TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Ransomware: How It Has Evolved to Be Faster, Stealthier, and Strike Harder

2020-10-15 · Read original ↗

ATT&CK techniques detected

12 predictions
T1486Data Encrypted for Impact
99%
"attack : “ some companies learn about suspicious activity by getting a call from law enforcement one evening, and by the next morning their servers, workstations, and all their disk - to - disk backups were encrypted. ” let ’ s dig into how ransomware has changed to strike so qui…"
T1486Data Encrypted for Impact
99%
"##ware encrypt all your data, it exfiltrated the confidential data to its servers. this quickly caught on as a powerful new motivator for ransomware authors. peck notes, “ some ransomware groups are exfiltrating data to the tune of terabytes copied out over days and weeks before …"
T1486Data Encrypted for Impact
99%
"recycle bins, all to foul recovery efforts. then, on a set date, the ransomware wakes up and begins encrypting everything at once. how ransomware has gotten stealthier if the ransomware is staying dormant longer, that means it needs to hide itself well. in fact, staying completel…"
T1486Data Encrypted for Impact
99%
"ransomware : how it has evolved to be faster, stealthier, and strike harder the evolution of ransomware we ’ ve finally reached the boiling point with ransomware attacks. it ’ s gone from being a nuisance to a significant financial burden as well as a mortal threat to our critica…"
T1486Data Encrypted for Impact
98%
"- save the encrypted file as a new file and use the built - in rename - and - overwrite - file function to replace the original file. a microsoft defender anti - ransomware function called controlled folder access can alert and block these operations. 6 however, newer variants of…"
T1486Data Encrypted for Impact
98%
"move on. which countries does it avoid? some ransomware variants will self - destruct if they think they ’ re within any of the nine russian commonwealth of independent states. another way to work smarter is to spread from highly connected internal network nodes, such as windows …"
T1486Data Encrypted for Impact
98%
"##ware. it ’ s 2020, and attackers have improved and strengthened their ransomware capabilities. we ’ re now seeing thousands of ransomware variants, with names like ryuk, dreamon, ragnar locker, crysis, ransomexx, clop, netwalker, wastedlocker, egregor, netwalker, nefilim, crypt…"
T1486Data Encrypted for Impact
88%
"be read. ransomware was also designed to not run if it detected itself running inside a virtual environment or a debugger. the malware code itself can now also include random code fragments that mislead analysis tools. some ransomware won ’ t activate without an unlock code, whic…"
T1486Data Encrypted for Impact
85%
"anyway. restrict open internal file shares, especially ones with wide - open permissions, such as authenticated users, which means everyone in the organization has access. if ransomware infects any user ’ s machine, it ’ s safe to assume everything in those shares is going to be …"
T1588.001Malware
54%
"##ware. it ’ s 2020, and attackers have improved and strengthened their ransomware capabilities. we ’ re now seeing thousands of ransomware variants, with names like ryuk, dreamon, ragnar locker, crysis, ransomexx, clop, netwalker, wastedlocker, egregor, netwalker, nefilim, crypt…"
T1657Financial Theft
41%
"##ware. it ’ s 2020, and attackers have improved and strengthened their ransomware capabilities. we ’ re now seeing thousands of ransomware variants, with names like ryuk, dreamon, ragnar locker, crysis, ransomexx, clop, netwalker, wastedlocker, egregor, netwalker, nefilim, crypt…"
T1585.002Email Accounts
34%
"##ware. it ’ s 2020, and attackers have improved and strengthened their ransomware capabilities. we ’ re now seeing thousands of ransomware variants, with names like ryuk, dreamon, ragnar locker, crysis, ransomexx, clop, netwalker, wastedlocker, egregor, netwalker, nefilim, crypt…"

Summary

Ransomware now includes data leakage, stealth, attack delay, anti-security, and ransomware as a service. CI Security’s John-Luke Peck shares his thoughts.