← Cybersecurity Today
Cybersecurity Today
Ingram Micro Ransomware Attack and the Rise of Linux SSH Server Compromises
00:10:41
In this episode of Cybersecurity Today, host David Shipley discusses the recent Safe Play ransomware attack on technology distributor Ingram Micro, exploring its impact and ongoing recovery efforts. The script also examines a new campaign targeting...
Loading summary
Transcript1 lines
- [00:01]
David Shipley
Ingram Micro has been hit with the safeplay ransomware Criminals are ramping up efforts to compromise Linux SSH servers to build proxy networks. Clickfix social engineering attack up 500% and a former ransomware negotiator is under criminal investigation for working with gangs to profit off of extortion payments. This is Cybersecurity Today and I'm your host, David Shipley. Let's get started. Ingram Micro, one of the largest technology distributors on the planet, said Saturday it was hit with a ransomware attack late last week. The publicly traded California firm was still dealing with the impact from the incident as of Sunday afternoon, with its website still down and redirecting to more information on the cybersecurity incident. In a release on Business Wire, the company said it recently discovered ransomware on some of its internal systems. The firm said it took steps to secure the relevant environment and proactively took some systems offline, as well as implementing other mitigating measures. Ingram Micro says it has launched an investigation with the assistance of leading cybersecurity experts and has notified law enforcement. It said it was working hard to restore affected systems and to resume processing and shipping orders. Bleeping computer posted the Safeplay ransomware note allegedly tied to the incident in it SafePay claims it exploited, quote, a number of mistakes, end quote Ingram made in, quote, setting up the security of your corporate network, so we were able to spend quite a long time in IT and compromise you, end quote. The safeplay note claims the intruders access sensitive and confidential information, including documents pertaining to financial statements, intellectual property, accounting records, lawsuits and complaints, personal and customer files, bank details, transactions and more. Interestingly, the group seemed to go out of its way to note the attack was purely financially motivated and not political. None of these claims have been independently verified. Ingram Micro had more than $47.98 billion in revenue in 2024, making it one of the most valuable U.S. technology companies. The ransomware attack comes on the heels of the firm returning to the Fortune 500 in June. Founded 46 years ago, Ingram Micro is a backbone distributor to value added resellers, managed service providers and more. Managed service providers who spoke to the Register reported being unable to manage customers. Microsoft 365 licenses, Dropbox licenses, hardware purchases and more hitting Ingram Micro is the technology sector equivalent of the Colonial Pipeline attack. A prolonged outage could have massive impacts across nearly 90% of the global technology marketplace. Ingram Micro also resells Microsoft's Office and Azure cloud offerings with some posters on Reddit's MSP thread on the weekend warning folks to revoke Ingram Micro accounts. As of Sunday, there was no evidence that Ingram Micro's incident had spread to others. However, the company's sheer reach would make any such event larger than anything we've ever seen. According to a recent Media article, Ingram manages more than 50 million seats in cloud services. We may all want to be grateful that this increasingly appears to be a vanilla cybercrime extortion attempt and not a nation state run, because had it been, things could have been far worse. If this outage takes the typical several weeks to several months to fully resolve the risks of major disruptions throughout, a broad swath of the technology supply chain will grow. A new campaign is targeting misconfigured Linux servers, with attackers deploying legitimate proxy software to covertly build network infrastructure for criminal use. This matches a trend we've been following since the start of the year, with criminal groups building new infrastructure leveraging proxies around the world. According to the onlab Security Emergency Response center or asec, threat actors are scanning for Linux systems with weak or default SSH credentials. Once access is gained, the attackers install Proxy tools, specifically TinyProxy and SingBox, to create scalable, anonymized networks. These tools are typically used for legitimate purposes such as content routing or bypassing geo restrictions, but in this case they're being repurposed for malicious activity. Unlike traditional malware campaigns that aim to exfiltrate data or encrypt files, this operation is focused on maintaining a stealth presence. No additional malware is deployed. Instead, the attackers use lightweight bash scripts that detect the server's operating system and use standard