Ransomware

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. They threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid.

Recent Statistics

In 2020...

The Average downtime due to ransomware: 21 days

Average recovery time for organizations: 287 days

Total victims paid to decrypt their data: US$350 million

Change in payout from 2019 to 2020: 311% increase</ref>

Total victims paid to decrypt their data: US$350 million

Mitigation

• CISA's StopRansomware.govCISA recommends that individual users:

1. Update software and operating systems with the latest patches, because hackers most commonly attack outdated applications and operating systems;
2. Never click on links or open attachments in unsolicited emails;
3. Constantly back up data, keep it on a separate device, and store it offline;
4. Use strong passwords; and
5. Only connect to secure networks, use a VPN, and make sure you have a firewall.

Recommendations for organizations include:

1. Heavily restrict user permissions to install and run software applications;
2. Enable the strongest spam filters possible; and
3. Configure firewalls to block access to known malicious IP Addresses.

• On April 29, 2021, the Institute for Security and Technology launched the Ransomware Task Force (RTF).

• Alternatives to payment include:

• working with the No More Ransom Project, which helps victims decrypt data without paying attackers;
• working with law enforcement immediately after noticing the attack

Debates

To Pay or Not to Pay?

The DON'T Camp: On June 10, 2021, FBI Director Christopher Wray testified before Congress that companies should not pay the ransom because doing so encourages more of this kind of activity and that victims may pay the ransom but not get their systems back. U.S. Energy Secretary Jennifer Granholm supports legislation banning ransomware payments.
The Maybe DO Camp: Bryan Hornung, the founder of cybersecurity firm Xact IT Solutions, argued that if companies cannot pay ransoms, they will have to close their doors and lawsuits will proliferate; also, the attackers may seek to extort individuals whose data are compromised if organizations do not pay. Ed Cabrera, CCO at Trend Micro, said that criminalizing ransom payments will lead hackers to make more lethal attacks and increase the pain.

Notorious Cases

Darkside

Darkside is a group of hackers that carried out a significant ransomware attack in May 2021. In August 2020, Darkside introduced its Ransomware-as-a-Service (RaaS) in a press release. The group provides web chat support to victims, builds intricate data leak storage systems with redundancy, and performs financial analysis of victims prior to attacking. The group is suspected to be former IT security professionals and is known to have a code of conduct that includes not attacking hospitals, schools, non-profits, or governments, but rather big organizations. After the May 2021 Colonial Pipeline attack, Varonis’s reverse engineering revealed that Darkside’s malware checked device language settings to ensure that they don’t attack Russia-based organizations. Darkside has Windows and Linux toolsets and is similar to NetWalker and REvil in that it has an affiliate program that offers anyone who helps spread their malware 10-25% of the payout.

Darkside

• runs command and control over TOR,
• avoids nodes where EDR is running,
• uses waiting periods,
• saves noisier actions for later stages,
• customizes code and connection hosts for each victim,
• obfuscates with encoding and dynamic library loading, and
• performs anti-forensics techniques, such as deleting log files.

TrickBot

TrickBot is ransomware that was first identified in 2016. It is a trojan developed and operated by a group of hackers who initially made it as a banking trojan to steal financial data. TrickBot has become a highly modular, multi-stage suite of tools to conduct myriad illegal cyber activities. TrickBot has been used

• To exfiltrate data (email, credentials, point-of-sale info);
• For crypto-mining; and
• For host enumeration (reconnaissance of Unified Extensible Firmware Interface (UEFI) or Basic Input/Output System (BIOS) firmware)

Operators include:

• Wizard Spider
• UNC1878
• Gold Blackburn

Relies on:

• Emotet and Bokbot
• Spearphishing, spam campaigns, malvertising, and network vulnerabilities, such as Server Message Block, to gain initial access

Microsoft Disrupts Trickbot

On October 12, 2020, Microsoft announced that it had disrupted Trickbot following a court order from the United States District Court for the Eastern District of Virginia, which granted Microsoft's request to halt Trickbot’s operations. Microsoft identified and disabled the infrastructure Trickbot used to communicate with and control victim computers, how infected computers talked with each other, and how Trickbot evaded detection and disruption previously. The corporation also identified the servers' IP addresses of servers.

Netwalker

In 2019, Netwalker was sent out into the world from the cybercrime group Circus Spider, who allowed hackers to rent access to their code in exchange for a percentage of the funds received.

Conti

Conti ransomware uses a double-extortion technique. Attackers send a phishing email originating from an address that the victim trusts.

REvil

Aka Sodin aka Sodinokibi, REvil has a reputation for extorting larger ransom payments than their competitors and promoting cybercrime forums.

Ryuk

From 2018 to 2020, Ryuk spread via malicious (phishing) emails with links and attachments, notoriously attacking EMCOR Group and Epiq Global.

SamSam

From 20-15 to 2018, SamSam infected the municipal/state services of Atlanta, Colorado, and San Diego and 200 public institutions/organizations.