s a pain to set up, but it’s worth it.
• Educate Your Employees: Train them to spot phishing scams and other social engineering tactics. They’re your first line of defense. You can’t skimp on this.

The Final Word: Stay Vigilant

The misuse of Kickidler, it’s a harsh reminder of how quickly the threat landscape changes. We have to understand these tactics, implement strong security measures, and generally protect ourselves. We need to stay vigilant. We need to adapt our security strategies. And we need to foster a culture of security awareness. Only then can we effectively counter the ever-present threat of ransomware. It’s an ongoing battle, and we can’t afford to let our guard down for even a second. It’s up to us, isn’t it?