FBI and CISA Warn of Ghost Ransomware: A Threat to Firms Worldwide

A joint advisory from the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) reveals the ongoing threat of Ghost ransomware, also known as Cring.

Active since early 2021, this group, operating out of China, has targeted organizations in over 70 countries, impacting critical infrastructure, schools, healthcare, government networks, and businesses of all sizes. Their motive is purely financial gain.

****How Ghost Operates:****

Ghost actors exploit known vulnerabilities in internet-facing services running outdated software and firmware. Their modus operandi involves using publicly available code to exploit known vulnerabilities, such as those in Fortinet FortiOS appliances, Adobe ColdFusion, Microsoft SharePoint, and Microsoft Exchange. Once inside, they deploy ransomware payloads, including Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe, which encrypt files and demand hefty ransoms in cryptocurrency.

While Ghost’s ransom notes often threaten to sell stolen data, they typically exfiltrate limited amounts of information, focusing on encrypting systems for ransom.

****Identifying Ghost Activity:****

The advisory provides a list of indicators of compromise (IOCs), including file hashes, ransom email addresses, and tools used by Ghost actors. Organizations should investigate any presence of these IOCs on their networks. Unusual network traffic, such as scans for vulnerable devices, manipulation of administrator accounts, and execution of unfamiliar PowerShell scripts, can also indicate Ghost activity.

****Protecting Your Organization:****

The advisory also stresses the importance of basic security measures to defend against Ghost ransomware. One key measure is maintaining regular backups, preferably offline or segmented, to enable system restoration without succumbing to ransom demands. Timely patching software and firmware is also vital in addressing known vulnerabilities before they can be exploited.

Organizations should implement network segmentation by isolating compromised systems to limit the spread of infections. Strengthening authentication methods is another vital step, with phishing-resistant multi-factor authentication (MFA) recommended for all privileged and email accounts.

Cybersecurity training for employees also helps overcome the risks of phishing attacks. Additionally, monitoring PowerShell usage can help detect malicious activity early.

Organizations should also implement allowlisting to restrict the execution of unauthorized applications and scripts, reducing the risk of malware infiltration. Network monitoring is essential for identifying and investigating any abnormal behaviour that could indicate a security breach.

Furthermore, minimizing service exposure by disabling unnecessary ports and restricting access to essential services can significantly reduce vulnerabilities. Lastly, enhancing email security through advanced filtering and anti-spoofing measures helps prevent phishing attempts and other email-based threats.

As Juliette Hudson, CTO of CybaVerse, notes, “Ghost is a serious nation-state threat, exploiting known CVEs in widely used tech. Organizations must prioritize patching and remediation to prevent attacks. Unlike many ransomware groups relying on social engineering, Ghost exploits vulnerabilities for initial access. This highlights the urgency of timely security updates, as exploitation windows are shrinking. Strong cybersecurity hygiene, vulnerability testing, and security awareness training, especially against AI-driven phishing and deepfakes, are essential to defence.“

1. RansomHub: The New King of Ransomware?
2. Lessons from the Holy Ghost Ransomware Attacks
3. Fake GitHub Accounts Drop Malware in Stargazers Ghost Scheme
4. New Codefinger Ransomware Exploits AWS to Encrypt S3 Buckets
5. US Sanctions Chinese Cybersecurity Firm for Ransomware Attacks