[Music]
World Health Organization researchers
and he mailed them all a floppy disc
this was his like get-rich quick scheme
based on nature this is a picture of the
floppy disc that he mailed them AIDS
information so of course at the time
AIDS had just become this big epidemic
researchers were studying it everybody
wanted to open this and they popped it
into their
computers and when they ran uh when they
did they got this popup that said dear
customer it is time to pay for your
software lease from the PC cyborg
Corporation complete the invoice and
attach payment for the lease and then
they actually had you mail a check to
Panama I don't know exactly what Dr pop
was planning here but he thought he was
going to be getting a bunch of checks
for $189 mailed to a po. box in Panama
where I guess he was going to just cash
out and live happily ever after turns
out it wasn't very hard to track this
down uh the attack was very quickly
traced down to him he was EXT extradited
to the United States where he was
declared mentally unit unfit for trial
so that is the beginning of ransomware
times have changed since then obviously
it's not your grandma's ransomware
anymore and um what we have seen today
is not just malware that locks up all
your data of course but we're seeing
data exfiltration threats to leak data
denial of service attacks so in this
talk and also in our book we discuss not
just ransomware but really cyber
extortion in general any threats to the
confidentiality integrity and
availability of
information okay I jumped a little bit
ahead and didn't tell you who we were so
let's back up a second who is this
person speaking at you my name is Sher
davidof I'm the CEO of lmg security and
I've been in the industry for 23 years
um along with Matt I'm the co-author of
ranor and cyber extortion and I've
written two other books as well and I
think my claim to fame is that the New
York Times called me a security dirty
badass ones that's like my biggest life
achievement uh Matt take it away talk
about yourself uh yeah so nice to meet
everyone my name is Matt Duran I'm the
director of training and research for
lmg security I have not been in uh cyber
security as long as Sherry by by any
stretch but uh you know I try to keep up
uh but yeah we uh we we're really
excited to be here and ransomware
honestly is is kind of a uh a a passion
project of ours we've uh we've been uh
working through ransomware cases and
dealing with this these kind of cyber
attacks for years uh put it all into our
book and so if you'd like to go ahead
and swing by our booth after the talk
we're actually going to be doing a book
signing starting right as soon as we get
done here which was supposed to be at
noon but a little bit after uh we'd love
to see you guys come by thanks Matt So
today we're going to start off by
talking about MGM uh the big Ransom case
that we've got a lot of questions about
lately we'll discuss the impacts of
cyber extortion and then we're going to
walk you through a couple more case
studies in a demo we'll talk about the
Royal ransomware gang the anatomy of a
ransomware attack and a demo from our
laboratory where the leite giraffe gang
hacks hack me Inc and then finally we're
going to uh conclude by talking about
the top security controls of 2023 we
want to make sure that we're giving
people consistent recommendations on
what to do for both response and
prevention um and so we'll conclude with
that all
right so last month of course hackers
took down MGM and for those of us who
were just in Vegas this was like a shock
how many of you were in Vegas for hacker
summer camp by the way yeah super fun
and I was like did I party with the
person who did that um but no it turned
out uh that it was a well-known
ransomware gang linked to Alpha V and
Scattered spider and it caused a
systemwide outage at MGM so everything
was down you can see on the screen here
the uh gambling machines were down cash
only at restaurants I honestly can't
even imagine that can't get into your
room with the digital room key half the
time that doesn't work for me anyway so
whatever the websites were down the TVs
were down I I don't even know what
people would do anymore at that point so
this was extremely impactful of course
for MGM and they did their best to
muddle through but a couple nuances
about this case that are very indicative
of the trend today number one it wasn't
just lack of availability right the
hackers also made a point of stealing
information and threatening to release
it to the world and you can see on the
screen here this is Alpha V and we can
never be sure that the hackers that
claim that they hacked somebody actually
did by the way that's a problem um but
anyway they said we posted a link to
download any and all exfiltrated
materials up till September 12th blah
blah blah um and they were trying to get
a big payout by threatening to release
this data which unfortunately for them
did not work they also said we still
continue to have access to some of mgm's
infrastructure so the importance of
threat hunting is really it cannot be
understated okay so then because of that
MGM had to disclose a data theft and
again this is part of the Playbook that
we see all the time so this is a
screenshot of a letter that was sent to
employees and in that letter they said
that employees um oh sorry criminal
actors obtained certain personal
information belonging to some customers
including name contact info gender date
of birth and driver's license and then
also a limited number of social security
numbers and passports I do wonder why
MGM had Social Security numbers for
customers I'm sure there was a good
reason know your customer verification
know your customer verification that
makes sense also some employee usernames
and passwords um and so they had to
announce a data breach because of this
this is part of a growing Trend what
you're seeing on the screen here are
statistics from the Beasley cyber
insurance company I was just actually at
one of their conferences and you can see
that over the past few quarters
somewhere between 80 to 95% of incidents
have had data exfiltration as a
