Ransomware

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. They threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid.

RaaS is a subscription for ransomware tools. RaaS allows cybercrime groups to extend their reach and decentralizes attacks, complicating efforts to disrupt them. The RaaS creators take a percentage of each successful ransom payment.

Recent Statistics and History-Making Events

Average downtime due to ransomware: 21 days

Average recovery time for organizations: 287 days

Total victims paid to decrypt their data: US$350 million

Change in payout from 2019 to 2020: 311% increase

Total victims paid to decrypt their data: US$350 million

Average individual payment: US$312,493

Year-over-year difference from 2019: 171% increase

Number of U.S.-based governments, healthcare facilities, and schools attacked: 2,400

The critical infrastructure sector that experienced more ransomware attacks than any other industry: Healthcare

On September 10, 2020, ransomware contributed to the first reported death related to a cyber attack, after an emergent patient had to be re-directed from a ransomware victim hospital in Germany.

On April 29, 2021, DHS Secretary Alejandro Mayorkas declared ransomware a national security threat.

Mitigation

• CISA's StopRansomware.gov recommends that individual users:

1. Update software and operating systems with the latest patches, because hackers most commonly attack outdated applications and operating systems;
2. Never click on links or open attachments in unsolicited emails;
3. Constantly back up data, keep it on a separate device, and store it offline;
4. Use strong passwords; and
5. Only connect to secure networks, use a VPN, and make sure you have a firewall.

Recommendations for organizations include:

1. Heavily restrict user permissions to install and run software applications;
2. Enable the strongest spam filters possible; and
3. Configure firewalls to block access to known malicious IP Addresses.

• On April 29, 2021, the Institute for Security and Technology launched the Ransomware Task Force (RTF), which released a comprehensive framework outlining 48 actions and their timelines for governments and industry leaders to undertake to disrupt the ransomware business model and mitigate attacks' impacts.

• Alternatives to payment include:

• working with the No More Ransom Project, which helps victims decrypt data without paying attackers;
• working with law enforcement, such as the FBI, immediately after noticing the attack

• To manage the fallout, an industry has grown up around cyberattack recovery. Cyber insurance (aka cybersecurity insurance, cyber risk insurance, data breach insurance, or cyber liability insurance) protects against some of the financial and legal consequences of cyber risks and attacks. This industry is focused on mitigating the side effects of cyber attacks and data breaches. The backstop support of insurance may encourage ransomware attackers, as insured victims may be more likely to pay. However, insurance providers generally require that clients adhere to baseline security practices, connect victims to recovery experts and law enforcement, and leverage market tools to incentivize security standards and discourage organizations from paying ransom.

• Zero Trust architecture limits lateral movement and contains the blast radius or ransomware attacks.

Debates

To Pay or Not to Pay?

The "DON'T make it an option" Camp

On June 10, 2021, FBI Director Christopher Wray testified before Congress that companies should not pay the ransom because doing so encourages more of this kind of activity and that victims may pay the ransom but not get their systems back.

U.S. Energy Secretary Jennifer Granholm supports legislation banning ransomware payments.

The Biden administration formed a multi-agency task force working on freeze ransomware payments made through cryptocurrency platforms

New York introduced and North Carolina passed bills to prohibit municipal ransomware payments.

The "Maybe DO let it remain an option" Camp

Bryan Hornung, the founder of cybersecurity firm Xact IT Solutions, argued that if companies cannot pay ransoms, they will have to close their doors and lawsuits will proliferate; also, the attackers may seek to extort individuals whose data are compromised if organizations do not pay.

Ed Cabrera, CCO at Trend Micro, said that criminalizing ransom payments will lead hackers to make more lethal attacks and increase the pain.

In the Harvard Business Review, Rahul Telang opined that in attacking companies rather than consumers, ransomware is forcing organizations to pay a steep, direct price for lax security and ultimately focusing organizations' attention on improving their cybersecurity and protecting their networks.

Coveware's core business model is negotiating ransomware sums.

Notorious Cases

Cobalt Strike

Cobalt Strike is the legitimate, commercially available tool used by network penetration testers that has been co-opted by threat actors. It is also known as Agentemis, BEACON, and CobaltStrike, and the threat actors that have used it include APT 29, APT32, APT41, Anunak, Cobalt, Codoso, CopyKittens, DarkHydrus, FIN6, Leviathan, Mustang Panda, Shell Crew, Stone Panda, UNC1878, UNC2452, and Winnti Umbrella.

Maze Cartel

Analyst1 Cartel Breadown

In June 2020, the Maze Cartel publically announced that TWISTED SPIDER, VIKING SPIDER, and LockBite were running a collaborative business arrangement. In November 2020, Twisted Spider announced they were shutting down the cartel operations.

