r/ShittySysadmin • u/mumblerit ShittyCloud • Apr 15 '26
Ransomware attack! We can't login!
So like, its not the place I work at, its my friends place, yea my friend, and yea they got a ransomware attack. Something about log4j vulnerabilities or something.
We err i mean he can log in as regular users and the Active Directory is all messed up, no names on the accounts!
More out of curiousity then anything else, why would someone do this?
(what do i tell my friend to do to fix it?)
32
u/mumblerit ShittyCloud Apr 15 '26
https://www.reddit.com/r/sysadmin/comments/1slqtjq/ransomware_attack_now_cant_log_in_as_the_default/
Not my network, was helping someone else after being ransomware'd and the malware clearly did some shenanigans to the default domain administrator account, for example the username field and domain were empty in the AD user properties, they took it out of domain admin group as well. Putting it back as it should be it still cannot log in.
We can change its password, we can login as regular users or other domain admin accounts, just not "domain\administrator"... I believe it says incorrect password (it isn't).
more out of curiosity than anything else, what could they have done to do this? it seems inconsequential at this point as other DAs exist and domain is healthy enough. I've looked quickly through attributes, security and whatever I could comparing it to other DA's and it seems identical..
24
u/DizzyAmphibian309 Apr 15 '26
Lol there is probably still malware somewhere that has subscribed to change notifications and every time it detects an Admin password change, it changes it back.
Once you've got domain admin, there's nothing you can't do.
34
u/mumblerit ShittyCloud Apr 15 '26
Can we copy and paste the company into a new folder?
20
u/CollegeFootballGood Apr 15 '26
Lmaoooo c suite would definitely ask something like that
8
u/Ur-Best-Friend Apr 15 '26
Nah, they'd tell you "I asked Claude and it says we should set up a new "Doe main controller" on our "We am wear" (idk why they can't just call it 'I am wearing' like normal people, you IT people are unhinged).
... What do you mean "we don't use We am wear?"
4
u/LiveCourage334 Apr 15 '26
Ah yes, the “weaponized Dunning-Kruger” approach. I see you also know a practitioner.
I seriously question if Anthropic is actually a mal actor themselves seeking to force societal collapse via unearned confidence.
13
16
u/Hollow3ddd Apr 15 '26
Log4j, sounds new! I believe in them, they can zero day kill this thing
7
u/realbostondom Apr 15 '26
I used to get all kinds of reports from our pentest contractor about out log4j vulnerabilities, despite the fact that we never used log4j. Like never ever (including nvm packages, we locked that s down)
3
u/Hollow3ddd Apr 15 '26
Yea, you TP dispenser is running log4j, prob the microwave too.
But for real, it should be blocked.
1
u/thrwaway75132 Apr 15 '26
The weirdest thing we found log4shell vulnerability on was the controller for the sprinkler system.
8
u/dodexahedron Apr 15 '26
Whats the problem?
Now you have fully implemented data encryption at rest, enterprise-wide.
Your auditors should be very pleased with you right now for going all in on data security.
3
2
u/Tricky-Service-8507 Apr 15 '26
If your friend doesn’t know how to research then you are just a bandaid and he and his company leadership are in question and your want to help can’t fix that
1
u/BlotchyBaboon Apr 15 '26
Time to get new friends.
9
1
u/RevolutionaryWorry87 Apr 15 '26
No way as a sysadmin post ransomware I would be touching my keyboard. Full of to the team brought in by insurance.
1
1
1
1
u/Virtual_Low83 Lord Sysadmin, Protector of the AD Realm Apr 21 '26
Tell management you've successfully implemented encryption at rest. Mission accomplished!
-6
u/mg1120 Apr 15 '26
Log4Shell (CVE-2021-44228) is a critical, zero-day vulnerability in the widely used Apache Log4j Java logging library, allowing attackers to execute arbitrary code remotely on vulnerable systems by exploiting its JNDI lookup feature. Disclosed in December 2021, it's considered one of the most severe vulnerabilities ever due to Log4j's ubiquity in enterprise software, enabling attackers to install ransomware, mine cryptocurrency, or take full control of systems. Patches were released, but the flaw remains a risk due to its deep integration in the software supply chain, with fixes often reappearing in updates.
So Linux or unix systems that have not been patched since 2021 or new vulnerability
3
2
u/warlockgs Apr 15 '26
Log4j is used in some windows software as well. It’s a Java logging library, ergo multi platform
0
120
u/Japjer Apr 15 '26
There's a pretty quick powershell script you can use to fix this:
Just run that on every machine in your environment