Linux package managers APT, YUM and or DNF to install TinyProxy. Once installed, the script modifies the configuration file located at etc. Tinyproxy tinyproxy conf. It removes any restrictive access controls and replaces them with a universal rule allow 0.0.0.00. This opens the proxy to all incoming connections, effectively allowing anyone on the Internet to route traffic through the compromised server via port 8.8.8.8. A second variant of the campaign uses Singbox, a multipurpose proxy that supports advanced protocols like VMessargo, VLAS, Reality Hysteria 2 and 2 UIC V5. These protocols are often used in circumvention tools, but here they appear to be facilitating anonymization for broader criminal infrastructure. Installation is carried out using scripts hosted on GitHub, pointing to a structured and potentially large scale operation. Comments found in the script are written in Polish, which may indicate the regional origin of the attacks or at least provide a linguistic clue. However, attribution remains unclear. Security researchers suggest the infrastructure is being monetized through proxy as a service offerings or leveraged to obscure the source of further malicious activity. For organizations running Linux based infrastructure, especially systems exposed to the Internet via ssh, security teams are advised to enforce strong authentication, ideally using SSH keys and not just passwords, audit for unauthorized proxy services, and monitor outbound traffic for signs of proxy misuse. This campaign highlights a shift in tactics from delivering destructive payloads to quietly establishing a persistent network resource that can be used in ongoing or future cyber operations. It's particularly relevant given the decline in the ability of criminals to use traditional bulletproof hosting services. Cybersecurity firm ESET says click fix attacks are up 500% in the first half of 2025, coming second only to traditional phishing as the most common attack method. The findings come in the latest ESET threat report, which summarizes threat data captured by its security tools. Quick fix attacks display a fake error that manipulates the victim into copying, pasting and executing malicious commands on their devices. The attack vector affects all major operating systems including Windows, Linux and macOS. It often mimics common human validation systems like Cloudflare or CAPTCHA services that are commonly deployed to distinguish human and bot traffic. The click fix technique is used to deploy infostealers, ransomware, remote access trojans, crypto miners, post exploitation tools, and even custom malware from nation state aligned threat actors, ESET says In the same report, ESET also gave some good news. In it, it said that global ransomware continues to descend into chaos, with fights between major gangs impacting several players, including the leading ransomware as a service ransom hub. While ransomware attacks and the number of gangs are up compared to 2024, payments are down. It's unclear why, but the report suggests that the combination of successful global law enforcement actions last year against a number of gangs and an increase in exit scams that's where gangs bail on their affiliates without paying them contributed to the growing chaos. Speaking of the ransomware industry and chaos, here's another interesting wrinkle. An ex ransomware negotiator is under criminal investigation by the U.S. department of justice for allegedly working with the ransomware gangs to profit from extortion payments. The suspect is a former employee of Digital Mint, a Chicago based incident response and digital asset services company that specializes in ransomware negotiation and facilitating cryptocurrency payments to receive a decryptor or prevent stolen data from being publicly released. The company claims to have conducted over 2,000 ransomware negotiations since 2017. Bloomberg first reported last week that the DOJ is investigating whether the suspect was working with ransomware gangs to negotiate payments, then allegedly receiving a cut of the ransom that was charged to the customer. The DOJ refused to comment when Bloomberg contacted them last week. From my perspective, ransom negotiation as an industry was always ethically challenging. Some ransomware operators such as Gancab and Reevil, even created special discount codes and chat interfaces specifically designed for these type of firms to receive a discount on the ransom demand. Some vendors in the ransomware negotiation space have been critical of others who don't use a fixed fee structure, with those that don't use that fixed fee structure often lending themselves to potential abuse. As always, stay skeptical and stay patched and yesterday was a good day to start doing fourth party breach Tabletops. We're always interested in your opinion and you can contact us@EditorialEchnewsDay CA or leave a comment under the YouTube video. I've been your host David Shipley, sitting in for Jim Love, who will be back on Wednesday. Thanks for listening.