A newly uncovered hacking collective, tagged as STAC6451, has been actively breaching Microsoft SQL (MSSQL) servers, with a primary focus on organizations in India. This group exploits vulnerable MSSQL servers to spread ransomware and conduct other harmful operations, representing a significant risk to various industries.
STAC6451 targets MSSQL servers exposed on the public internet, specifically those accessible via the default TCP/IP port 1433. Their methods include:
- Unauthorized Entry: The group initiates their attack by brute-forcing weak passwords on exposed MSSQL servers.
- Activating xp_cmdshell: Once access is gained, they enable the xp_cmdshell stored procedure to run arbitrary commands on the server.
- Deploying Malicious Payloads: Using the Bulk Copy Program (BCP), they upload and execute malicious payloads, including tools for privilege escalation, Cobalt Strike Beacons, and Mimic ransomware.
- Creating Backdoor Accounts: Utilizing the Python Impacket library, they create multiple backdoor accounts (e.g., “ieadm”, “helpdesk”, “admins124”, “rufus”) to maintain access and move laterally within the network.
STAC6451’s Strategy Against MSSQL Servers
STAC6451’s primary target is MSSQL servers exposed directly to the internet with weak security configurations. After breaching these servers, the attackers activate xp_cmdshell, a stored procedure that is disabled by default due to its potential security risks. Once enabled, xp_cmdshell allows the attackers to run discovery commands to gather system details like version, hostname, memory, domain, and user context. This reconnaissance is often automated and follows a consistent pattern across different environments.
The attackers use the BCP utility to insert malicious files into the MSSQL database, which they then move to writable directories on the server. These files include tools like AnyDesk, batch scripts, and PowerShell scripts, which facilitate further exploitation and persistence.
To ensure continued access, STAC6451 creates several user accounts on compromised systems and adds them to local administrator and remote desktop groups. They also deploy remote control tools such as AnyDesk and enable Wdigest in the registry to store credentials in plaintext.
For privilege escalation, STAC6451 employs a malware tool called PrintSpoofer, which takes advantage of vulnerabilities in the Windows spooler service to gain higher privileges and execute malicious commands.
Sophos has detected STAC6451’s activities targeting various Indian sectors. While some ransomware attempts were thwarted, the threat persists. The group demonstrates a moderate level of sophistication, utilizing automated steps in their attack process to prepare for ransomware deployment.
Recommendations for Mitigation
To defend against STAC6451, organizations should:
- Avoid exposing MSSQL servers to the internet.
- Disable the xp_cmdshell stored procedure on SQL instances.
- Use application control to block potentially harmful applications like AnyDesk.
- Keep systems up-to-date with the latest patches and security updates.
For a comprehensive list of Indicators of Compromise (IOCs), visit: Sophos IOCs for STAC6451