component these are specifically cyber
extortion incidents So Gone are the days
when people could say oh ransomware it
just comes and cleans it off pretty much
every ransomware case you see you have
to treat it as though it's a potential
data breach
exposure extortion in my opinion is here
to stay and if you think about it it's a
lot of work to deploy ransomware and
then keep track of the keys and try to
unlock it the criminals end up basically
having to do customer support for their
victims and in fact a lot of times when
we're working with these criminal gangs
it sure feels like they are like
professional customer support
Specialists like they'll help you
troubleshoot the decryptor and things
like that um or one one time they
actually said tell us what country
you're from and seemed like they were
gathering statistics on their
performance so anyway ransomware is
complex when you think about the ROI on
Data Theft it is much higher all they
have to do is steal some data and then
threaten to release it to the world and
they're done right um we've even had
cases where we're pretty sure they
didn't actually steal information they
were just fooling um but out of an
abundance of caution The Ransom was
actually paid and sometimes that's
covered by cyber insurance so it's much
much easier likely to remain widespread
okay we're also starting to see um much
much quicker disclosures in part because
of the new SEC guidelines that say you
must disclose within four business days
that's huge we already were getting some
visibility but four business days means
there's really not a whole lot of time
to do an investigation to rule out an
issue in the case of MGM we just got
handed a lot of information about the
financial impact very very quickly after
it happened in fact I can't remember a
case uh before where we got an estimate
so quickly um they estimated overall it
would be a $100 million loss and that
included both the operational outage as
well as fees the fees included legal
fees um Tech Consulting
fees when you have a ransomware cyber
extortion case the immediate impact
seems huge but often that's just the tip
of the iceberg from a cost perspective
so in the case of MGM their Q3
expenditure was $10 million but again
they're estimating that another 90% of
that will be happening in the future
after the
fact we also see other consequences that
are not as easy to me to measure the
ponon Institute had a great report last
year about the medical effects of
ransomware and other types of cyber
extortion cases so check this out when a
healthc care facility gets hit with
ransomware 64% of the time there's
delays in in care uh and excuse me
delays in procedures and tests that have
resulted in poor outcomes so boom right
there it's hard to quantify but you see
that occurring there's a longer length
of stay which means it's more costly and
the one that's most frightening is that
it leads to increased mortality in
patients as well so literally ransomware
can be a life or death
situation we also see layoffs and
resignations um in legal and Retail the
number of organizations that do layoffs
after a ransomware attack is close to
50% and in other Industries it's still
very significant we we also see 32% of
organizations hit by ransomware lose
their top leadership e either because
they resign or because they're fired and
of course we also see lawsuits both for
privacy reasons and because of the
operational impact so I think all of us
have been seeing privacy lawsuits for a
while and a lot of them do get thrown
out because the uh victims can't can't
show harm what happened in the U UHS
case is that multiple patients sued many
of those were not allowed to continue
because they couldn't show harm but one
patient was was able to demonstrate that
he suffered Financial damage because he
was scheduled for a surgery that surgery
got delayed because of a ransomware
attack he no longer had the same
insurance coverage and so he could
calculate the difference in financial
costs and so his lawsuit was allowed to
proceed so we're seeing many different
types of lawsuits a lot of gray areas
some conflicting rulings um which means
everything's up in the air right now
legally speaking okay the total revenues
generated by ransomware have been going
up and up up and up and you can see
already in
2023 the revenues that the criminals are
making are significantly higher than the
year before of course it's hard for us
to track ransomware revenues and how
much money they're making for those of
you following cersa the new federal
incident reporting law that will go into
effect in the next year or two um soon
we will be required to report Ransom
more payments within 24 hours if you're
part of critical industry and as a
result of that sisa will be producing
quarterly reports that give us
statistics so even though it's a little
scary to think hey we're going to have
to report Ransom payments in 24 hours
that is going to give us a lot more
visibility into how big this industry
really
is okay so how did the MGM hack happen
it was a social engineering attack we're
actually seeing a lot of ransomware and
cyber extortion cases beginning this way
according to Bloomberg it was a social
engineering attack on the company's help
desk and MGM has not confirmed a lot of
these details um but according to a
former MGM employee the help desk was
vulnerable to an attack because it was
too easy to do a password reset for
someone who calls in the good news is
that MGM was using multiactor
authentication so even if you could
reset somebody's password no worries no
sweat they still have uh MFA on their
phones right wrong um attackers are
calling help desks and pretending that
hey I lost my phone I need I need my
multiactor authentication to be reset
and this is called a cross tenant
impersonation attack it's a trend that
OCTA has been warning about for a while
in fact OCTA has uh published a whole
blog post on it several months ago it
service desks are targeted so your help
desk may be targeted think about how you
verify those employees when they call in
particularly if they call in and need a
