Ransomware Group Uses Unpatched Webcams to Deploy Attacks

A recent cybersecurity report by S-RM has revealed a new tactic used by the Akira ransomware group, demonstrating their persistence in bypassing security defenses. When their initial attempt to deploy ransomware was blocked by an endpoint detection and response (EDR) tool, the attackers shifted their focus to an unexpected network device—a webcam. 

This strategy highlights the evolving nature of cyber threats and the need for organizations to secure all connected devices.

The attack began with the use of remote desktop protocol (RDP) to access a target’s server. When the group attempted to deploy a ransomware file, the victim’s EDR successfully detected and neutralized the threat. However, rather than abandoning the attack, the adversaries conducted a network search and identified other connected devices, including a fingerprint scanner and a camera. The camera was an ideal entry point because it was unpatched, ran a Linux-based operating system capable of executing commands, and had no installed EDR solution. 

Exploiting these vulnerabilities, the attackers used the camera to deploy ransomware via the Server Message Block (SMB) protocol, which facilitates file and resource sharing between networked devices.

According to cybersecurity experts, this kind of attack is difficult to defend against because it targets overlooked devices. Rob T. Lee, chief of research at the SANS Institute, compared detecting such threats to “finding a needle in a haystack.” The attack underscores how cybercriminals are constantly ada

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.