Anonymous hackers – working under the flag of AntiSec – have targeted a US defense contractor, stealing and publishing thousands of emails and documents.
Google drive markdown. Sophos VDI - 50-99 USERS - 24 MOS Sophos Anti-Virus for vShield - VDI 2 Year 50-99 User Product details. Quantity: Details Current Stock Level. Sophos Intercept-X Features: XG Firewall Features: h. Applies to the following Sophos product(s) and version(s) Central Windows Endpoint 10.8.1, Central Windows Endpoint Intercept X 2.0.0 What to do. From the Sophos Central Admin that will manage the endpoint/s, download the installer SophosSetup.exe. Go to Protect Devices under Endpoint Protection select Download Complete Windows Installer.
Sorry, this product is no longer available, Please contact us for a replacement.
Fast, effective threat protection for virtual machines.
Sophos for Virtual Environments delivers effective protection for your virtual environment, whether it's running on VMware vSphere or Microsoft Hyper-V. Sophos provides efficient, always-on security for guest machines by offloading malware detection to centralized Sophos Security Virtual MachineHighlights
- Centralized virtual security VM eliminates scan and update storms
- Supports VMware vSphere and Microsoft Hyper-V
- Ensures up-to-date protection for virtual servers
- Managed through a centralized console across physical and virtual servers and endpoints, either on premises or in the cloud
- Detects and removes all remnants of threats automatically
- Protects against known and unknown threats with Live Protection
- Includes best-in-class 24/7/365 support
Security designed for virtual environments
We built Sophos for Virtual Environments to work seamlessly with both VMware vSphere and Microsoft Hyper-V. Utilizing an ultra-thin agent on each virtual machine (VM), Sophos offloads malware detection to a centralized Security VM, securing all the guests on a host. This approach gives you fast, effective protection with lower resource use and much simpler management.Real-time threat protection with automatic cleanup
Sophos for Virtual Environments allows for on-access, on-demand, or scheduled threat scanning. It also features an automated, multi-component cleanup, thanks to our ultra- thin guest agent. If malware is detected on the guest VM, it discovers and removes all remnants of the threat. Sophos Live Protection technology provides real-time protection from previously unseen threats.High performance, low impact
Specifically designed for high performance in virtualized workloads, Sophos for Virtual Environments is able to provide you with increased protection without the performance impact of a full agent. By using advanced caching, we've eliminated the need to scan redundant files. The Sophos Security VM centralized protection approach eliminates problems typically associated with agent-based solutions, including 'scan storms' and 'update storms'. The ultra-thin guest agent boasts a tiny footprint compared to full anti-malware agents, and does not require frequent updates, making it ideal for golden image deployments.Easy deployment and simplified management
Virtual environments are dynamic, so you need to be able to easily deploy and have visibility to ensure they are protected. With Sophos for Virtual Environments you can easily manage malware detection via a centralized intuitive console, with a choice of either cloud-based or an on-premises console. With either you can create policies, view alerts, request scans, and generate reports. And the same cloud-based console manages your Sophos-protected physical servers and endpoints, mobile and wireless devices, and email and web gateways.Support when you need it
Malware infections, system issues, and maintenance windows are not limited to business hours, and neither are we. Sophos provides 24/7/365 support standard-get the help you need, when you need it.
Licenses can be used across physical and virtual machines.
Sophos for Virtual Environments is included in all of the Sophos Server Protection licenses. And, you can choose your management console:
- Sophos Central, the Sophos-maintained, cloud-management environment
- Sophos Enterprise Console, the on-premise management console
Licenses can be used across physical and virtual servers as necessary. Sophos for Virtual Environments deploys easily using the hypervisor of your choice, without the need for additional appliances or third-party components, making it perfect for environments that are a mix of hypervisors, or where that flexibility is preferred.
Documentation:
Download the Sophos VDI Data Sheet (PDF).
It appears you don't have a PDF plugin for this browser. No biggie.. you can click here to download the PDF file.
Pricing Notes:
- All Prices are Inclusive of GST
- Pricing and product availability subject to change without notice.
While conducting an investigation into an attack in July in which the attackers repeatedly attempted to infect computers with Maze ransomware, analysts with Sophos’ Managed Threat Response (MTR) discovered that the attackers had adopted a technique pioneered by the threat actors behind Ragnar Locker earlier this year, in which the ransomware payload was distributed inside of a virtual machine (VM).
In the Maze incident, the threat actors distributed the file-encrypting payload of the ransomware on the VM’s virtual hard drive (a VirtualBox virtual disk image (.vdi) file), which was delivered inside of a Windows .msi installer file more than 700MB in size. The attackers also bundled a stripped down, 11 year old copy of the VirtualBox hypervisor inside the .msi file, which runs the VM as a “headless” device, with no user-facing interface.
The Maze-delivered virtual machine was running Windows 7, as opposed to the Windows XP VM distributed in the Ragnar Locker incident. A threat hunt through telemetry data initially indicated the attackers may have been present on the attack target’s network for at least three days prior to the attack beginning in earnest, but subsequent analysis revealed that the attackers had penetrated the network at least six days prior to delivering the ransomware payload.
The investigation also turned up several installer scripts that revealed the attackers’ tactics, and found that the attackers had spent days preparing to launch the ransomware by building lists of IP addresses inside the target’s network, using one of the target’s domain controller servers, and exfiltrating data to cloud storage provider Mega.nz.
The threat actors initially demanded a $15 million ransom from the target of the attack. The target did not pay the ransom.