multiactor authentication system reset
and then once they were in the system of
course the hackers were then able to add
new accounts and promote other users
remove multiactor authentication those
are the typical things that they're
going to do once they're inside
according to journalists the MGM attack
was drop dead simple and this is an
organization that invests a ton in cyber
security but they said uh based on what
the hackers told them all alphab did was
hop on LinkedIn find an employee and
call the help desk a 10-minute
conversation again MGM has not confirmed
this um to wrap up our discussion of
social engineering another big Trend we
were seeing in a reason this is
successful is because of the prevalence
of caller ID spoofing so this is spoof
card at lmg we actually do social
engineering testing and we like to use
spoof card to change your voice to to do
call or ID changes um there's also many
other similar tools like this the FBI
came out with their annual report
recently on crime statistics and warned
that um there's an increasingly
prevalent tactics in this case by
business emaa compromise actors of
spoofing legitimate business numbers to
confirm fraudulent banking details with
victims so we're seeing more and more
call or ID spoofing in different
contexts and of course over the next few
years we're going to have to worry about
voice cloning um I think you need now
what is it 30 seconds of audio in order
to be able to clone somebody's voice so
I guess anybody watching this
presentation on the internet can now
clone my voice
great um but there are strong ways to
verify callers uh one that many of my
bank clients use is just to integrate
with a multiactor authentication system
like OCTA so you can actually have a pin
sent to the person's phone and read to
you uh over the phone um which I think
is a pretty decent uh way to do it and
then also there's tools like pin drop
that will actually sample the audio in
the background of the call and Link it
and uh check a database of known
fraudulent uh call samples to see if it
matches things like that so they're
actually doing audio analysis and
looking at call metadata and things like
that so bottom line we need to be
training our our employees we need to be
including things like voice social
engineering MFA in order to resist these
extortion attacks and other types of
attacks finally attackers another Trend
we're seeing which came up in MGM is
that attackers are kneecapping
virtualization so in the MGM attack uh
their esxi servers were allegedly
encrypted by The Ransom more gang so
Matt I'll turn it over to you to go
through some of these details perfect
yeah so when we're talking about uh the
the prevalence of going after hypervisor
specifically I mean this has become a
big Trend and we're seeing a lot of
Brans more groups go for this there's
good reasons why they would do that
though and uh MGM unfortunately felt the
brunt of this the uh the esxi host they
were running actually managed most of
those critical systems inside their
Network so their Players Club their
hotel uh uh reservation system their
phones those were all virtual systems
and the attackers really took these
things down to like the base bare metal
level I mean they annihilated these uh
these esxi host which is is pretty nasty
so why go after a hypervisor well when
you think about it it actually makes
quite a bit of sense why you would want
to go after a system like that first off
we all use them I mean everyone is
moving towards virtualization as kind of
the default in their environments now
how many of you run all bare metal
servers inside of your environment I'd
be surprised if I saw very many hands
come up right yeah everybody's moving
towards things like VMware towards uh
things like hyperv towards esxi I mean
there's there's reasons why we do this
the other thing too is that those esxi
hosts those uh those virtualized uh uh
hosting platforms are usually a lot more
powerful than just a standard
workstation they've got a lot more RAM
they've got a much more powerful
processor set it makes sense why the
attackers would want to go for that more
efficient on their part and finally if
they can take down a hypervisor at a
root level that means they don't have to
go through and encrypt every single
computer inside your network one by one
by one they don't have to do a massive
software push they don't have to deal
with something like PS exec they can
just hit the hypervisor take everything
down in one Fell Swoop that also means
from an investigation standpoint I can't
get data off of any of those hard drives
anymore because everything is encrypted
all the way down to the uh the the
kernel level that that sucks for me uh
and we have an example of this actually
happening so uh the Royal ranser group
has been pretty prolific as of late they
are one of the bigger names uh when we
when we talk about modern ransomware up
there with black hat and Alpha V uh lock
bit and some of the other more kind of
you know notorious uh names that we hear
in the industry we were working with a
state government agency and they had
about 5,000 individual users they had a
big esxi farm that was hosting a lot of
their infrastructure their domain
controllers their file servers
application servers their Citrix
environment and then most importantly
they had their backup system hosted in a
virtualized platform uh that is a
mistake for any of you who are thinking
about doing that so so please don't do
that when we talk about immutable
backups we want really immutable backups
not something where if I take out your
hypervisor I also kill your backups
which we'll we'll get to that here in
just a second so let's talk about the
attack as we see in a lot of cases this
really started with a fishing email
social engineering and ransomware tend
to go kind of hand inand they are
they're like peas and carrots uh and the
other problem that we ran into here was
another very common issue the attackers
were able to to get into the network
they were able to uh exploit local
administrator credentials on a single
computer at first but all the local
