What is Ransomware?

Ransomware (ransom + malware) is a form of malware designed to allow malicious actors to extort money from an organization. This is accomplished by using a variety of encryption techniques that lock an organization’s files to then force the organization to pay for the key to unlock the data.

Ransomware attacks have become increasingly common with attackers targeting organizations with weak security practices. In fact, a recent survey revealed that 85% of organizations have fallen prey to ransomware in the past five years. And this crime pays: The predicted global cost of ransomware attacks has climbed steeply with a more than 4x increase between 2017 and 2021 to an estimated $20 Billion, and may be up to 265 Billion by 2031. Indeed, modern ransomware attacks are so profitable that criminal groups like BlackByte, Conti, and REvil are continually developing new and innovative ways to systematically attack organizations while simultaneously increasing the difficulty of detection and prevention. These tactics have included the use of encrypted protocols to obscure actions such as exploitation, data gathering, and the exfiltration of data for the purposes of extortion.

Unlike early ransomware attacks that focused on targets of opportunity, modern ransomware attacks leverage detailed playbooks that rapidly take advantage of new vulnerabilities to gain access to their victims’ networks. One prominent example is the speed with which the BlackByte ransomware gang began leveraging the Proxy-Logon and Proxy-Shell vulnerabilities as part of their standard attack playbook. The adaptability of these criminal groups and their ability to bypass traditional perimeter defenses serves to underscore the necessity of midgame detection techniques.

Ransomware Prevention Best Practices

Preventing ransomware attacks within organizations requires investment in security tools such as NDR, EDR, firewalls, and SIEM, in addition to good operational security practices and procedures. While attackers are quick to leverage new vulnerabilities and attack avenues, there are a wide variety of compensating controls that security-conscious organizations can leverage to make an attacker’s job more difficult.

No security posture is foolproof—skilled and dedicated attackers with enough time and money can gain access to any environment. However, as with most criminal organizations, ransomware operators are focused on making money, which means picking easy targets for rapid paydays. Every step an organization takes to increase the difficulty in conducting a successful attack decreases the likelihood of attacks by ransomware operators.

Organizations looking to reduce the likelihood of a ransomware attack must constantly evaluate their security posture with an eye toward the changing threat landscape and evolving attacker and defender toolkits. Given the level of adaptivity, attackers have shown it is critically important to extend visibility and security practices to include the midgame. The midgame is where attackers have the most freedom of action and security teams have traditionally had the least visibility.

Some of these best practices include:

• Continual User Training. This has demonstrable results, preventing users from becoming complacent about security. Continual training should cover topics including:
  • Identifying malicious emails
  • Validating the source of documents before opening
  • Do not click on unknown links
  • Avoid disclosing personal information both in business communications and on social media
  • Do not use USB sticks to transport data in and out of the workplace
• Evaluating Security Practices and Procedures. As organizations evolve their security posture it is critical to avoid becoming complacent, this requires organizations to constantly re-evaluate their security practices and policies to adapt to organizational and threat landscape changes. Particular points of interest include:
  • Security controls, such as:
  • Least User Privilege controls should apply to employees and partners. Security teams should consider the ability to access organizational data, but also the level of user permissions on local machines and network resources
  • Disable macros and scripts for office documents
  • Disabling PowerShell scripting, or leveraging script signing and Microsoft Best Practices
  • Regular and rapid software updates and patches
  • This should include updates to operating systems such as Windows and Linux, as well as 3rd party applications
  • Deploy and properly maintain security tools including:
  • Antimalware tools such as antivirus or endpoint eetection and response (EDR)
  • Network detection and response (NDR)
  • Logging data to a SIEM
  • Email filtering and attachment malware scanning tools
  • Backups:
  • Keep regular backups of all critical data including disconnected cold storage backups
  • Following vendor best practices:
  • Security vendors typically recommend configuration options that optimize their tools to defend against ransomware
    • A shortlist of some of the most common vendors’ recommended practices can be found at the bottom of this blog

Combating Ransomware in the Midgame

Modern ransomware is now carried out in a three-part playbook: opening (initial access), midgame (post-compromise), and endgame (extortion cycle). Each stage of the playbook consists of a variety of techniques designed to allow attackers to evade security measures and compromise then gain control over additional assets.

