MALWARE--KimcilWare Server-Side Ransomware

KimcilWare is a malicious server-side ransomware application written in PHP. Once the malicious PHP file is uploaded to a web server, it can be accessed by malicious users. By interacting with the web shell, the malicious users are able to encrypt files on the filesystem within the web server data directory.  Currently, other than paying the ransom, there is no known way to decrypt files encrypted by the server-side ransomware.

Exploitation

Stages

1. The malicious user successfully installs the PHP shell on the vulnerable server.
2. The vulnerable server responds with a success response indicating that the shell has been uploaded.
3. The malicious user interacts with the shell by running commands or causing files on the filesystem to be encrypted in the web server data directories.

Prerequisites

The server-side ransomware must have been established on the target system using some other vector, such as file upload vulnerabilities in an associated application or phishing.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Follow standard internal remediation procedures for discovery of malware.