admin credentials were the same all the
way across the network uh again very
very common mistake that we find our
pent testers find this one very very
frequently as well and it is just a
death nail to an environment once this
uh once this gets hit uh once they hit
there they were able to get into an IT
manager's computer scrape a locally
stored clear text password file that had
the SSH credentials for their hypervisor
system so now they're not even logging
in with the graphic interface anymore
they're not going through the browser
they're just going straight in through
SSH they have root level access on this
device uh and then they uh they they
went ahead and uh kind of locked out the
uh the ATT or the uh the regular users
at that point so one of our big
recommendations here if you're able to
because this is not always as easy as it
sounds is to include things like your
root level hypervisors in your security
program uh in a lot of cases though
there may not be an EDR or an antivirus
agent that you can actually drop on that
system pretty common actually I mean
they're really not built for that kind
of uh that kind of work and also in a
lot of best practice configurations
those hypervisors are excluded from
things like AV scans in the first place
mainly because we don't want to
interfere with them we don't want to
Brick the system and we don't want a
bunch of unnecessary uh resource
draining software running on those hosts
it makes sense I I used to be in it I
get but uh we we still need to keep an
eye on those so uh make sure that you're
able to catch issues quickly there and
uh you know make sure you're not leaving
those things out in the cold so this
brings up another that we're seeing in a
lot of our in a lot of our rans more
cases and that is the basic practice of
the hackers locking people out of
systems this is uh you know passwords
being changed it is Network
configurations being changed there's a
lot that can happen here to keep someone
who is a who is responding to a ransom
more attack from being able to actually
respond uh in this case the attackers
got in and they changed the passwords
for every user they had their own user
password set up at this point and uh
they were uh they were basically in
control of the entire network the IT
staff had no way of actually getting in
uh the other thing too they securely
deleted those virtual backups uh all the
way down to the root level of the drive
so at this point again it did not matter
that the uh the victim at this point
actually on paper had a pretty robust
immutable backup system the attackers
didn't need to worry about that because
they went underneath that backup and
just took it out of the hard drive uh
this is this is a bad place to find
yourself if uh if you couldn't imagine
that the Royal ransomware gang one of
the things I think is funny about them
is they have value added services oops
um so for example if you look at the Roy
Royal's website on the dark web this is
their contact form and they say
fortunately we got you covered Royal
offers you a unique deal for a monest
royalty uh for our pentesting services
we will not only provide you with an
amazing risk mitigation service blah
blah blah but also a Security review for
your systems so sometimes you can pay a
little extra and the attackers will give
you a Security review or or it might
even be
included um you don't want the hackers
to be the ones pentesting you it's
better to have a real penetration test
ahead of time uh not after the fact so
that's one of our top
recommendations all right so tell us
about the damage Matt all right so yeah
let's go over the damage uh really quick
though I do want to point out we did do
a negotiation with the black hat uh
Ransom more group at one point and they
did send us one of those pens reports uh
pretty thorough we we actually got a
pretty good idea of what was happening
on the network formatting was crap the
formatting sucked but and it cost like
$750,000 so I mean a regular pen cheaper
better but yeah anyway sorry tangent
there uh so the damage uh the local
backups inside of this network were
completely annihilated these guys were
dead in the water all the other hosts on
the network their domain controller
their app server their file server all
this stuff is just dead at this point
machines won't boot we can't collect
evidence I mean this is this is pretty
rough and now we're in the situation
where we're likely going to need to
rebuild their entire network from the
root hypervisor level all the way up to
fully functional that's a big lift
especially for a 5,000 person
organization I mean that's that's going
to take quite quite a bit of
time this brings us up to why we need to
focus on backup so much as a means of
both proactive security and well
recovery from ransomware attacks if we
are using true immutable backups ideally
offsite completely that gives us the
ability to recover from even some of the
most catastrophic style of attacks if
the uh God forbid The Burning uh or the
building burns down or something like
that we still have our infrastructure
available especially if we have like a
replication site or some kind of uh you
know nice Dr switch over we can uh we
can jump into configuration does matter
too if you think you have immutable
backups please test that make sure they
are truly immutable if you're not
testing your backups you don't have
backups pretty simple concept there now
in this case our victim actually got
lucky and this is not something that we
run into very frequently we were very
happy to find this they actually had a
decommissioned esxi system that they had
uh they had moved off into it storage
about a month before the attack actually
happen so this is sitting completely
offline just collecting dust in an IT
store storage closet this is great news
for us because now we have a ton of that
data that was now encrypted that we
could get back not all of it there're
still we're still losing about 30 days
worth of data at this point which is
significant I mean that's that's going
to be a problem but it's now much less
of a problem it also meant we didn't
