The Ransomware Economy

There's no doubt about it...cybercrime, and especially ransomware, is an entire economy in and of itself.

Don't believe me?

Read through this ProPublica article, not just once, but a couple of times.  And take notes.  Then go back and read the notes.  Here's what I got from the article:

1. Organizations are looking to insurance policies to defray the costs of incidents.  Rather than investing in prevention, detection, and response, they're accepting (to some degree) that these incidents are going to happen, and seeking to establish a means to minimize their financial risk.  Hence, insurance policies.
2. A ransomware incident occurs, and the policy kicks in.  Depending upon how the policy was set up, and what it covers, the deductible may be much less than the ransom.  Financial risk minimized.
3. Insurance providers are more interested in getting ransoms paid quickly; getting the encryption keys and recovering files minimizes down time, and therefore any additional costs incurred as a result of services not being available.  So, insurance providers want the ransom paid, in order to minimize their financial exposure.
4. There's also an entire economy that's popped up around ransom payment brokers, organizations that act as intermediaries between victim organizations, insurance providers, and the bad guys.

But is that the end?  Is this just about encrypting data and getting paid to unlock it?  I wouldn't think so, and here's why.  One of the things I've always been curious about is, is there any data exfiltration going on prior to data encryption?  Are bad guys taking anything before encrypting files?  In most cases, it's hard to tell...I'm aware of ransomware cases where the bad guys are actually in the environment for weeks or even months before encrypting files, and the artifacts of data staging and exfiltration may be fleeting, at best, and nonexistent during the incident response.

Not long ago, a fellow responder shared that many of the ransomware cases he works include an element of data exfiltration.  A recent 60Minutes segment on ransomware includes a similar statement; if you watch until 9:50 in the segment, you'll see mention of the bad guy further extorting an organization by threatening to leak their "internal data".

Let's look at some of the reporting on ransomware, such as this The Conversation article. At one point in the article, we see the statement:

Ransomware usually spreads via phishing emails or links...

Perhaps "usually", yes, but not always.  The 60Minutes segment mentioned the Samsam ransomware; during the first half of 2016, these guys were seen using the publicly available JexBoss exploit to gain access to organizations through JBoss CMS servers.  At that time, the average time between initial access to the organization and deploying the ransomware was 4 months. In 2017, in some cases, they switched to Terminal Services servers, gaining access via easily-guessed passwords.  Yes, some ransomware (some Ryuk incidents, for example) incidents begin with a phishing email, and then branch off into deploying remote access tools, internal reconnaissance, possibly privilege escalation, networking mapping, and finally, deploying the ransomware.

Another quote from the article:

Offenders will do their homework before launching an attack, in order to create the most severe disruption they possibly can.

Yes, they will.  But what does this mean?  This means a couple of things; first, they decide who to target, and when.  Employees within companies have targets against which they're judged; sales reps, for example, usually hit crunch time at the end of a quarter.  So, what the bad guys will do is send something to a sales rep that looks legit, and it's something that they need to open.  Yes, they're targeting individuals.

What does this look like, you ask?  While not related to ransomware, but take a look at the Mia Ash story, and you'll see what targeting looks like.  Going after sales reps, or the finance department, legal counsel...all of these are targets within an organization, and very often the "lure" looks attractive enough to obviate phishing awareness training.  However, this is only the beginning.  In the Mia Ash story, the adversary developed a relationship with their targets, to the point where, when it came time to send a weaponized document for the target to open, the target had no doubt in their mind regarding the fact that they were dealing with "Mia".

Something that isn't stated in the media is that, for some ransomware cases, once an adversary gains initial access to an infrastructure, there are a number of actions that must take place in order for them to have such an impact as to make paying the ransom the obvious choice going forward.  They need to observe and orient to where they are, collect information about the infrastructure, make decisions (that's the easy part, they're often quite practiced at this), and then act.  This is Col Boyd's OODA loop.  In some cases, this can take weeks, and in others, months.  Unfortunately, one of the things missing from public reporting of ransomware incidents, in addition to the observed initial access method, is the time that the adversary is on target before deploying ransomware.  It's not an easy task to go into a completely new infrastructure and find those files and systems that, if unavailable, would bring the organization to a halt.

With visibility, these actions can be detected, and responded to in a timely manner.  When I say, "responded to", I mean determining the initial infection vector and following a containment and eradication plan early in the adversary's process.  Let's say that you detect a new account being created on a system, because you have the visibility to do so...which user account was used to create the new one?  How did that user account gain access to the system on which the command was run?  Follow the tracks back to the starting point, and determine how the adversary got on the system, and then search your infrastructure for other, similar artifacts. 

It all starts with visibility.  Don't address ransomware by trying to figure out if you should restore systems from backup or pay the ransom; instead, catch the adversary early in their process and stop them before they encrypt their first file.