Incident Response Techniques for Ransomware Attacks

Overview of this book

Ransomware attacks have become the strongest and most persistent threat for many companies around the globe. Building an effective incident response plan to prevent a ransomware attack is crucial and may help you avoid heavy losses. Incident Response Techniques for Ransomware Attacks is designed to help you do just that. This book starts by discussing the history of ransomware, showing you how the threat landscape has changed over the years, while also covering the process of incident response in detail. You’ll then learn how to collect and produce ransomware-related cyber threat intelligence and look at threat actor tactics, techniques, and procedures. Next, the book focuses on various forensic artifacts in order to reconstruct each stage of a human-operated ransomware attack life cycle. In the concluding chapters, you’ll get to grips with various kill chains and discover a new one: the Unified Ransomware Kill Chain. By the end of this ransomware book, you’ll be equipped with the skills you need to build an incident response strategy for all ransomware attacks.

Preface

Who this book is for

What this book covers

Download the color images

Section 1: Getting Started with a Modern Ransomware Attack

Free Chapter

Chapter 1: The History of Human-Operated Ransomware Attacks

2016 – SamSam ransomware

2017 – BitPaymer ransomware

2018 – Ryuk ransomware

2019-present – ransomware-as-a-service

Summary

Chapter 2: The Life Cycle of a Human-Operated Ransomware Attack

Initial attack vectors

Post-exploitation

Data exfiltration

Ransomware deployment

Summary

Chapter 3: The Incident Response Process

Preparation for an incident

Threat detection and analysis

Containment, eradication, and recovery

Post-incident activity

Summary

Section 2: Know Your Adversary: How Ransomware Gangs Operate

Chapter 4: Cyber Threat Intelligence and Ransomware

Strategic cyber threat intelligence

Operational cyber threat intelligence

Tactical cyber threat intelligence

Summary

Chapter 5: Understanding Ransomware Affiliates' Tactics, Techniques, and Procedures

Gaining initial access

Executing malicious code

Obtaining persistent access

Escalating privileges

Bypassing defenses

Accessing credentials

Moving laterally

Collecting and exfiltrating data

Ransomware deployment

Summary

Chapter 6: Collecting Ransomware-Related Cyber Threat Intelligence

Threat research reports

Community

Threat actors

Summary

Section 3: Practical Incident Response

Chapter 7: Digital Forensic Artifacts and Their Main Sources

Volatile memory collection and analysis

Non-volatile data collection

SRUM

Summary

Chapter 8: Investigating Initial Access Techniques

Collecting data sources for an external remote service abuse investigation

Investigating an RDP brute-force attack

Collecting data sources for a phishing attack investigation

Investigating a phishing attack

Summary

Chapter 9: Investigating Post-Exploitation Techniques

Investigating credential access techniques

Investigating reconnaissance techniques

Investigating lateral movement techniques

Summary

Chapter 10: Investigating Data Exfiltration Techniques

Investigating web browser abuse for data exfiltration

Investigating cloud service client application abuse for data exfiltration

Investigating third-party cloud synchronization tool abuse for data exfiltration

Investigating the use of custom data exfiltration tools

Summary

Chapter 11: Investigating Ransomware Deployment Techniques

Investigation of abusing RDP for ransomware deployment

Crylock ransomware overview

Investigation of Administrative shares for ransomware deployment

REvil ransomware overview

Investigation of Group Policy for ransomware deployment

LockBit ransomware overview

Summary

Chapter 12: The Unified Ransomware Kill Chain

Cyber Kill Chain®

MITRE ATT&CK®

The Unified Kill Chain

The Unified Ransomware Kill Chain

Summary

Why subscribe?

Other Books You May Enjoy

Packt is searching for authors like you

Share Your Thoughts

Customer Reviews

5 star

4 star

3 star

2 star

1 star

2018 – Ryuk ransomware

The Ryuk ransomware took Big Game Hunting to new heights. Associated with the Trickbot group, also known as Wizard Spider, this ransomware strain is still active today.

Throughout its history, the group has attacked various organizations and made at least $150 million, according to AdvIntel (source: https://www.advanced-intel.com/post/crime-laundering-primer-inside-ryuk-crime-crypto-ledger-risky-asian-crypto-traders).

For quite some time, it was called triple threat, as typically such infections started from the Emotet trojan, which loaded Trickbot, which was used for downloading post-exploitation tools and final ransomware deployment. Usually, Trickbot was used to download a PowerShell Empire agent or a Cobalt Strike Beacon – another extremely popular post-exploitation framework.

Recently, the group changed the toolset and started to use a new trojan called Bazar. Interestingly enough, they started to use vishing (voice phishing) in their distribution scheme. The phishing emails don't contain any malicious files or links, just some information about a fake paid subscription and a phone number to call to cancel it. If a victim calls the number, the operator guides him or her to download a weaponized Microsoft Office file, open it, and enable the macros, so the computer is infected with Bazar. Just like with Trickbot, the trojan is used to download and execute a post-exploitation framework – most commonly, Cobalt Strike.

To deploy Ryuk, the threat actors leveraged multiple techniques, including the previously mentioned PsExec and Group Policy modification.

First, they provided emails to allow the victims to contact them, but soon started to use Tor onion services:

Figure 1.5 – Instructions embedded into the ransom note

Ryuk ransomware operators are still active, and, according to AdvIntel and HYAS, have earned more than $150 million (source: https://www.advanced-intel.com/post/crime-laundering-primer-inside-ryuk-crime-crypto-ledger-risky-asian-crypto-traders).

Who was behind the Ryuk ransomware?

On June 4, 2021, the FBI released an indictment charging Alla Witte, aka Max, for being involved in a transnational organization responsible for creating and deploying the Trickbot trojan and ransomware.

Some other Ryuk-related threat actors were the Emotet botnet operators. They were arrested in January 2021 as the result of a collaborative operation between law enforcement in the Netherlands, Germany, the United States, the United Kingdom, France, Lithuania, Canada, and Ukraine. As a result, the authorities took full control of the botnet's infrastructure.

One of the most notable things was what exactly the Emotet operators' workplace looked like:

Figure 1.6 – Emotet operators' workplace

More insights are available in the following video: https://www.youtube.com/watch?v=_BLOmClsSpc.

Despite the fact that threat actors are being arrested, more and more cybercriminals want to join the big game. So, another phenomenon has emerged – ransomware-as-a-service.

Incident Response Techniques for Ransomware Attacks

Incident Response Techniques for Ransomware Attacks

Overview of this book

Related Content you might be interested in

Current Title:

Incident Response Techniques for Ransomware Attacks

Aligning Security Operations with the MITRE ATT&CK Framework

Practical Memory Forensics.

Digital Forensics and Incident Response.

2018 – Ryuk ransomware

Who was behind the Ryuk ransomware?