{"id":86086,"date":"2020-06-21T13:42:19","date_gmt":"2020-06-21T11:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/ransomware-novyj-sposob-organizaczii-utechek-dannyh"},"modified":"2020-06-21T13:42:19","modified_gmt":"2020-06-21T11:42:19","slug":"ransomware-novyj-sposob-organizaczii-utechek-dannyh","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/ransomware-novyj-sposob-organizaczii-utechek-dannyh","title":{"rendered":"Ransomware - a new method for organizing data breaches","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Data breaches are a pressing issue for security services. Now, with most people working from home, the risk of breaches is significantly higher. This is why notorious cybercriminal groups are focusing on outdated and inadequately secured remote access protocols. Interestingly, a growing number of data breaches today are linked to ransomware. How, why, and in what way - read on.<\/p>\n

\"Ransomware
\n<\/a><\/noindex>
\nLet's start with the fact that the development and distribution of ransomware is a highly profitable criminal business in itself. For instance, according to estimates from the American FBI, the Sodinokibi group<\/a><\/noindex> earned approximately $1 million per month over the past year. Meanwhile, criminals using Ryuk were making even more - at the start of the group's activities, their earnings reached up to $3 million per month. So, it's no surprise that many Chief Information Security Officers (CISOs) identify ransomware as one of the top five risks to businesses.<\/p>\n

The Acronis Cyber Protection Operation Center (CPOC) in Singapore confirms the rise of cybercrime in the ransomware sector. In the second half of May, a 20% increase in blocked ransomware attacks was observed globally compared to normal levels. After a slight decline, we are now seeing a resurgence in activity this June. There are several reasons for this. <\/p>\n

Gaining access to the victim's computer
\n<\/h3>\n

\nProtection technologies are evolving, and criminals must change their tactics to penetrate specific systems. Ransomware attacks still spread through well-crafted phishing emails (which often involve social engineering). However, recently, malware developers have been paying particular attention to remote employees. To target them, one can find poorly secured remote access services, such as RDP or VPN servers with vulnerabilities.
\nThis is exactly what they are doing. Ransomware-as-a-service offerings have emerged in the dark web, providing everything necessary to attack a chosen organization or individual. <\/p>\n

Attackers seek any means to infiltrate corporate networks and broaden their attack scope. A popular method has become attempts to infect service providers' networks. As cloud services are gaining popularity today, infecting a well-known service allows attackers to target dozens or even hundreds of victims at once. <\/p>\n

In the event of a breach of web management consoles for security systems or backup services, attackers can disable protection, delete backups, and ensure their malware is deployed throughout the organization. That's why experts recommend rigorously securing all service accounts with multi-factor authentication. For instance, all Acronis cloud services allow for dual protection, as, in case of a password compromise, attackers can nullify all the advantages of using a comprehensive cybersecurity system. <\/p>\n

Expanding the attack scope
\n<\/h3>\n

\nOnce the coveted target is achieved and the malware is already within the corporate network, standard tactics are typically employed for further propagation. Attackers assess the situation and strive to overcome the barriers that have been set up within the company to counteract threats. This part of the attack can occur manually (after all, if they are already inside the network, the bait is on the hook!). For this, well-known tools such as PowerShell, WMI PsExec, and newer tools like Cobalt Strike are used. Some criminal groups specifically target password managers to penetrate deeper into the corporate network. Recently, malware such as Ragnar has been spotted in a completely isolated VirtualBox virtual machine image, which helps to conceal unwanted software presence on the machine. <\/p>\n

Thus, when entering a corporate network, malware tries to verify the user's access level and apply stolen passwords. Utilities such as Mimikatz and Bloodhound & Co. assist in breaking into domain administrator accounts. Only when the attacker believes the possibilities of spreading are exhausted does the ransomware program load onto client systems. <\/p>\n

Ransomware as a cover
\n<\/h3>\n

\nGiven the seriousness of the threat of data loss, more companies are implementing what is known as a \"Disaster Recovery Plan\" each year. This way, they do not worry too much about encrypted data and, in the event of a ransomware attack, they do not start collecting a ransom but instead initiate the recovery process. However, the attackers are not idle. Under the guise of ransomware, mass data theft occurs. The first to adopt this tactic on a large scale was Maze back in 2019, although other groups have periodically combined attacks as well. Now, at least Sodinokibi, Netfilm, Nemty, Netwalker, Ragnar, Psya, DoppelPaymer, CLOP, AKO, and Sekhmet are engaged in data theft alongside encryption.<\/p>\n

Sometimes attackers manage to siphon off dozens of terabytes of data from a company, which could have been detected by network monitoring tools (if they had been installed and configured). After all, most data transfer typically occurs simply via FTP, Putty, WinSCP, or PowerShell scripts. To bypass DLP and network monitoring systems, data can be encrypted or sent as a password-protected archive, posing a new challenge for security services that need to inspect outgoing traffic for such files.<\/p>\n

Studies of the behavior of infostealers show that attackers do not collect just anything\u2014they are particularly interested in financial reports, client databases, personal information of employees and clients, contracts, records, and legal documents. Malware scans drives in search of any information that could theoretically be used for extortion.
\nIf such an attack was successful, attackers typically publish a small teaser, showing a few documents as proof that data has leaked from the organization. Some groups even publish the entire data set on their website if the ransom deadline has passed. To avoid detection and ensure broad reach, data is also published on the TOR network.<\/p>\n

Another monetization method is the sale of data. For instance, Sodinokibi recently announced open auctions where data is awarded to the highest bidder. The starting price for such auctions ranges from $50,000 to $100,000, depending on the quality and content of the data. For example, a set of 10,000 records on cash flows, confidential business data, and scanned driver's licenses were sold for at least $100,000. For $50,000, one could acquire over 20,000 financial documents plus three databases with accounting files and client data. <\/p>\n

The websites where leaks are published vary widely. They can be simple pages where all the stolen data is posted, or they can have more complex structures with sections and purchasing options. However, the main goal of all these sites is the same \u2014 to increase the chances of attackers getting real money. If this business model proves successful for the attackers, there\u2019s no doubt that more such sites will emerge, and techniques for stealing and monetizing corporate data will further expand.<\/p>\n

Here are the current websites where data leaks are published:<\/p>\n

\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n\"Ransomware
\n<\/p>\n

What to do about new attacks
\n<\/h3>\n

\nThe main challenge for security services under these conditions is that recently, more incidents related to Ransomware have become a mere distraction from data theft. Attackers no longer focus solely on encrypting servers. On the contrary, the primary goal is to orchestrate a leak while you are dealing with the encryptors. <\/p>\n

Thus, relying solely on a backup system, even with a good recovery plan, is insufficient to combat layered threats. Of course, backups are essential because attackers will inevitably attempt to encrypt something and demand a ransom. The point is that each Ransomware attack should now be seen as a reason for a comprehensive traffic analysis and an investigation into possible attacks. Additionally, it\u2019s important to consider other security measures that could: <\/p>\n