Cybersecurity Alert: Hackers Exploit Microsoft SQL Servers with FreeWorld Ransomware

Hey Mck’s, Today We are going to talk about the recent DB#JAMMER cyber threat. Basically, hackers are going after weakly protected Microsoft SQL servers and spreading a new ransomware called FreeWorld. They use a toolkit with sneaky stuff like RAT payloads and go in through brute force attacks on these servers. Without any delay let’s dive into this.

In the world of online security, a recent attack named DB#JAMMER has caught everyone’s attention. Cybercriminals are going after weakly protected Microsoft SQL (MS SQL) servers, using a toolkit that’s got all sorts of sneaky stuff, like enumeration software, RAT payloads (basically hacker tools), and a fresh flavor of ransomware called FreeWorld. So, these bad actors start by cracking their way into vulnerable hosts by brute-forcing MS SQL servers. Once they’re inside, they mess around with something called xp_cmdshell to run commands and snoop around databases. Next, they mess up the system’s firewalls and make sure they can keep coming back by hooking up to remote file-sharing systems (SMB shares). This lets them move files back and forth and sneak in malicious tools like Cobalt Strike. This is the setup for bringing in AnyDesk software and finally dropping the dreaded FreeWorld ransomware bomb. Oh, and they also tried (and failed) to set up some RDP persistence thing with Ngrok.

The big takeaway here is that having strong passwords is a big deal, especially if you’ve got stuff out there exposed to the internet. This breach started because they cracked the door open with a brute force attack on an MS SQL server. It’s a reminder for everyone to up their password game. Now, let’s talk about the bigger picture. Ransomware attacks are back with a vengeance in 2023, after kind of chilling out in 2022. The interesting thing is that fewer victims are paying the ransom (only 34%), but when they do, the payout is huge — averaging $740,144, which is way up from Q1 2023. The bad guys are also getting more creative. They’re even sharing details of how they pulled off attacks to mess with victims’ chances of getting a payout from cyber insurance. It’s a wild world out there.

To protect against these kinds of threats, organizations need to get serious about cybersecurity. That means strong passwords, keeping your software up to date, and investing in good security tools. Plus, don’t forget to train your people to spot phishing scams and other tricks. In a nutshell, the DB#JAMMER campaign is just a glimpse into the ever-evolving world of online threats. Stay sharp, stay safe.