This chapter is from the book
This chapter is from the book
This chapter is from the book
3.2 Entry
In the entry phase, the adversary gains a foothold inside the victim’s technology environment. While this may mean that the adversary gains access to a computer inside the victim’s network, it could also be a cloud-based resource such as a virtual machine, a hosted application such as email, or a remote system such as an employee’s personal computer. Whatever the point of entry, the adversary will leverage this initial access during the next phase (expansion) to spread throughout the environment.
Common methods of entry include:
Phishing: The adversary sends an email, text, or other message designed to trick the victim into taking an action that gives the adversary information and/or access to the victim’s environment.
Remote logon: The adversary successfully gains access to an interactive session via a remote logon interface such as Remote Desktop Protocol (RDP), using credentials that have been guessed, stolen, purchased, or otherwise obtained.
Software vulnerability: A vulnerability is found in the victim’s Internet-facing applications, servers, or network equipment.
Technology supplier attack: The adversary has access to a supplier’s technology resources (such as a software provider or managed service provider [MSP]), whether legitimately or through compromise, and leverages this to gain access to the victim’s environment.
Let’s discuss how adversaries execute each entry method, and highlight the corresponding opportunities for detection and effective response techniques.
3.2.1 Phishing
Cyber extortion events often start with a phishing attack, in which the adversary sends a message designed to trick the intended victim into taking an action, such as clicking on a link or opening an infected attachment. Phishing kits, which automate the attack process, often sell for $5 to $15 on the dark web.
Phishing attacks can be conducted via any form of messaging, from email to SMS messages to social media. (Carrier pigeon, anyone?3) However, cyber extortionists typically aim to get a foothold within an organization’s network, and email is the most widely used method for transmitting messages from external to internal senders in these types of environments.
3.2.1.1 Remote Access Trojans
The payload of phishing messages is often a remote access Trojan (RAT), which is a software utility designed to enable an adversary to remotely control or access a computer system.
The features of RATs vary widely, but typically they enable an adversary to do the following:
Establish a communication channel between the compromised endpoint and a controlling server
View data about the infected computer
Control the infected computer remotely
Evade detection
Sophisticated RATs can include advanced capabilities, enabling the adversary to take the following steps:
Automatically steal sensitive information from the victim’s computer, such as credit/debit card numbers, stored passwords, computer system information, and more
Interactively log on using Virtual Network Computing (VNC) or a similar program
Produce reports of user activity, account balances, web history, and more
Execute advanced privilege escalation attacks and facilitate the adversary’s lateral movement
Install addition malware (including ransomware)
Leverage the victim’s computer(s) to attack other organizations
Malicious Swiss Army knives such as Emotet and Trickbot rely on phishing campaigns to deliver their malware, which adversaries leverage to gain persistent access, steal information, and distribute other threats. The presence of a RAT is often a precursor of a cyber extortion attack.
Traditionally, RATs are delivered via social engineering attacks such as phishing emails, malicious websites, or compromised applications. The adversary who installs a RAT may conduct cyber extortion, or sell or rent access to other criminals, who in turn may choose to conduct cyber extortion themselves.
Opportunities for Detection
When an extortion attack starts with phishing, typically a user device is “patient zero,” the first system entered by the adversary. From there, the adversary establishes persistence, which typically involves a reverse shell of some kind (since most devices are blocked by the firewall from direct inbound Internet access). The adversary then leverages stolen credentials or unpatched vulnerabilities to escalate their account privilege, move laterally, and spread throughout the environment.
Specific indicators include the following:
Warnings and alerts in email security software: In some cases, the suspicious email may be automatically quarantined; in others, the email is sent along with a warning to the users, email administrator, or both. The user’s email system may also insert a warning in the subject or body of an email if the email meets certain criteria that are in line with characteristics of a phishing attack.
User report: A user may report the phishing message to the response team. When this happens, IT staff should quickly look for other users who received the same or similar phishing emails and remove those emails from other users’ inboxes. If any user clicked on a link or attachment in the suspected email, this should activate the organization’s incident response processes to ensure that any resulting infection is contained.
Malware sample: By analyzing a malware sample, you can often match it to specific known phishing campaigns or hacker groups and obtain lists of additional indicators to search for in the affected environment.
Email application logs: Application logs may contain warnings related to emails that have been processed, or alerts on blocked attempts, which can help you identify high-risk users, periods of unusual activity, changes in user risk profiles, and more.
Antivirus log entries: When a user clicks on a link or attachment in a phishing email and downloads or runs malware, it may generate an antivirus software alert.
Event logs: Similarly, when a user clicks on a link or attachment in a phishing email that results in code execution, it may generate records of unusual activity such as privileged command execution, scheduled task creation, or application and service starts or stops.
3.2.2 Remote Logon
Many cyber extortion attacks occur because the adversary gained access to a remote logon interface, such as an RDP platform. Quite often, cyber extortionists purchase stolen credentials on the dark web from an initial access broker rather than stealing or guessing them.4 Then, the extortionists use these credentials to gain a foothold in the network and deploy their attack.
There are good reasons why “open” RDP services have traditionally been the root cause of a large percentage of extortion attacks:
No special tools are needed to gain remote access to the service.
