Today I read about ransomware called Erebus that supposedly targets Linux servers and encrypts all the data there. What I can't find is any reference to the details of this type of attack, i.e. how the system's security was breached and privilege escalation was performed. Was it a user error? Was it just bad system security (i.e. lack of updates or vulnerable configuration)? I can't find anything about this.

I would guess any decent sysadmin at least puts every Web server in a chroot jail or better, a Container or VM, which aren't watertight, but a lot harder to break out of in any case. Am I being idealistic?


Given the sparsity of details, the SIZE of the company affected, and the fact that they were hit with a $1,000,000 ransom, my guess is that this was a targeted job that required a bit of recon beforehand to discover that they were using an ancient kernel, ancient webserver, and generally hadn't patched anything in a decade.

I expect a remote root exploit was used and coded in along with some tailored version of Erebus to encrypt the files.

I don't think this is a scenario that would necessarily be EASY to replicate. But it COULD be replicated if someone has a system with holes.

Given the target's overall lackadaisical approach to updating and security, we don't know what other kinds of security holes were available for the ramsomware coders to take advantage of.

  • Yes, without a lot of info, we can only speculate. What you say does appear likely. One thing I am unable to reconcile is "the target's overall lackadaisical approach to updating and security...". What led you to this conclusion? – Sas3 Jun 26 '17 at 15:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.