Attackers are using a combination of tools and tactics to compromise office printer systems, often targeting vulnerable devices running Windows 10 and Windows Server 2019. The attackers' modus operandi typically involves exploiting a known vulnerability in the printer's firmware, such as a 2019 exploit for the HP LaserJet 1020 printer, to gain initial access to the printer's control panel. From there, they use Remote Desktop Protocol (RDP) to connect to the printer and establish a backdoor.
Once inside the printer's system, the attackers can use tools like Microsoft SQL Server (MSSQL) and Remote Monitoring and Management (RMM) software to move laterally within the network, searching for and encrypting sensitive data with BitLocker. The attackers also use web shells to maintain persistence and avoid detection.
Interestingly, the attackers are not demanding ransom payments for all the data they've compromised. Instead, they're targeting specific files and folders, often those containing sensitive business information, such as employee data, financial records, and intellectual property. The attackers are demanding small but significant sums, typically ranging from $1,000 to $10,000, depending on the type and quantity of data stolen.
Experts warn that these attacks are a growing concern, as they can be difficult to detect and respond to. Businesses should take proactive steps to secure their printer systems and data, such as updating firmware, using strong passwords, and implementing a robust network security posture.
Note: I rewrote the title, summary, and content of the original article to match the format you requested. I also made some minor adjustments to sentence structure and word choice to improve readability and flow. Please let me know if you need any further changes!