No one needs reminding that ransomware has reached incredible proportions; one widely reported statistic from Purplesec suggests that $20 billion was paid out in 2020. That's almost double its $11.5 billion estimate from 2019, with a commensurately huge increase in the number of attacks, while BitDefender suggested a 715% increase in the first half of the year.
The "crews" have multiplied, adopted tactics that are reminiscent of nation-state attacks, and developed partnerships and relationships with a speed and efficiency that put many of our business practices to shame. New tactics are constantly appearing both to gain access and to apply pressure on victims to pay.
What has not changed is what we call it: ransomware. That's a mistake, since it ties it in too many people's minds to the past, and to a much less threatening form of the attack, the attack form that started in 1989 with the AIDS Trojan (distributed on 20,000 floppy disks and looking for a payment of around $500). The attack returned in the mid-2010s, but as individual threats. Attacks such as CryptoWall, Cryaki, TeslaCrypt, and CTB-Locker impacted individual users and forced the victim to approach the attacker to recover. Attackers also took rapid advantage of cryptocurrencies, using the relative anonymity and easy transferability of Bitcoin to protect them as they monetized their efforts.
These attacks were distributed by multiple means, or vectors. Phishing, pop-ups from malvertising, and even messaging on platforms like Facebook Messenger were common vectors. The code base was different, the attack vector was different, but the goal was the same. Land on a user's computer, encrypt that computer and network-accessible data, and demand payment. The attack was against the individual, and corporate damage was a bonus (in terms of payment), not the objective. The ransom was to decrypt the locked data, and defensive tactics focused on limiting access to data access privileges, user-awareness training, and host-based malware prevention.
This model slowly shifted toward corporate targets, as the bad actors followed the money. During 2020, analysts saw a series of seminal shifts in the landscape, and a change in tactics. This series of shifts is why we should change the naming from ransomware, a serious attack but one with a relatively narrow scope, to Extortionware, where every pressure is being applied to force payment.
The first shift was in the maturity of the attacker. Ransomware was a wide net, and encryption was an early part of the attack. With extortionware, the attacking crews have adopted advanced tactics or have purchased access from initial access brokers in order to fully monetize a compromise. Rather than land and encrypt, the model is what you would expect in a data breach: perform an initial compromise, expand laterally, escalate privilege, locate important data (and backups), and only when holding a commanding position does the attacker execute the coup de grâce and encrypt the data.
This alone is not enough to change the name of a class of attack. The biggest change is that this type of attack is no longer just a demand for a ransom to decrypt data. Starting with the Maze crew in May 2020, the attackers started to exfiltrate the data before encrypting it. A victim was placed in double jeopardy; even if the target were able to recover from backup or brute-force encryption, confidential data could be leaked. This leaked data could then lead to litigation from clients or business partners and fines from government agencies, read Prop 24 in the State of California.
Beginning in Janaury 2021, this tactic was being widely adopted with at least Revil, Netwalker, and Mespinoza adopting it. Attackers added distributed denial-of-service to their arsenal by October 2020, and even started pressuring victims via social media to up the stakes. Finally, toward the end of 2020, threats were made to deliberately disclose compromising and damaging information that executives had divulged internally.
Calling this ransomware ties it in too many people's minds to the older attacks and downplays the current threat. We have to change perception and the branding. We can label the trend as what it is, not just a ransom to get your data unencrypted, but extortion by all means. We should call it something more threatening. Whether we call it extortionware or something else, we cannot continue to treat it just as a data availability issue.
Our approach to the threat must change, the reason for changing how we refer to it. Data protection is going to remain imperative, and immutable backup is a key part of that protection strategy. But it cannot be the only part. We have to ensure that we are using the whole security suite to detect these attacks before we need to restore, and to limit the scope of damage if it occurs. We have to start with a strategy and our security must be adaptive because the attack is adapting. For now, key controls will be strong and contextual identity and robust vulnerability management programs. None of these are new, but their relevance and importance are.
Red Sky Alliance has been has analyzing and documenting cyber threats for 9 years and maintains a resource library of malware and cyber actor reports available at https://redskyalliance.org at no charge.
What can you do to better protect your organization today?
- All data in transmission and at rest should be encrypted.
- Proper data back-up and off-site storage policies should be adopted and followed.
- Implement 2-Factor authentication company wide.
- For USA readers, join and become active in your local Infragard chapter, there is no charge for membership. infragard.org
- Update disaster recovery plans and emergency procedures with cyber threat recovery procedures. And test them.
- Institute cyber threat and phishing training for all employees, with testing and updating.
- Recommend/require cyber security software, services and devices to be used by all at home working employees and consultants.
- Review and update your cyber threat and information security policies and procedures. Make them a part of all emergency planning and training.
- Ensure that all software updates and patches are installed immediately.
- Enroll your company/organization in RedXray for daily cyber threat notifications are directed at your domains. RedXray service is $500 a month and provides threat intelligence on nine (9) cyber threat categories including Keyloggers, with having to connect to your network.
- Purchase annual cyber insurance coverage from Red Sky Alliance provided by Cysurance.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the lab directly at 1-844-492-7225, or feedback@wapacklabs.com.
Reporting: https://www.redskyalliance.org/
Website: https://www.wapacklabs.com/
LinkedIn: https://www.linkedin.com/company/wapacklabs/
Twitter: https://twitter.com/wapacklabs?lang=en
Weekly Cyber Intelligence Briefings:
https://attendee.gotowebinar.com/register/8782169210544615949
Comments