CSLATEST

ansomware
attachment, such as a Microsoft Word
document or PDF file containing malware.
Others, however, may contain a link to a
webpage controlled by the attackers. The goal
is to get the target to open the attachment
and trick the victim to enable macros or click
the link, which can then deliver a malicious
downloader, leading to the final payload,
which is ransomware.
"Software vulnerabilities play a key role in
facilitating ransomware attacks through
several avenues. These include vulnerabilities
used as part of malicious documents, vulnerabilities
found in perimeter devices like Secure
Socket Layer Virtual Private Networks (VPNs),
as well as a plethora of flaws designed to
elevate privileges, once inside an organisation's
network."
Prolific ransomware groups such as LockBit,
Rhysida, Play and ALPHV/BlackCat make use of
multiple exploits in their efforts to compromise
organisations. "For illustration, throughout the
last quarter of 2023, threat actors exploited
CitrixBleed in attacks against a variety of organisations.
Some notable examples include
attacks against Boeing and Comcast."
While initial access is how ransomware
groups gain access to an organisation's
network, once inside they will set their sights
on Active Directory, says Montel. "Gaining
domain privileges provides attackers with
the necessary capabilities to distribute their
ransomware payloads across the entire
network. Once threat actors are inside,
the game is fundamentally over. Today's
ransomware gangs will look to extrapolate
data silently and, once that's achieved, they'll
prepare to encrypt systems and cripple the
organisation's ability to function.
"A further trend that has been seen is threat
actors wiping data at rest. This is even more
insidious and can be undetected, compared
to encryption. Often, the first the organisation
knows anything about the attack is a communication
from the gang threatening to
encrypt systems or publish the data on the
dark web, if demands are not met. The added
pressure from this type of extortion is what
has helped make ransomware so successful."
The question of whether to meet ransomware
demands is complicated, he adds. "Only
the organisation impacted will be able to
determine the best cause of action. Given the
financial impact from ransomware attacks,
be it the inability to function from crippled
systems or sensitive data exposed, prevention
has to be better than cure. Gaining visibility
into where the biggest areas of risk are -
exposure management - is absolutely critical
to knowing which doors and windows are
wide open and need to be closed to stop
ransomware in its tracks."
14-STAGE ASSAULT
A ransomware attack typically involves 14
stages, according to Kennet Harpsoe, senior
cyber analyst at Logpoint. "The first stage is
reconnaissance, where the threat actor
gathers information about the victim. The
second stage is resource development to
support targeting, followed by initial access,
in which the attacker tries getting into the
network. The fourth phase is execution,
where the attacker tries executing malware."
The next stage is persistence, he says, in
which the attacker attempts to maintain a
foothold in the victim's network, even if the
system terminates the payload process or
reboots. "Afterwards, attackers use privilege
escalation to gain access to accounts with
higher-level access and defence evasion by
disabling security, clearing logs or obfuscating
the payload. At the privilege escalation stage,
attackers then retrieve logins.
"The discovery phase allows attackers to
identify other weaknesses within the network
and plan and execute more advanced attacks,"
continues Harpsoe. "Using lateral movement,
the attacker moves to other hosts to establish
a presence and access information. The collection
stage is when attackers collate data
Justin Giardina, 11:11 Systems:
ransomware attacks reflect a chilling
professionalisation of tactics and leverage
military-grade encryption.
from systems and the Command and Control
(C&C) phase is where the attacker establishes
control over the victim's systems."
Exfiltration is where attacks extract data using
various methods. The last stage is impact,
where the attackers use techniques at a later
stage to disrupt availability, compromise
integrity or manipulate business and operational
processes. Knowing these tactics is
essential to detect an ongoing attack before
the attackers deploy the ransomware.
"Ransomware can result in downtime, data
loss and ransom payments, but now the fines
for non-compliance are an additional concern,
as we saw in the case of BlackCat," he states.
"It filed a complaint with the SEC over Meridian-
Link's failure to disclose a cybersecurity incident
to punish the company for not paying the
ransom. This new extortion tactic will likely
be used going forward, especially with the
introduction of NIS2.
"Compliance-driven extortion could diminish
www.computingsecurity.co.uk @CSMagAndAwards May/June 2024 computing security
31