How the attack transpired
Subsequent analysis by the MTR team revealed that the attackers orchestrated the attack using batch files, and made multiple attempts to maliciously encrypt machines on the network; The first iteration of ransomware payloads were all copied to the root of the %programdata% folder, using the filenames enc.exe, enc6.exe, and network.dll. The attackers then created scheduled tasks that would launch the ransomware with names based on variants of Windows Update Security or Windows Update Security Patches.
The initial attack did not produce the desired result; The attackers made a second attempt, with a ransomware payload named license.exe, launched from the same location. But before they launched it, they executed a script that disabled Windows Defender’s Real-Time Monitoring feature.
The attackers then, once again, executed a command that would create a scheduled task on each computer they had copied the license.exe payload to, this time named Google Chrome Security Update, and set it up to run once at midnight (in the local time zone of the infected computers).
These detections indicate that the ransomware payloads were being caught and quarantined on machines protected by Sophos endpoint products before they could cause harm. Sophos analysts started to see detections that indicated the malware was triggering the Cryptoguard behavioral protections of Intercept X. In this case, Cryptoguard was preventing the malware from encrypting files by intercepting and neutralizing the Windows APIs that the ransomware was attempting to use to encrypt the hard drive.
So the attackers decided to try a more radical approach for their third attempt.
Weaponized virtual machine
The Maze attackers delivered the attack components for the third attack in the form of an .msi installer file. Inside of the .msi was an installer for both the 32-bit and 64-bit versions of VirtualBox 3.0.4. This version dates back to 2009 and is still branded with its then-publisher’s name, Sun Microsystems.
The .msi also contains a 1.9GB (uncompressed) virtual disk named micro.vdi, which itself contains a bootable partition of Windows 7 SP1, and a file named micro.xml that contains configuration information for the virtual hard drive and session.
The root of that virtual disk contained three files associated with the Maze ransomware: preload.bat, vrun.exe, and a file just named payload (with no file extension), which is the actual Maze DLL payload.
The DLL file has a different, internal name for itself.
The preload.bat file (shown below) modifies the computer name of the virtual machine, generating a series of random numbers to use as the name, and joins the virtual machine to the network domain of the victim organization’s network using a WMI command-line function.
The virtual machine was, apparently, configured in advance by someone who knew something about the victim’s network, because its configuration file (“micro.xml”) maps two drive letters that are used as shared network drives in this particular organization, presumably so it can encrypt the files on those shares as well as on the local machine. It also creates a folder in C:SDRSMLINK and shares this folder with the rest of the network.
At some point (it’s unclear when and how, exactly, it accomplished this), the malware also writes out a file named startup_vrun.bat. We found this file in c:usersAdministratorAppDataRoamingMicrosoftWindowsStart MenuStartup, which means it’s a persistence mechanism that relies on the computer rebooting before the attackers launch the malware.
The script copies the same three files found on the root of the VM disk (the vrun.exe and payload DLL binaries, and the preload.bat batch script) to other disks, then issues a command to shut down the computer immediately. When someone powers the computer on again, the script executes vrun.exe.
The C:SDRSMLINK folder location, created when the .msi file first runs, acts as a clearinghouse for specific folders the malware wants to track. It’s full of symbolic links (symlinks, similar to Windows shortcuts) to folders on the local hard drive.
The Ragnar Locker connection
The technique used in the third attack is completely different to those used before by the threat actors behind Maze, but the investigators recognized it immediately because the team who responded to this Maze attack are the same team that responded to the Ragnar Locker ransomware attack, where the technique was first seen.
In Sophos’ earlier reporting about Ragnar Locker, we wrote that “Ragnar Locker ransomware was deployed inside an Oracle VirtualBox Windows XP virtual machine. The attack payload was a 122 MB installer with a 282 MB virtual image inside—all to conceal a 49 kB ransomware executable.” MITRE has subsequently added this technique to its ATT&CK framework.
The Maze attackers took a slightly different approach, using a virtual Windows 7 machine instead of XP. This significantly increased the size of the virtual disk, but also adds some new functionality that wasn’t available in the Ragnar Locker version. The threat actors bundled a VirtualBox installer and the weaponized VM virtual drive inside a file named pikujuwusewa.msi. The attackers then used a batch script called starter.bat.to launch the attack from within the VM.
The virtual machine (VM) that Sophos extracted from the Maze attack shows that this (newer) VM is configured in such a way that it allows easy insertion of another ransomware on the attacker’s ‘builder’ machine. But the cost in terms of size is signficant: The Ragnar Locker virtual disk was only a quarter the size of the nearly 2GB virtual disk used in the Maze attack—all just to conceal one 494 KB ransomware executable from detection.
Ragnar Locker | Maze | |
MSI installer | 122 MB OracleVA.msi | 733 MB pikujuwusewa.msi |
Virtual Disk Image (VDI) | 282 MB micro.vdi | 1.90 GB micro.vdi |
Ransomware binary in VDI | 49 KB vrun.exe | 494 KB payload |
The attackers also executed the following commands on the host computer during the Maze attack:
This ran the Microsoft Installer that installs VirtualBox and the virtual hard drive.
They stop the Volume Shadow Copy service; the ransomware itself includes a command to delete existing shadow copies.
They halt SQL services to ensure that they can encrypt any databases.
They attempt to stop Sophos endpoint protection services (which fails).
Finally, they start the VirtualBox service and launch the VM.
The future of ransomware?
Sophos Vdi Datasheet
The Maze threat actors have proven to be adept at adopting the techniques demonstrated to be successful by other ransomware gangs, including the use of extortion as a means to extract payment from victims. As endpoint protection products improve their abilities to defend against ransomware, attackers are forced to expend greater effort to make an end-run around those protections.
Sophos Vdi
Sophos endpoint products detect components of this attack as Troj/Ransom-GAV or Troj/Swrort-EG. Indicators of compromise can be found on the SophosLabs Github.