{"id":5531,"date":"2022-11-24T09:00:00","date_gmt":"2022-11-24T09:00:00","guid":{"rendered":"https:\/\/www.adminbyrequest.com\/?p=5531"},"modified":"2026-01-25T07:50:32","modified_gmt":"2026-01-25T07:50:32","slug":"venus-ransomware-hits-healthcare","status":"publish","type":"post","link":"https:\/\/www.adminbyrequest.com\/en\/blogs\/venus-ransomware-hits-healthcare","title":{"rendered":"Venus Ransomware Hits Healthcare"},"content":{"rendered":"\n

We can all agree: ransomware perpetrators are the lowest of the low. The general consensus proved to be truer than ever during the Covid-19 pandemic when healthcare organizations \u2013 previously left alone for the most part as an \u2018unspoken rule\u2019 amongst hackers \u2013 became popular targets for cyber criminals,<\/p>\n\n\n\n

Unfortunately, hackers haven\u2019t let up in this area post-Covid. It\u2019s been revealed by the United States Department of Health and Human Services (HHS) that one, possibly more, healthcare firms have fallen victim to ransomware over the past few months.<\/p>\n\n\n\n

The culprit? Venus ransomware.<\/p>\n\n\n\n

Venus Rising<\/h2>\n\n\n\n

Far from having the qualities of its planetary namesake (love, beauty, prosperity, victory), Venus is a run-of-the-mill piece of ransomware that targets the Windows OS.<\/p>\n\n\n\n

Bleeping Computer<\/a> provides the breakdown:<\/p>\n\n\n\n

1. Initial access is gained via exposed RDP session \u2013 one of the two most common attack vectors, along with phishing. The hackers scan all ports (not just the default 3389 RDP listening port), listen for a response to determine an RDP connection, then likely gain access via brute force.<\/p>\n\n\n\n

2. Once access to the target system is gained, the malware attempts to kill the following 39 processes relating to Microsoft Office apps and database servers:<\/p>\n\n\n\n

taskkill, msftesql.exe, sqlagent.exe, sqlbrowser.exe, sqlservr.exe, sqlwriter.exe, oracle.exe, ocssd.exe, dbsnmp.exe, synctime.exe, mydesktopqos.exe, agntsvc.exe, isqlplussvc.exe, xfssvccon.exe, mydesktopservice.exe, ocautoupds.exe, agntsvc.exe, agntsvc.exe, agntsvc.exe, encsvc.exe, firefoxconfig.exe, tbirdconfig.exe, ocomm.exe, mysqld.exe, mysqld-nt.exe, mysqld-opt.exe, dbeng50.exe, sqbcoreservice.exe, excel.exe, infopath.exe, msaccess.exe, mspub.exe, onenote.exe, outlook.exe, powerpnt.exe, sqlservr.exe, thebat64.exe, thunderbird.exe, winword.exe, wordpad.exe<\/p>\n\n\n\n

3. It then goes about deleting event logs, VSS Shadow Copies, and disables Data Execution Prevention using the command below:<\/p>\n\n\n\n

wbadmin delete catalog -quiet && vssadmin.exe delete shadows \/all \/quiet && bcdedit.exe \/set {current} nx AlwaysOff && wmic SHADOWCOPY DELETE<\/p>\n\n\n\n

4. After all of the above is successfully completed, the stage is set for encryption. Venus appends .venus to encrypted files (in addition to the existing file extension), and a bright orange HTA ransom note is automatically displayed on the victim\u2019s screen:<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Source: Bleeping Computer<\/em><\/p>\n\n\n\n

Notably, to date the perpetrators do not seem to be focused on Data leakage, instead pouring all their efforts into encryption.<\/p>\n\n\n\n

Venus also doesn\u2019t discriminate based on target type or size. As well as healthcare giants, there have been reports from individuals on Bleeping Computer<\/a> who have found files on their home PCs and servers sporting the .venus extension.<\/p>\n\n\n\n

