Crypt0saur Server-Side Ransomware

Crypt0saur is a malicious server-side ransomware application written in PHP. Once the malicious PHP file is uploaded to a web server, it can be accessed and interacted with. By interacting with the web shell, the malicious user is able to encrypt files on the filesystem within the web server data directory. Currently, other than paying the ransom, there is no known way to decrypt files encrypted by the ransomware.

Exploitation

Stages

1. The malicious user exploits an attack vector, such as outdated software or a misconfigured server to install the web shell.
2. The malicious user interacts with the web shell and allows the attacker to use web shell functions on the compromised server.
3. A status is returned from the web shell indicating that its usage has been successful.

Prerequisites

The attacker must be able to send crafted packets to the target system.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Upgrade to a non-vulnerable version to mitigate this vulnerability.