• Initial access is where attackers gain a foothold through a wide range of techniques including phishing, exploitation, and drive-by downloads.
  • Security controls for this phase include firewalls, EDR, email filtering, etc. These tools and controls are designed to prevent the attacker from gaining a foothold in the environment.
• The midgame begins when the attacker has compromised at least one device and begins pivoting through the target infrastructure. This is where attackers have the most freedom of action. Attackers will begin reconnaissance of the target network, stealing usernames, setting up persistence mechanisms, and compromising additional systems.
  • Security policies for this stage include least-privilege user and device permissions, limiting or disabling PowerShell, and device posture assessment tooling. Network architectures should include segmentation and monitoring with security tooling including EDR, NDR, East/West focused IDS, and NAC.
• The extortion cycle begins with the launch of the ransomware. At this stage, the attacker has launched their final assault on the target organization. Rapid response at this stage may minimize the damage however it is highly unlikely that mitigation efforts will be entirely successful.
  • Backups, both online and offline, are critical to the success and speed of recovery operations. Backups should be performed as frequently as possible with regular cold storage backups. This ensures that if the attacker compromises one set of backups, cold storage backups are available to restore from.

How NDR Aids in Ransomware Mitigation:

Preventing attackers from gaining a foothold in an environment is not always possible, but network detection and response (NDR) empowers defenders with the ability to interrupt intruders during the midgame—before they do real damage. NDR is designed to monitor network traffic patterns and protocols that attackers leverage during the midgame such as Powershell, WMI, MS-RPC, and more.

Even with network monitoring capabilities, decryption is increasingly important for detecting attacks that leverage encrypted protocols. NDR solutions with decryption capabilities provide in-depth monitoring with the historical data needed to detect abuse of protocols such as NTLM and Kerberos, which greatly increases the ability of defenders to detect and respond to the malicious activity starting at initial access, through the midgame, and into the extortion phase of the attack.

By monitoring raw network traffic feeds NDR can identify ransomware actors in the midgame and avoid the difficulties associated with traditional security controls like IAM, SIEM, and EDR. NDR helps defenders uplevel their detection capabilities in critical areas by: * Identifying and alerting on internal reconnaissance and enumeration behaviors * Spotting lateral movement techniques that lead to the compromise of domain controllers and data services * Spotting the exploitation of vulnerable internal services such as PrintSpooler, even when the exploit occurs over encrypted protocols * Isolating intruder and malware C&C, even in noisy DNS traffic * Identifying data staging for exfiltration and encryption activity indicative of ransomware

On February 25, 2022, two days after Russia began its military invasion of Ukraine, the U.S. Cybersecurity & Infrastructure Security Agency (CISA) issued a rare Shields Up warning for U.S.-based organizations, stating: “Every organization—large and small—must be prepared to respond to disruptive cyber activity.”

The Shields Up warning is in direct response to increased Russian cyber aggression against Ukrainian and other targets in the region, including recent distributed denial-of-service (DDoS) and malware attacks. In addition to the possibility of disruptive nation-state activities affecting U.S. targets, CISA also warned of an increase in cyber attack activity against U.S. organizations from Russia or hackers acting on Russia’s behalf.

The need for this warning was amplified by recent events, including the hacking of over twenty U.S.-based natural gas companies by Russian Intelligence two weeks before the Russian Army invaded Ukraine. With the CISA warning, this recent evidence, and what we know from past attacks against Ukraine it would be irresponsible for organizations to ignore CISA’s warning.

Download ExtraHop’s guide to responding to CISA’s Shields Up warning.

To help organizations prepare for a possible attack, it’s important to first, understand the types of attacks organizations should be watching for.

Russian Cyber Attacks to Watch Out For

Given the speed at which the war against Ukraine is progressing, in the immediate future, attacks are likely to be fast, hard-hitting, and focused on disruption and destruction.

Here are some of the attacks to watch out for.

Distributed Denial of Service (DDoS)

DDoS attacks aren’t new or particularly sophisticated, but they’re still effective at stopping work at government agencies and commercial enterprises in its tracks. Russia has used these attacks before. For example, in 2008, during the country’s conflict with Georgia, Russia or another party closely affiliated with the Russian government launched DDoS attacks against the Georgian government and Georgian news agencies.

It’s not surprising, then, that on February 15, 2022, DDoS attacks were launched against two of the largest Ukrainian banks as well as the Ukrainian military. More attacks are likely to follow. Targets could expand to include organizations outside of Ukraine.