Tips for Prevention<\/h2>\n\n\n\n

When you break it down, there are essentially three stages to the Venus attack. The first is the initial infection \u2013 the malicious software finding its way into your IT system. Then comes \u2018setting the scene\u2019 for encryption, and the third and final stage is the encryption itself. Everything prior to stage three can be recovered from if detected, but once your files are appended with the dreaded .venus\u2026 start saving for at least 1 BTC if you\u2019re an individual, and likely upwards of 20 if you\u2019re an enterprise. (Just kidding, it\u2019s advised to never pay a ransom.)<\/p>\n\n\n\n

Let\u2019s start with the initial-infection attack vector, Remote Desktop Protocol (RDP). It\u2019s a readily available direct path to another endpoint or network, and it provides native access to the victim\u2019s system. The credentials used to create an RDP connection are usually administrator credentials, meaning if an attacker manages to obtain these, they then have full privileges on the endpoint and can do a lot more damage.<\/p>\n\n\n\n

Tip 1: <\/strong>Stop using RDP.<\/p>\n\n\n\n

In fact, with Venus (and most ransomware), elevated privileges are a requirement for stage 2: successfully preparing for encryption. Venus has to stop services and processes, delete event logs and shadow volume copies, and disable critical software prior to encryption \u2013 none of these tasks can be completed by a standard user.<\/p>\n\n\n\n

Tip 2: <\/strong>Restrict administrative privileges.<\/p>\n\n\n\n

While Venus ransomware is busy killing Windows services and deleting logs, the user remains blissfully unaware of what is happening because the exact tools that should alert them to the situation have been circumvented by the ransomware – it can proceed to the third and final encryption stage unhindered.<\/p>\n\n\n\n

Tip 3:<\/strong> Use a third-party Auditing tool.<\/p>\n\n\n\n

Turning Tips into Tools<\/h2>\n\n\n\n

It\u2019s all well and good to know what you need to be doing to protect your enterprise from threats such as Venus ransomware, but putting reliable protective measures in place is a whole other ball game.<\/p>\n\n\n\n

With Admin By Request Privileged Access Management (PAM) solution, each of the three stages of a Venus attack can be prevented or detected prior to successful encryption.<\/p>\n\n\n\n

From the User Portal, you can block any application from running on every endpoint that the software is deployed to. Create a blanket rule that RDP can\u2019t be used at your organization, and enforce it by Blocking the application:<\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

In terms of privileged access, Admin By Request allows for the instant revocation of your users\u2019 elevated privileges. All users become standard user \u2013 unless specified otherwise in the User Portal, where you can create granular access rules for different users, groups, and OUs.<\/p>\n\n\n\n

Users who require elevated privileges to do their jobs can remain productive (and protected) with Admin By request, which provides Just-In-Time elevation for individual applications upon request, rather than elevating the user or allowing them to have around-the-clock privileges.<\/p>\n\n\n\n

In terms of event logging, Venus is programmed to shut down the built-in Windows tools that would give you an idea of its presence in the system. Admin By Request offers a detailed Auditlog which tracks and records all elevated activity. Actions like stopping processes, deleting privileged data, and disabling key pieces of software are all logged with relevant details such as the time, file, and the user who enacted the change included. Alerting capabilities detect actions deemed suspicious, and send desktop or email notifications based on your configuration.<\/p>\n\n\n\n

TL, DR<\/h2>\n\n\n\n

With Admin By Request deployed and configured appropriately, Venus ransomware would be unable to enact its attack plan on your endpoints and encrypt your organization\u2019s data.<\/p>\n\n\n\n

Download the\u00a0Admin By Request Free Plan<\/a>\u00a0or book a demo today to get started \u2013 and rest assured your enterprise won\u2019t be the next to make headlines.<\/p>\n","protected":false},"excerpt":{"rendered":"

Initial infection via RDP, killing 39 processes, deleting event logs, then encryption – but all stages of the Venus ransomware attack can be prevented with the right tools.<\/p>\n","protected":false},"author":2,"featured_media":5532,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[36],"tags":[89,80,83,90,91,81,82,62,79,85,86,87,88],"ppma_author":[9],"class_list":["post-5531","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogs","tag-criminal","tag-current-events","tag-cyber-attack","tag-cyber-criminal","tag-hacker","tag-healthcare","tag-malware","tag-microsoft","tag-ransomware","tag-rdp","tag-remote-desktop-protocol","tag-venus","tag-venus-ransomware","entry","has-media"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t