Excellium services newsletter : Ransomware attacks: a new significant business industry

In recent years, ransomware attacks evolved from simple and basic encryption malware to a complex and organized industry. With this evolution, attacks have now a far more important impact on business continuity and the company reputation.

by Excellium SA

Share

Excellium services newsletter : Ransomware attacks: a new significant business industry

In recent years, ransomware attacks evolved from simple and basic encryption malware to a complex and organized industry. With this evolution, attacks have now a far more important impact on business continuity and the company reputation.

by Excellium SA

by Excellium SA

In recent years, ransomware attacks evolved from simple and basic encryption malware to a complex and organized industry. With this evolution, attacks have now a far more important impact on business continuity and company reputation.

The old fashion way

Even if ransomware exists since 1989, they became largely popular in the late mid-2000s. Until the late mid-2010s, almost all ransomware attacks observed by CERT-XLM were based on the same pattern:

  • Hackers send one malicious file to a large target audience with only basic capabilities. The large majority are targeting Windows environment,
  • When executed, the malware encrypts all the available file on the system and on mapped network shares.
  • Last, attackers drop a ransom note on the system: a text file or a new wallpaper explaining that they encrypted all the files and describing the payment method to recover them.

Then, new features were added gradually:

  • The usage of the unique executable for each victim to limit the detection,
  • The possibility to replicate itself inside the network with either vulnerability – like the WannaCry campaign exploiting the MS17-010 – or by brute-forcing credentials on other systems.

The overall process was industrialized, with different actors coding the malware, distributing it, and managing the payment. Almost no human interactions were necessary after the launch of a campaign.

What CERT-XLM now observes is a breakthrough in the ransomware attacks.

Recent ransomware evolution

One big change in the recently observed cases is a manual intervention to maximize the damages and increase the profits of the attack.

The initial vectors are more diverse. Phishing is still the most common infection vector, but attackers’ groups now also exploit vulnerabilities on border security devices. For example, they largely used remote code execution on Citrix Gateway Server (CVE-2019-19781) or on Pulse Secure (CVE-2019-11510) to get access in the internal network. We also identify the brute-force of exposed services like RDP during our investigations.

From the internal network, attackers then use the same techniques and tools as pentesters (Kali, Cobalt Strike, Metasploit, Mimikatz…)  to overtake the domain. Once they gain and persist accesses, they resold them on the black market: many forums exist where some can buy these accesses.

With Domain Admin privilege on the infrastructure, attackers then exfiltrate as much as possible data like emails, database, source code, files share and of course users’ credentials.

Now the messing part can start. Some attackers hide their track of compromise by cleaning logs, but it is not so common. They prepare a ransomware and deploy it on all systems, typically with a GPO. It is also common to disable anti-virus and delete backups to maximize the damages.

At this time, all systems are infected, «pulling the cable» will not stop the attack as it could in the past. In addition, with this technique, almost everything is accessible, and malware is no longer limited to user privileges.

Finally, attackers drop a ransom note, but, in the recent trend, attackers are not only asking the victim to pay for data recovery: they also create a website, a shaming list, mostly on TOR, and threaten to publish the stolen data on it if companies don’t pay the ransom.

How to protect from ransomware

Even if the techniques evolve, the main security recommendations remain the same:

  • Assess and patch your border security. The newly discovered vulnerabilities on the remote access solution show how dangerous it is to keep an unpatched Citrix Gateway exposed on the internet. Ensure that you have strong access mechanism enforced like Multi-Factor Authentication.
  • Make sure you have a strong email policy and your users are fully aware of existing threats. Still today, most of the cases investigated by CERT-XLM start from a phishing email.

In addition, to reduce the risk of a full domain compromise from foothold gained by an attacker as a simple user, do perform intrusion tests:

  • To discover weaknesses in your internal network,
  • To set up proper alerting before it is too late.

Finally, the best way to recover from a ransomware attack is backups, more precisely: offline backups. It is crucial to not only keep them offline but also regularly test restoration to ensure it’s working as expected. If the backups are not offline, they will probably get encrypted too …

Conclusion

To sum up, the ransomware attacks moved from an automated industry to a more efficient approach with deep intrusion and compromise of the infrastructure, and where the data encryption is just one of the ways to ransom victims.

The development of a public shaming list of victims largely also increases payment pressure on victims. The cost for the company has now tripled:

  • The remediation cost to restore the whole information system,
  • The cost due to the loss of activity until the company contain the incident,
  • The loss of competitive advantage if attackers publicly disclose internal information like email, source code or confidential files
Top