Ransomware

While the Russian military effort will probably not include Ransomware attacks, the Russian government has unleashed Russian Criminal Cybercrime Enterprises to engage in unrestricted cybercrime activities, including the Conti Gang. The U.S. has already warned companies to be wary of increased ransomware attacks for two reasons. First, Russia might use them to cause trouble for Ukraine. Second, because of rising tensions with the West, the country might become more tolerant of hackers within its own borders. Ransomware gangs that, a year ago, would have feared prosecution by the Russian government might find themselves free to operate as they wish now—provided they target organizations outside of Russia.

One reason why ransomware attacks are still effective: Too many companies are still using protocols such as RDP and SMBv1 that common ransomware variants rely on for traversing networks. For years, vendors and standards organizations have been urging companies to stop using these outdated protocols, some of which were designed without cybersecurity in mind.

For example, recognizing the protocol’s glaring security shortcomings, Microsoft officially discontinued support for SMBv1 nine years ago. But according to a recent survey by ExtraHop, 68% of organizations were still running SMBv1, leaving themselves vulnerable to dangerous malware variants such as WannaCry and NotPetya.

Get a Complimentary Shields Up Security Assessment

Organizations should assume that if attackers find these protocols active on networks, they’ll take advantage of them.

Russian Wiper Malware

Living up to its name, Russian wiper malware is designed to be destructive, wiping out data rather than encrypting it for ransom. Russia has been accused of wielding this kind of malware before, most famously in the NotPetya malware attacks of 2017, which, incidentally, targeted Ukrainian government agencies, news organizations, and utility companies.

Probably as part of an attempt to paralyze the Ukrainian response to its invasion, Russia unleashed a new wiper malware to attack Ukrainian government ministries and financial institutions in February. Fortunately, Microsoft detected the attack within three hours and worked on a response. They dubbed the malware “FoxBlade,” updated Microsoft Defender to recognize the malware’s signature, and coordinated responses with government agencies and other organizations to block the attack.

Organizations should be wary of similar wiper attacks against a broader range of targets.

Brute Force Attacks

Attackers use brute force attacks to gain credentials that can be used for exploring networks, exfiltrating data, and gaining access to critical systems. One common type of brute force attack is credential stuffing, in which attackers use scripts to automatically feed thousands of compromised username/password combinations into login fields. These attacks succeed a significant amount of the time because, all too often, people reuse email address/password combinations across multiple sites. Billions of compromised username/password combinations are available for little or no money on the dark web.

If a nation state or its affiliates wants to break into organizations, it makes sense for them to take advantage of brute force attacks. Organizations should assume that Russia might do so.

Phishing

As far back as 2018, CISA issued an alert warning that Russian government cyber actors were launching cyber attacks against U.S. government agencies and critical infrastructure companies. Many of these attacks involved phishing email campaigns sent from compromised email accounts. These phishing attempts become more credible when they come from a compromised account of an organization’s leader.

The goal of phishing attacks—then and now—is often to gain access to privileged accounts on applications and servers, which can then be used for exploring networks, gaining access to operational controls, and spreading malware.

Escalations Among Civilian Hackers

Something that’s new in this war is gangs of volunteer hackers declaring loyalty to Ukraine or Russia and unleashing attacks on their preferred country’s behalf. For Ukraine, these hackers are serving as a volunteer cyber army, guarding digital assets and launching attacks against Russia. For Russia, these volunteers offer more manpower and perhaps some new techniques for waging cyberwar against Ukraine.

For organizations in the U.S., the addition of these volunteers increases the uncertainty of the cyber attacks that may follow. More actors and perhaps more varied attack strategies give security teams all the more reason to ensure their defenses are as strong as possible.

Implementing CISA’s Shields Up Guidance to Prevent Cyber Attacks

All organizations, public and private should stay vigilant and prepare for possible intrusions. To do this, security and business leaders alike should review and heed the advice in CISA’sShields Up, which offers guidance to improve overall hygiene and defenses, detect and respond to potential intrusions, and maximize organizational resilience.

To break down the CISA Shields Up guidance further and help organizations understand what steps they should take to to reenforce their security posture, ExtraHop has released A Practical Guide to Shields Up, a complete analysis of the Shields Up recommendations with detailed expert advice.

War is one of humanity’s oldest and most merciless, dehumanizing, and abhorrent acts. In the modern age, war is also now publicly documented, with a constant, unmoderated stream of updates on social media taking us right to the place events are unfolding, throwing into stark relief the individual and personal impacts of war as it happens. We are seeing this now with the war on Ukraine. Perhaps this shared experience will make the world reflect on the impact and implications of war—and will give nations and their leaders pause in the future. I hope for peace, for the safety of the Ukrainian people, and for the continuation of a free and independent Ukraine.

