This chapter is from the book
This chapter is from the book
This chapter is from the book
3.6 Leverage
To actually launch an extortion attack, the adversary first needs to gain leverage by actively threatening the confidentiality, integrity, and/or availability of information resources. Most commonly, adversaries accomplish this by encrypting files with ransomware, or stealing sensitive data so they can later threaten to publish it if they do not receive payment.
In this section, we discuss the two most common scenarios: ransomware detonation and data exfiltration. Keep in mind that these are only selected examples—there are many other ways for adversaries to gain leverage over a victim. Ultimately, adversaries are limited only by their imaginations.
3.6.1 Ransomware Detonation
The detonation phase represents the last piece of “hands-on” access that an adversary will normally execute. Once the adversary has mapped their targets, obtained sufficient access, and potentially exfiltrated everything they want, the final fireworks show at the end of the incident is the detonation of a ransomware executable. This phase of the attack is often the first indicator of compromise a victim sees directly and, unfortunately, at this point it is usually too late to prevent the attack.
An adversary can distribute and detonate their encryption software in many different ways. Here are three common methods:
Group policy: An adversary with access to a domain controller and domain administrator credentials can use the software distribution system built into most Windows networks as a springboard to distribute their malicious software. This activity is typically accompanied by the creation of a scheduled task that can simultaneously detonate the ransomware payload on all computers within the victim’s environment. This shortens the overall period in which a defender could stop the attack, and also makes investigating the attack more difficult because it can effectively obfuscate the origin of the malware execution.
System administration toolkit: Adversaries are frequently observed using the PsExec toolkit or similar utilities to distribute their malicious payload. Configuring a network to accept this type of software push is trivial, and the previous expansion steps taken by the adversary usually provide them with exactly what they need to initiate this form of detonation. The PsExec utility is part of the Microsoft SysInternals toolkit and automates the process of distributing executable programs to domain-connected hosts.
Manual distribution and detonation: In some cases, the adversary may choose to avoid automated distribution and simply install and execute the encryption software manually on selected targets within the overall network. This tactic is observed in both small networks with a minimal number of overall targets and large organizations. In the latter case, an adversary is more concerned with encrypting the “crown jewels” of the network than with encrypting every individual host.
Once the ransomware payload is detonated, the exact sequence of events varies depending on the strain. However, there are some common actions that the software typically executes:
Adds malicious software to startup sequences, which facilitates persistence between reboots.
Creates ransom notes.
Deletes shadow volume copies, to prevent file restoration.
Enumerates drives, often starting with drive A:\ and moving alphabetically through the hosts’ mapped drives.
Encrypts files. Most ransomware strains encrypt a targeted list of files, often based on a preloaded list of file extensions.
Encrypts backup files once found on the network.
Opportunities for Detection
While some might seem obvious, here are the signs indicating that ransomware has been detonated on a network:
Unauthorized software installations
Unauthorized or unusual scheduled task creation
Registry modification
Visible ransom notes
Encrypted files
3.6.2 Exfiltration
The adversary may deliberately exfiltrate data to use it as leverage in extortion, commit fraud, or sell it. This type of exfiltration is distinct from the network reconnaissance discussed in Section 3.2.3, in that the purpose is to gain some benefit beyond simply increasing access.
For example, the Conti playbook that was leaked in 2021 (discussed in Section 2.9.6) illustrated how adversaries now purposefully search for financial documents, accounting information, client data, and more.13 The adversaries also seek out details that are specifically useful for negotiating extortion payments, such as cyber insurance policies. Today, this has become standard practice, and the exfiltration often occurs quickly and in bulk.
Adversaries could exfiltrate data from any repository, including systems on a local network, mobile device, or cloud repository. In today’s cloud-driven technology landscape, sensitive data is often stored via Amazon S3, Dropbox, SharePoint, and other cloud-based storage systems. Adversaries often access the data held within the cloud using credentials and access keys obtained during their takeover of their victims’ local network, and vice versa.
Because the adversary might transfer or sell access to the victim’s technology environment at any point, it is entirely possible for a victim’s data to be stolen multiple times by different adversaries.
Adversaries commonly use the following tools for exfiltrating data:
Mainstream cloud services: The advantage of these services—which include Dropbox, Google, OneDrive, and others—is that they are often already supported by the local environment and can blend with normal usage.
File transfer programs: The adversary can use common Windows utilities such as WinSCOP or Powershell to send data to a server under their control. Typically the data is encrypted or encoded in transit.14
Anonymous file sharing services: MEGA, FreeFileSync, and similar services are very convenient aids for adversaries, since they require little effort to set up and are free up to a certain volume of data. MEGA has become particularly popular. It includes built-in end-to-end encryption, making it difficult for data loss prevention systems to detect, and the user can transfer files using a web browser or desktop app. Since these services are not normally used in a standard enterprise environment, it can be easy to detect and block applications of this type.