have to buy decryptor from the Royal
ransomware group to get those systems
back online which is uh which is pretty
nice when we're when we're talking about
you know an overall ending for the
victim so this brings up another thing
that we wanted to talk about here and
that is the importance of conducting
actual response training this is
something that the victim in this case
had not done and their IT staff kind of
had to shoot from the hip a bit when we
were getting into the initial parts of
this response that's not where you want
to find yourself when you're in a very
very high stress uh High severity
situation like this you want to be
rehearsed you want to be practiced
understand your incident response plan
understand who does what make sure that
you can move through a situation like
this as efficiently and smoothly as you
possibly can I mean it's not going to be
easy but it's good to practice you know
I think one thing we've seen recently is
the importance of ack knowledging Shadow
it when you're doing tabletops how many
of you have a shadow it or one or more
Shadow it groups in your organization
yeah so the problem is you go through
tabletop exercise thinking everything is
centralized and then push comes to shove
um there was a public entity recently uh
that we worked with that had a major
ransomware issue and they had Shadow it
that did not want to give them the
password to the backup system it was
totally a political issue um it delayed
them for weeks and eventually they got
it sorted out there was some HR uh HR
issues that came out of that um but the
bottom line is make sure you're
including Shadow it you're being
realistic when you're doing these
tabletop exercises I like how you
describe the threat of physical violence
as an HR issue
oh okay so now it's time to see what
happens in our laboratory so we wanted
to do a demo for you guys and just sort
of take a ransom or attack all the way
from beginning to end or really to the
extortion Point um so in this case we
have set up a organization called hack
me Inc hack me Inc manufacturers widgets
if you can't tell we pick on hack me Inc
in our laboratory a lot um very
important widgets and they also serve
the public so they have 24/7 uptime
requirements and they also of course
collect highly sensitive customer data
so there's a risk of data exfiltration
um because for some reason you need pii
in order to manufacture widgets so
that's hack me Inc hack me gets hit with
a ransomware attack as we're going to go
through this um you'll meet two people
at hack me Inc one is Le ability she is
their Finance Clerk and the other is
just in time our it
administrator so Lei of course has
unprivileged access uh to the
environment obviously she has access to
sensitive data but nothing special from
an IT admin perspective and then Justin
has the keys to the kingdom and let's
meet your criminals we decided the leite
giraffe gang would be our criminal gang
they're about to strike and uh as as
part of that there's the radman in lmg's
laboratory wow he looks familiar
criminals um okay so this is our anatomy
of a ranser attack and by the way um
anybody want a cyber slap bracelet we
have instead of handouts little wrist
outs that's right hey Spike nice to see
you uh boom they're also at our booth
you can stop by our booth afterwards and
I think we have like a couple hundred of
them um okay so you can see on these uh
wrist outs the anatomy of a cyber
extortion attack we start with entry we
go to expansion appraisal um priming
leverage and extortion so what this is
trying to illustrate is that from the
point of entry you actually have often
quite a bit of time to detect the
attackers before they actually hold you
hostage it's a whole process for them an
opportunity for you so where do we want
to start first of all we started off by
looking for a remote access troan how
are we going to get into the environment
we're going to find that rat and install
it and in this case we are going to
install it with a fishing attack y um
this is let's see which one was this the
xorm of rat this is written in Rust and
that's another Trend we're seeing of
these evasive programming language that
uh can run crossplatform that are very
fast um there was a headline last year
that black hat the black hat gang was uh
looking to rewrite their code in Rust I
know Matt you were just reading this
news article this morning yeah I mean
it's it's one of the uh again it's one
of the trends that we're seeing
uh similar to When anybody remember the
Zeus banking Trojan am I am I dating
myself here there's there's a couple
hands I see okay so the Zeus banking
Trojan kind of like the grandfather of
all Banking and information stealing
Trojans uh it was uh it was built and
released by a hacker named Hamza Bendel
also known as The Smiling hacker if you
ever look at news articles with him he's
always got this big grin on his face uh
but when he realized he was about to be
apprehended by federal law enforcement
he released that source code publicly
and because of that we saw this
explosion in the number of banking
Trojans trickbot Emet uh gim all of the
big names that you think of when you
think of information stealing Trojans
have their Genesis in that Zeus source
code and we're seeing a kind of
resurgence of that pattern with rust
based information Steelers there's a ton
of them that are out there some of them
just on GitHub even uh and attackers are
grabbing the source code modifying it to
fit their needs and then using it to uh
to do things like evade antivirus uh to
evade EDR software in some cases and
again to run crossplatform it can run on
Linux it can run on a Mac it can run on
a Windows PC and there's there's a lot
of of of useful uh kind of uh uh well
uses for that kind of
software so let's get started here how
do we actually get something like a
remote access Trojan onto a network well
we went ahead and went with the same way
that most attackers do we just sent a
fishing email in this case you can see
exactly what that looks like we have
accounts payments yahoo.com but we're
going to spoof that to a name that the
