RE TURGENCE: Turkish Hackers' New Target - MSSQL Servers
Indicators of Compromise
No domains found for this campaign
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
REMEDIATIONS
To remediate and protect against campaigns like RE#TURGENCE that targets MSSQL servers, several steps can be taken. These measures aim to enhance security, particularly against brute-force attacks and ransomware deployment:
Strong Password Policies: Implement strong password policies to prevent brute-force attacks. Passwords should be complex, unique, and regularly changed.
Network Security: Restrict MSSQL servers from being directly accessible from the internet. Use firewalls to control the traffic to the server and ensure that only authorized users can access it.
Regular Updates: Keep the SQL server and all related software up to date. Regularly apply patches and updates to mitigate known vulnerabilities.
Lock Out After a Certain Failed Attempts: One of the suggested prevention of brute force attack is applying lock out mechanism after a certain failed login attempts.
Regular Backups: Regularly back up databases and store them securely. This ensures data availability in case of a ransomware attack.
Monitoring and Logging: Monitor server logs for unusual activities, such as repeated failed login attempts, which could indicate a brute-force attack.
Security Awareness Training: Educate staff about common cyber threats and security best practices to prevent successful phishing and social engineering attacks.
Intrusion Detection Systems (IDS): Implement IDS to detect and alert on suspicious activities on the network.
Limit User Privileges: Apply the principle of least privilege, ensuring users have only the access rights they need to perform their job.
Incident Response Plan: Have a robust incident response plan in place to quickly respond to and mitigate the effects of a security breach.
Disable Unused Features/Services: Turn off SQL server features or services that are not required to reduce the attack surface.
Endpoint Protection: Use antivirus and anti-malware solutions to protect against malware infections.
Secure Remote Access: If remote access to the SQL server is necessary, use secure methods like VPNs with strong encryption.
Penetration Testing: Regularly conduct penetration testing to identify and fix security vulnerabilities.
By implementing these practices, organizations can significantly reduce the risk of being compromised in similar campaigns targeting MSSQL servers.
SOCRadar’s Recommendations for Organizations:
- Perform regular data backups.
- Implement strong password policies and multi-factor authentication systems.
- Keep your software continuously updated.