Title: How Hackers Bypass Security Controls Using Windows Safe Mode and AnyDesk Remote Administration Tool

As technology continues to evolve, hackers are also finding new ways to evade security measures. A recent report by Sophos reveals that Russian hackers have been using a combination of Windows Safe Mode and the remote administration tool, AnyDesk, to bypass security controls.

The attack begins with attackers installing AnyDesk on targeted machines, specifically configuring it to run in Safe Mode while connected to the network. This allows them to maintain control over the device even when the target organization tries to lock out remote access. The hackers then disable Windows Update services and Windows Defender, as well as attempt to disable components of commercial security software solutions that can run in Safe Mode.

The script issues a series of consecutive commands that prepare the machines for the release of the ransomware and then reboots into Safe Mode. This allows the attackers to gain full remote control over every machine they've set up with AnyDesk, while the target organization is locked out of remote access to those computers.

AvosLocker is a relatively new ransomware-as-a-service that first appeared in late June 2021 and has been growing in popularity according to Sophos. The hackers use PDQ Deploy to run and execute a batch script called 'love.bat', 'update.bat', or 'lock.bat' on targeted machines, which then executes the ransomware.

Sophos researchers investigating the ransomware deployment found that the main sequence starts with attackers using PDQ Deploy to run and execute a batch script called “love. bat,' “update. bat,' or “lock. bat' on targeted machines. The Sophos Rapid Response team has so far seen AvosLocker attacks in the Americas, Middle East and Asia-Pacific, targeting Windows and Linux systems.

According to Peter Mackenzie, director of incident response at Sophos, 'Sophos has never seen some of these components used with ransomware, and certainly not together.' This highlights the importance of staying vigilant and up-to-date with security measures to prevent such attacks.

In conclusion, hackers are constantly finding new ways to evade security controls. It is crucial for organizations to be aware of these tactics and take necessary precautions to protect themselves against such threats.

Iphone anydesk