you know victim probably recognizes at
this point that's trivial and easy to do
and we're going to include something
like a Word document Microsoft Office
documents especially one note uh Links
at this point are really really
prevalent in dropping these kinds of of
pieces of software on the network so uh
there's our there's our maloc and in the
back end of this thing uh I'm sorry when
when we open it it's it's going to look
something like this and if you've worked
in cyber security or even worked with
email for a while you've likely seen a
document like this pop up at one point
or another it's going to say something
like the operation didn't complete
successfully because this was created in
an online version of Word or you need
admin access or something realistically
what they're trying to get you to do is
hit that enable content button at the
top of the uh of the banner
uh reminder don't click that ever please
don't otherwise you and I have to have a
much different conversation than we're
having today and i' really rather not uh
once we click that button that's going
to hit some VB script that I have
embedded in the document that's going to
reach out to the internet grab my
payload drop it onto the computer and
just like that we are now infected and
you can see my little proxy servers I I
ran this through any.run just to to get
some nice visuals for it but we ran
through the US for one of our servers
and then I ran through two proxies in
Germany uh at this point which was uh
which was kind of fun to
do now once we have the the uh that
initial foothold on the device we uh we
get a view from the attacker side of our
victim computer and we can get just
basic shell access right now if I just
run to Who Am I you can see that I am
the hackme domain user lay lay ability
this means that now I have access uh and
I can uh I can use that access to do any
number of things uh mostly what I want
to do though is uh steal data establish
persistence and then move throughout the
network in a much wider
fashion so let's see what that looks
like oh yeah so I've got username I've
got IP address I've got my uh my windows
version I've got my privilege level and
uh then I've got my my interactive shell
so one of the very first things I'm
going to do and I'm I'm modeling this
off of The Playbook of a pretty Infamous
ransomware group we'll tell you who that
is here in just a second but the very
first thing I want to do is gain
persistence outside of that remote
access Trojan now despite the fact that
this is written in Rust it's going to
evade antivirus it's going to be tough
to see I can't guarantee that nobody's
going to notice a piece of unauthorized
software running on the network so
instead I'm going to drop a piece of
legitimate remote access software in
this case I'm going to use the Splashtop
uh streamer and I can just send a direct
command line uh uh uh command over to
this computer install the streamer and
now I've got full RDP access instead of
having to worry about going through the
shell and going through my remote access
Trojan it's a you know pretty standard
way of going about
things this was not detected by any anti
antivirus or antiu and you can see three
of them here sorry Mt my eyes are not
that great oh yeah you're fine um but uh
yeah you can see three them here I think
it was um we ran it through virus total
and it didn't find it at all uh did we
run this one through Windows Defender
yeah we ran Microsoft Defender which I'm
surprisingly did not catch any of it
yeah and that's uh unfortunately not
that uncommon that's why you need EDR to
level up yeah the other one was Bit
Defender Bit Defender didn't catch this
one either but yeah we we saw nothing
and a lot of that has to do again with
the fact that we're using a rust based
info stealer here the way that Russ
packages their programs uh means that
signature-based identification becomes
incredibly difficult it's not the same
as a virus that's written in C or
something like that that uh those those
signatures just flat out don't really
exist which means again our traditional
model of antivir software is reasonably
ineffective against these types of
malware it's why we need EDR software
the other Trend we're seeing a lot of is
that hackers are just using legitimate
tools and um Matt was referencing the uh
the group that we modeling this after
three guesses uh what group is this
anybody know for a slap bracelet that we
modeling this off of what Ransom or
gang is
that
did you say Cony
bear bear close yeah there's one in
particular that leaked A
playbook than you uh thanks for being an
interactive audience I can't quite see
you guys um yeah this is based on the Ki
Playbook and we actually have a
screenshot a little later but kti's
Playbook actually got dumped to the
world and you could see that they were
actually Distributing legitimate tools
any.run was one um which means that it's
going to be harder to catch them with
things like antivirus software so again
that's why EDR is so important you
really need to level up and do
behavioral based analysis and things
like that and not just rely on
signatures um so our next phase of the
Cyber extortion attack is expansion um
what uh the elite giraffe gang did here
was they started scanning the network to
see what other opportunities they had to
expand so Matt take it away yeah and in
this case I'm not going to do anything
loud and obnoxious like use n map or
anything like that I'm just going to use
another piece of it software I'm just
going to use Advanced ip scanner it's
free it's lightweight it's easy to use
and again it's legitimate software it's
signed by a legitimate company it's
probably not going to set off any anti
software alert so that's going to give
me a pretty good view of the network and
you can see what I'm pulling back here
I'm pulling back the the open shares the
host names the IP addresses and the Mac
addresses of all the devices on the
network again this is one that we find
in a lot of aftermath when we do ranser
investigations the next thing I'm going
to do is I'm going to scrape some
credentials off of this computer and the