RDP is a common protocol that often does not trigger alerts, particularly if it is actively used by employees or an IT administrator.
The adversary can often pivot through the compromised computer to gain access to other systems using RDP inside the network.
Many organizations use RDP or other remote access tools so that employees can log in to their workstations from home or while traveling, or so IT administrators or vendors can access an internal network remotely at all hours. This is also—and unfortunately— convenient for adversaries, who frequently steal credentials or use password-spraying attacks to gain unauthorized access.
The vast supply of stolen passwords available for free or for sale on the dark web has fueled these attacks. By the summer of 2020, researchers had identified more than 15 billion stolen username and password combinations on the dark web.5 At the time of this writing, stolen RDP credentials sell for $16 to $24 each.6
Many people reuse the same password for multiple accounts.7 Adversaries leverage this tendency by conducting “credential stuffing” attacks, in which they take stolen credentials and attempt to use them on a wide variety of logon interfaces. When they successfully log in to another account, they can either leverage it themselves or sell access to the newly compromised account.
In 2020, the COVID-19 pandemic suddenly created a rush to remote work. In response, many organizations rapidly enabled remote access with little security oversight, and were compromised as a result.
Opportunities for Detection
Common signs of remote authentication attack or compromise include the following:
Failed logon attempts: When an adversary conducts password spraying or credential stuffing attacks, there are often repeated failed logons (sometimes followed by a successful logon). This can occur at the perimeter, or it can occur within the network as the adversary attempts to move laterally. Unfortunately, many networks are not configured to record or report failed logon attempts on Microsoft Windows hosts within their network, meaning that an adversary can automate attempts to authenticate within the network without being detected.
Unusual successful logon attempts: These may include logins at odd times or places, distinct user-agent strings, and “impossible travel” alerts notifying of logons from geographically distant locations in a quick succession.
Creation of new accounts: Such accounts may suddenly be used for remote access.
3.2.3 Software Vulnerability
Adversaries routinely search for exploitable vulnerabilities in widely used software and leverage these to launch cyber extortion attacks, as seen in the Kaseya attacks, as well as adversaries’ response to the ProxyShell and Log4j vulnerabilities (among many others). In the case of Accellion, the Cl0p group was able to exploit a critical vulnerability in Accellion FTA devices and steal sensitive data affecting more than 9 million individuals, resulting in a $8.1 million class-action settlement in January 2022.8
The “Shodan.io” search engine, which indexes Internet-connected devices, can be used by adversaries and defenders alike to identify potentially vulnerable Internet-facing services.
Timely patch deployment can dramatically reduce the risk of a perimeter device compromise. However, IT administrators are often unaware that their specific firmware or software version is vulnerable, particularly in organizations that have limited resources for IT management. Furthermore, zero-day vulnerabilities exist for perimeter devices, and may be incorporated into high-end exploit kits before the manufacturer has time to identify the issue.
Opportunities for Detection
Common signs of attack via perimeter software vulnerability include the following:
Alerts on port or vulnerability scans on perimeter devices (although this is a normal occurrence, so it’s important to review such alerts carefully and resist the urge to be lulled into complacency)
Strange error messages relating to that application or system, performance degradation (processes that overwhelm the processor or memory), or system/application crash
Unexpected outbound connections from servers or even workstations
Unusual and unrecognized processes or applications running on perimeter systems
3.2.4 Technology Supplier Attack
Frighteningly, the entry point for a cyber extortion attack may be a supplier, such as an IT provider, MSP, equipment vendor, or cloud provider. In 2019, 22 towns in Texas were hit with a devastating REvil ransomware attack, which was traced back to their common MSP.9 After infiltrating the MSP’s network, the adversary leveraged the MSP’s normal remote administration tool, ConnectWise Control, to deploy the ransomware throughout customer networks. Thanks to an effective backup and recovery strategy and strong response plan, the towns’ operations were successfully restored within a week.10
Cloud providers, too, suffer ransomware attacks that can dramatically impact customers. In May 2020, Blackbaud, a leading provider of cloud-based fundraising software, was hit with a ransomware attack. Customers were notified in July and told that “the cybercriminal removed a copy of a subset of data from our self-hosted (private cloud) environment … we paid the cybercriminal’s demand with confirmation that the copy they removed had been destroyed.”11
Blackbaud’s ransom payment was little consolation to the thousands of customers who stored sensitive data in the cloud, many of whom were required to conduct their own investigations—often at their own expense. Without direct access to evidence, however, their response was hampered. Within just a few months, Blackbaud had been sued in 23 proposed class-action lawsuits, received approximately 160 claims from customers and their attorneys, and been hit with inquiries from a plethora of government agencies and regulators.12
Opportunities for Detection
Customers typically have little visibility into the operations and risk management practices of suppliers, even those that have a high level of access to their sensitive data or network resources. They also have no way to directly detect an intrusion into supplier networks and must rely on suppliers to implement effective detection capabilities to prevent the spread of ransomware.
Visible signs of a supplier compromise may include the following:
Unusual logins or activity from supplier accounts
Spam emails originating from a supplier’s address
Unusually slow service or full outages
Notification or media reports of a cybersecurity compromise relating to the supplier