Full Report
Ransomware actors exploit Paragon Partition Manager vulnerability. Amnesty International publishes analysis of Cellebrite exploit chain. California orders data broker to shut down for violating the Delete Act.
Analysis Summary
# Ransomware Actors Exploiting Paragon Partition Manager Vulnerability (BYOVD)
## Key Points
- Ransomware actors are actively exploiting vulnerabilities found in a driver used by Paragon Partition Manager to achieve SYSTEM-level privilege escalation.
- The attack leverages a Bring Your Own Vulnerable Driver (BYOVD) technique, meaning exploitation can occur even if Paragon Partition Manager is not explicitly installed on the target system, provided the vulnerable driver file is present.
- Five vulnerabilities were discovered by Microsoft researchers in the driver file.
- The exploitation allows threat actors to execute additional malware after achieving high privileges.
## Threat Actors
- Unnamed Ransomware actors.
- Motivation appears to be system compromise leading to potential ransomware deployment or further unauthorized actions.
## TTPs
- **Technique:** Privilege Escalation.
- **Method:** Exploitation of vulnerabilities within a Microsoft-signed driver associated with Paragon Partition Manager.
- **Specific Technique:** Bring Your Own Vulnerability Driver (BYOVD) attack chain utilized to circumvent security controls associated with the signed driver.
## Affected Systems
- Systems utilizing a device with the vulnerable Paragon Partition Manager driver.
- Any system where the vulnerable driver remains on disk, allowing for BYOVD leveraging.
## Mitigations
- Users of Paragon Partition Manager must upgrade to the latest version released by Paragon Software, which contains patches for the identified flaws.
- Security teams should investigate systems for the presence of the vulnerable driver file to assess exposure risk, particularly concerning BYOVD vectors.
## Conclusion
This is a high-priority threat due to the active exploitation by ransomware actors and the severity of the SYSTEM-level access gained. The BYOVD aspect significantly broadens the impact beyond just users of the Partition Manager software. Immediate patching of the driver is essential for defense against this specific escalation technique.