uh the cony Playbook itself uh will
we'll reference the software to use here
but uh I uh if I drop something like
mimic hats on a computer like this I
mean it's going to light up like a
Christmas tree any antivi software even
Windows Defender is going to catch that
I don't want that right I want to be
able to you know stay in the network for
as long as I can so instead if there is
a specific set of misconfigurations
which we unfortunately find fairly
frequently in the wild I can just pop
open your uh your task manager and I can
dump your elsass right from there this
means that I can now scrape clear text
credentials on my computer not have to
load any malware on your computer other
than the rat that I already have and
this is going to give me things like our
local admin passwords and occasionally
depending on how the session systems are
set up I may get more credential access
than that in this case I find Justin
times uh password sitting right there on
the computer this means now I can move
laterally so I'm going to go ahead and
uh test this out on the network I'm
going to RDP to any host that I can in
this case because Justin time is an
admin on the system I'm able to get
myself into one of their uh their domain
controllers I've basically got the
Kingdom at this point I've I've got
access to everything that I
need now what I'm going to do is fully
expand so uh I'm going to use a again a
legitimate toolkit I'm just going to use
the PS exec toolkit shove this remote
access trojen out to every computer on
the network because well I want
everything I don't know where the data
really lies on the network at this point
and I want to be able to steal it so the
more access I have the better using
something like PS exec I can push this
to anything on the domain that's going
to respond and I've got the admin
credentials to do it at this point you
can see my uh my my list of victim
computers growing in the bottom there
again we mentioned this is the kti
Playbook uh we we were following right
along with the instruction they give to
all of their Affiliates at this point
including the use of mimic hats and they
give you uh some it's we didn't
translate this it's in Russian but they
give you some advice on moving these
files off of the network to avoid
detection it's a you know pretty smart
way of going about they actually get to
the point where they tell their um
Frontline hackers what to look for what
kinds of files and things like that
which is interesting because like the
cases you see where for example they're
reusing a dirty wallet often that's
because you have a total newbie just
following these instructions step by
step not realizing that they need to
replace it with a new clean wallet that
they've just create that they have just
created um so Ki of course is operating
using the franchise model so they have
these centralized resources which are
then getting distributed to Affiliates
we had a conversation with Mark grins
from digital mint at loat this year and
uh the he was talking about the use of
uh of sanctioned cryptocurrency wallets
and how he very infrequently sees them
and when he got to the conversation
about how amateur hackers will sometimes
reuse dirty wallets and they can't
actually even pay them a ransom because
they're sanctioned by by by ofac his
feeling of disappointment sounded like
so palpable at that point just like
shaking his head like an angry father or
something okay so then uh just to zip
through some of these the attackers are
going to do an appraisal of what they
have they often these are not targeted
attacks you know they're just sending a
bunch of fishing emails and then they're
like oh what do we have and we'll see
that later I'm doing a talk later today
uh where we study the mov it attack and
the Klo Ransom gang just comes out and
says uh let us know if you've been
hacked cuz they have no idea what
organizations they've actually gotten so
they'll look for pii they'll look for
financial information they'll look for
proprietary information for a couple
different reasons one because of course
they want to hold you hostage and use
that as leverage but they'll also use
that to do things like set the ransom
demand um we've had case after case
where uh they clearly have inside
knowledge it's clear that they know the
amount that of the Cyber insurance
coverage and they're willing to
negotiate to just below that cyber
insurance policies are usually very
readily accessible in email and places
like that and then they're looking at
the finances and they seem to set the
ransom demand based on like a percentage
of Revenue or a percentage of net income
things like
that okay so whoops sorry meant to be on
that slide um so the next phase is that
the attackers are going to start speel
lunking through the files and apps that
hack me Inc and what were you looking
for evil Matt whatever we could find
honestly I mean we're we we don't know
uh and from an attacker standpoint they
don't have a road map to where your data
sits at this point this this is where
this was a great opportunity for
detection too because they're going to
start making noise uh we're looking for
anything that we can possibly find we're
looking for spreadsheets we're looking
for Word documents we're looking for
database files anything that might
contain something valuable to us
something we can use to extort you
further on down the road uh in this case
because we uh we had gotten into a
finance person's computer uh the local
file system actually had quite a bit of
uh of useful information for us uh not
quite not quite enough though I mean we
we really want to expand outward from
here uh but the next thing we wanted to
do was look at the groups that Leah was
uh was available with and this is going
to give us a little bit more information
about the domain specifically it's going
to tell us kind of where we need to go
uh where do you think we would go next
if we've got the local file system if
I'm a ransomware operator based on your
network experience alone where am I
going to go after I hit your local file
system file shares file shares where