Three data exfiltration patterns are commonly seen in cyber extortion cases:
Automated RAT exfiltration
Mass repository theft
Curated theft
Each of these exfiltration patterns leaves a different footprint in the network and may require different response tactics. In the following subsections, we discuss each in turn.
3.6.2.1 Automated RAT Exfiltration
Quite often, a RAT installed on the victim’s network is configured to automatically steal files and upload them to a system controlled by the adversary. When this occurs, the RAT typically has a configuration file that allows the operator to select files based on an extension and/or keywords in the filename. For example, the authors of this book studied one widely used RAT, Atmos, which shipped with a default configuration that exfiltrated all files with .pdf and .docx extensions, plus any documents containing the keywords “bank” or “payroll” in the filename. In this case, as in many others, the adversary’s goal was likely to facilitate financial fraud.
Modern RATs are sophisticated and typically include built-in techniques to help the user avoid detection. When files are automatically exfiltrated, typically the data transfer is slowly metered so that it doesn’t set off network monitoring alerts.
RATs typically transfer data over the built-in command-and-control channel, which is often encrypted, again for evasion purposes. Although the functionality of RATs varies, the data normally winds up on a server under the adversary’s control—often another hacked server that is part of a botnet. Depending on the RAT’s level of sophistication, the adversary may even have point-and-click access to view and sort stolen files through the RAT’s interface.
3.6.2.2 Mass Repository Theft
Today, “smash-and-grab” data exfiltration is a popular technique. Many adversaries enter the network with the goal of stealing data, and invest little time in curation before theft. Why bother sorting through the data while on the victim’s network, when the adversary can steal it en masse and analyze it on their own systems?
In cyber extortion cases, typically there is no need to pick through data extensively to accomplish the adversary’s objectives. Once the adversary has access to the victim’s network, they seek out large data repositories and transfer them out in bulk. Then, during the negotiation phase, they can share screenshots of the stolen data or provide file lists. No matter if the bulk of the stolen files is unimportant; the presence of even a few documents containing PII can spell reputational disaster for the victim.
In some cases, bulk file transfer can cause significant headaches for the victim. Once the victim is aware that data may have been stolen, typically the next step is to take an inventory of the potentially exposed data and create a notification list. Firms that conduct e-discovery normally charge by the gigabyte, so even if the majority of the stolen files contain no sensitive data, the cost for verifying this fact may be large.
In some cases, the adversary “stages” data on a single system prior to exfiltration. This process gives the adversary time to organize files, ensure everything is compressed and encrypted, and then exfiltrate it all at once, giving the victim limited time to respond before all the data flies out the door. The Lockbit extortion gang was observed staging data and organizing files based on the system from which they were stolen, and then copying the directories to a single MEGA console before uploading them. However, quite often adversaries do not bother “staging” data at all, but simply copy it directly from the hacked systems.
As RaaS kits become more automated, adversaries are curating less and automatically exfiltrating data more. The Netwalker RaaS platform advertised “[a] fully automatic blog, into which the merged data of the victim goes, the data is published according to your settings.”15 The RaaS automatically exfiltrated the victim’s data to MEGA, and then created a blog where the MEGA links would appear at the proper time.16
3.6.2.3 Curated Theft
In some cases, an adversary may steal only specific files of value, such as source code, databases of PII, or other material. To accomplish this, the adversary needs to first identify these files on the network, typically through manual examination. Often, content of this type is curated due to the size of the repository, or because the attack is targeted and the adversary has a predetermined goal in mind.
For example, the gaming company CD Projekt Red was hit with a ransomware attack in 2021, when adversaries specifically leveraged stolen source code in their ransom note. “We have dumped FULL copies of the source codes from your Perforce server for Cyberpunk 2077, Witcher 3, Gwent and the unreleased version of Witcher 3!!!”17
Due to the size of the source code repositories, and the fact that these were stored in the dedicated Perforce software, exfiltration of this material was undoubtedly purposeful and curated. The adversary also explained that they had stolen materials relating to accounting, human resources, and more, but specifically leveraged the intellectual property in their extortion efforts. “If we will not come to an agreement,” they threatened, “then your source code will be sold or leaked online, and your documents will be sent to our contacts in gaming journalism.”18
Opportunities for Detection
Signs of data exfiltration may include the following unexplained or unusual activities:
Increases in network traffic, particularly outbound direction
Connections to cloud file sharing services
Use of MEGA and other third-party file sharing websites that are not typically used
File movement and staging activities
Connected sessions with unknown or suspicious destinations