The people who comprise the cartel originate from eastern Europe, primarily speak Russian, and ensure that their payloads do not execute on Russian victims. Twisted Spider used Maze ransomware from May 2019 to November 2020 and Egregor beginning in September 2020, each using its own malware, infrastructure, and online personas. The operators are very communicative with media, cybersecurity firms, and other cybercriminals. Viking Spider began its ransom operations in December 2019. Wizard Spider has multiple teams and has been participating in attacks since 2016. The Lockbit Gang was the first to automate attacks. SunCrypt was the first gang to introduce denial of service attacks to extort victims.

Darkside

Darkside is a group of hackers that carried out a significant ransomware attack in May 2021. In August 2020, Darkside introduced its Ransomware-as-a-Service (RaaS) in a press release. The group provides web chat support to victims, builds intricate data leak storage systems with redundancy, and performs financial analysis of victims prior to attacking. The group is suspected to be former IT security professionals and is known to have a code of conduct that includes not attacking hospitals, schools, non-profits, or governments, but rather big organizations. After the May 2021 Colonial Pipeline attack, Varonis’s reverse engineering revealed that Darkside’s malware checked device language settings to ensure that they don’t attack Russia-based organizations. Darkside has Windows and Linux toolsets and is similar to NetWalker and REvil in that it has an affiliate program that offers anyone who helps spread their malware 10-25% of the payout.

Darkside

• runs command and control over TOR,
• avoids nodes where EDR is running,
• uses waiting periods,
• saves noisier actions for later stages,
• customizes code and connection hosts for each victim,
• obfuscates with encoding and dynamic library loading, and
• performs anti-forensics techniques, such as deleting log files.

TrickBot

TrickBot is ransomware that was first identified in 2016. It is a trojan developed and operated by a group of hackers who initially made it as a banking trojan to steal financial data. TrickBot has become a highly modular, multi-stage suite of tools to conduct myriad illegal cyber activities. TrickBot has been used

• To exfiltrate data (email, credentials, point-of-sale info);
• For crypto-mining; and
• For host enumeration (reconnaissance of Unified Extensible Firmware Interface (UEFI) or Basic Input/Output System (BIOS) firmware)

Operators include:

• Wizard Spider
• UNC1878
• Gold Blackburn

Relies on:

• Emotet and Bokbot
• Spearphishing, spam campaigns, malvertising, and network vulnerabilities, such as Server Message Block, to gain initial access

Microsoft Disrupts Trickbot

On October 12, 2020, Microsoft announced that it had disrupted Trickbot following a court order from the United States District Court for the Eastern District of Virginia, which granted Microsoft's request to halt Trickbot’s operations. Microsoft identified and disabled the infrastructure Trickbot used to communicate with and control victim computers, how infected computers talked with each other, and how Trickbot evaded detection and disruption previously. The corporation also identified the servers' IP addresses of servers.

Netwalker

In 2019, Netwalker was sent out into the world from the cybercrime group Circus Spider, who allowed hackers to rent access to their code in exchange for a percentage of the funds received.

Conti

Conti ransomware uses a double-extortion technique. Attackers send a phishing email originating from an address that the victim trusts.

REvil

Aka Sodin aka Sodinokibi, REvil has a reputation for extorting larger ransom payments than their competitors and promoting cybercrime forums. The FBI accused REvil of orchestrating a ransomware attack on the world's largest meat processing company, JBS, in June 2021. JBS paid US$11 million in ransom to decrypt their files.

REvil Suddenly Goes Offline

On July 13, 2021, Monitors discovered that a payment website and a blog run by the REvil group suddenly became unreachable, leading many to speculate that U.S. or Russian officials may be behind the disappearance.

Ryuk

From 2018 to 2020, Ryuk spread via malicious (phishing) emails with links and attachments, notoriously attacking EMCOR Group and Epiq Global.

SamSam

From 2015 to 2018, SamSam infected the municipal/state services of Atlanta, Colorado, and San Diego and 200 public institutions/organizations.

CryptoLocker

In 2013, a new type of ransomware, also known as Gameover Zeus, used the advent of Bitcoin transactions and the latest in encryption, using 2048-bit RSA key pairs generated from a command-and-control server. Only computers running a version of Windows are susceptible to Cryptolocker (it does not target Macs).

AIDS Trojan

In 1989, one of the first ransomware attacks ever documented, also known as the PC Cyborg Virus, was released via floppy disk. Victims sent US$189 to a P.O. box in Panama to restore access to their systems.