Threat Overview – BlueSky
In the ever-evolving landscape of cyber threats, a new player has emerged with alarming efficiency: the BlueSky Ransomware variant. First spotted in June 2022, this malicious software has been targeting public-facing MSSQL servers, showing similarities with infamous ransomware variants like Conti and Babuk. BlueSky’s tactics, infrastructure, and rapid propagation mark it as a formidable threat to organizations, especially those with vulnerable MSSQL servers exposed to the internet.
Campaign Overview
BlueSky’s campaign is characterized by its swift and aggressive approach. It gains initial access through brute force attacks on MSSQL servers, a tactic observed in a detailed DFIR Report from December 2024. Post-intrusion, the actors move quickly to encrypt files, appending them with the “.bluesky” extension and leaving a ransom note for victims. Its active infrastructure into 2023 indicates that BlueSky is not a fleeting threat but a persistent danger to organizations’ digital assets.
Technical Details
The BlueSky Ransomware exhibits a sophisticated modus operandi. It initiates its attack by exploiting MSSQL servers through brute force, then utilizes Extended SQL Stored Procedures for command execution. This access allows the threat actor to deploy Cobalt Strike beacons and PowerShell scripts aimed at disabling protection measures and extracting credentials. Notably, BlueSky uses Tor2Mine malware, which employs scripts to hinder malware protections, and establishes persistence through scheduled tasks and services. Lateral movement within networks involves Remote Service creation and domain controller exploitation, signifying a comprehensive attack strategy.
Taking Action Against BlueSky
In the face of this escalating threat, preparedness is key. Organizations with public-facing MSSQL servers must be particularly vigilant. As BlueSky Ransomware employs varied attack methods, ranging from direct brute force to sophisticated PowerShell scripts, a robust defense strategy is crucial. This includes regular monitoring, updating security protocols, and employing advanced threat hunting techniques.
To effectively combat threats like BlueSky, Cyborg Security’s HUNTER Platform offers a proactive solution. Our platform provides free and premium hunt packages specifically designed to hunt for the behaviors, tactics and techniques of BlueSky Ransomware. These packages include behavioral threat hunting content, which is pivotal in identifying and mitigating such advanced threats.
For those without a Community account on HUNTER, signing up is straightforward and free. By doing so, you gain access to our extensive library of hunt packages and tools, empowering your organization to stay ahead of threats like BlueSky.