Another lesson of the war between Russia and Ukraine is that the parameters of the battlefield have evolved tremendously in the last 20 years. Wars are fought on battlefields and oceans and in the skies above us. Increasingly, they are also fought on the network, as combatants seek to weaken their enemies by compromising systems, data, and critical infrastructure.

Earlier this week the Cybersecurity & Infrastructure Security Agency (CISA), in conjunction with the FBI issued a new Shields Up warning based on the Russia/Ukraine conflict, advising organizations to adopt a heightened security posture and prepare for the likelihood of an attack.

With its Shields Up warning, CISA provides concrete guidance about where organizations should focus their efforts at this moment of crisis. The warning also offers clear, straightforward, and actionable recommendations for corporate leaders and executives around how they can best support security teams and prepare their organizations for a worst-case scenario. This includes ensuring visibility and support for CISOs and SecOps teams, lowering reporting thresholds for threat activity, and testing plans and capabilities around incident response and business continuity.

As a CEO, I hope corporate and organizational leaders take this guidance to heart and implement it, to the greatest extent possible, for the duration of this heightened alert period and in the future. As leaders, it is essential that we trust the people we hired, and to empower them to succeed in the role for which they were hired. Now is the time to reinvigorate a critical relationship between our cyber defense teams and the rest of the businesses. What CISA is asking on behalf of every CISO and every security practitioner is this: Cybersecurity is essential to your business, and we have reached a moment when it is at incredibly high risk. Give your security teams your full support by resourcing them, and then let them do what they do best—defend your systems, your data, and your organization.

Get a Complimentary Shields Up Security Assessment

To help leaders like you establish that communication, I’d like to offer some lessons I’ve learned throughout my career, and some advice that I’ve taken to heart on my leadership journey.

1. Take the time to get briefed on your current security posture, both immediately and on an ongoing basis moving forward. Understand your organization’s overall security posture, including areas of strength and weakness. Understand the challenges your security teams face and get them the resources they need to be successful in the modern threat landscape. Many executives and boards have governance structures that require periodic readouts, but building a strong relationship as a baseline can ensure that your organization is prepared for a real event.
2. Ensure that executive leadership is fully briefed on incident response, crisis management, and business continuity plans. This helps leadership refresh their understanding of the role they and their organizations play if events unfold. Incident response plans should include assessment of each executive’s departmental response readiness, and the results should be reported back to the full executive team. Taking these steps will help uncover issues that need to be resolved quickly, strengthening your overall security posture.
3. Assess the security infrastructure protecting your organization. At minimum you should understand:
   • How often software is updated, including vulnerabilities commonly exploited by Russian threat actors (See CISA’s Shields Up Guidance for a list). You should also understand your organization’s policies regarding automatic updates, which are generally a best practice but increase the risk of a software supply chain attack.
   • How frequently critical systems and data are backed up, how the backups are protected from compromise, and how readily systems can be restored in the event of a breach.
   • What identity management and multifactor authentication tools and processes are being used, and ensuring that they are fully operational.
   • How your organization monitors, manages, and protects endpoints, including both traditional endpoints like servers and computers, as well as IoT and employee devices.
   • How you are managing the risks associated with the use of public cloud applications and infrastructure, and your organization’s areas of responsibility versus those of the cloud provider.
   • How your network is secured, including your ability to detect, remediate, and investigate threat activity on the network.

As you start a discussion with your security and technical teams, also keep in mind that systems integrators, managed services providers, channel partners, and technology vendors have expertise and services that can help organizations scale up defenses during times of high alert, and help assess organizational readiness to defend against advanced threats.

At ExtraHop, we are standing by to help our customers with any concerns or questions. At this critical moment for so many organizations, we are dedicating resources to ensure that organizations get the support they need to effectively defend their networks from attack. To learn more about how we can help assess your security posture (including identifying devices still vulnerable to Log4Shell), contact us at shieldsup@extrahop.com. We also have new recommendations for how to implement and mature CISAs Shields Up guidance for organizations.

CISA’s Shields Up warning and associated guidance is a reminder that we are united in a common mission: To defend our organizations, our customers, our employees, and our data, against advanced attacks. That mission is more important now than ever, and you have our full support.