else storage I'm going to hit your Cloud
that's that's where I'm going to go next
and this is again this is another one of
those big trends we're seeing peanut
butter and jelly R somewhere in the
cloud yeah so I mean if I've got access
to your computer odds are pretty good
you've either got to save session in
your browser or you've got a local app
that's going to take me to SharePoint
now I've got access to your cloud system
I've got your entire network so uh we we
can just kind of move on from
there uh once we had Justin's
credentials too we were able to get to
his computer and this is uh this is
something we've seen in a number of
cases this means I can also get access
to something like your Microsoft 365
admin portal and if you listen to my
talk yesterday that admin portal can be
very very impactful when we're talking
about obscuring our uh our activities
inside of a cloud tenant we can also do
things like change access permissions I
get access to everyone's shared folders
at that point uh in the in the cloud
system it's a bad place to find yourself
so uh yeah again watch out for that
one all right so then they do priming
priming is when the hackers are getting
the environment ready for ransomware to
be pushed out once they've collected
your data typically this is the next
step and this is also an opportunity to
detect them so evil Matt what did you do
to Prime the environment yeah so priming
the environment is again one of those
opportunities for detection where we
start to make a lot of noise how many of
you you guys remember when holiday in
got hacked
recently a couple of you so the the
reason holiday in they were they were
hit with a uh a data deletion uh attack
instead of a ransomware attack and the
reason that happened was because the
attackers couldn't figure out how to get
their ransomware to run uh mainly that's
because of security software and other
controls on the network if I've got
admin access I can kneecap those
controls so right now I'm pushing out
some group policy objects they they're
going to turn off things like file
access control and uh antivirus software
this means I'm just going to have a more
clear path towards uh completely
compromising the network as a whole and
this should be sending up alerts it
absolutely should yeah new GPO should
should totally alert you that something
something is going wrong uh the next
thing I'm going to do is enumerate the
file server I'm look for all the shares
that I uh I have access to and I'm going
to uh then change those file permissions
to give myself or anyone else access to
that that means when I dump my Ransom
more executable I can hit absolutely
everything and uh this is going to uh
again maximize my
impact the next thing I'm going to do is
create my own account on the system so
right now I've compromised a domain
admin I've compromised a standard user
I've got a remote access Trojan sitting
out there but what if I'm discovered
what if somebody realizes that account's
been compromised and they Chang the
password well I'm kind of locked out of
the system at that point and I don't
want that so instead I'm going to make
myself the radman uh and uh I I tried to
pick up a more you know smart assy name
to to put on there but this one seemed
to work pretty well but yeah this this
means that now I have my own persistent
admin access to the network and if as we
see in a lot of cases uh I detonate
ransomware and the IT staff just rolls
back to right before the Ransom were hit
they might be restoring my account again
so I can just get right back into the
network a very common thing that we see
uh so now I've got my own admin access
I've opened up the shares for everything
and it's time for us to probably steal
some data before we uh before we encrypt
everything right so how are we going to
do that well again we're going to use
some legitimate software to do this I
don't want to uh I don't want to set off
any big alarm Bells so if I uh if I
don't need to use my my Trojan to steal
data uh I will I will go for something
like arone and uh arone we see very
frequently as a uh is a you know pretty
common addition to an attacker's toolkit
uh one of the things that's nice about
it is it's very easily customizable it
can link directly up to a cloud shared
folder and it staggers the actual upload
of data so this isn't going to set off
any usage alarms we're not going to see
any big bandwidth spikes very kind of
sneaky way of pulling data out of the
network uh if I'm not worried about that
I can actually just use the rat that I
already have on the system and and pull
data that way but it's going to be a
judgment call on my part there and then
we went to the dark web to pick out our
ransomware exactly yeah we we to detate
some ransomware and when we when we
looked for a ransomware what I really
wanted to do was make this basically
ransomware for dummies uh what kind of
ransomware strain can I grab that's
going to automate most of these
processes for me I want to just be able
to double click this and go so we uh we
did some searching we went through Alpha
Bay we went through versus we went
through the cipher market and uh we
settled on the Dharma ransomware strain
now Dharma if you're not familiar with
it is uh is is a lower dollar ransomware
but they go in high volume this is kind
of the Gan crab method of of somewhere
they kind of shotgun blast this out to
anyone who they can get as a a victim
they charge a reasonably low cost and
they just work on volume to actually
make their money and they're they're
very successful uh with Dharma you're
looking normally at about $5,000 per
computer that they uh they encrypt so if
they get your file server five grand you
get that back and they're they're out
the door but it uh it automatically
ruins a lot of things for us inside the
network the very first thing it does is
delete uh Shadow volume copies this
means that after the ransomware executes
uh I can't go back to a previous version
of that file and get around the
encryption this is very common almost
all ransomware does this at this point
in time and you can see the uh the
thread indicators this is from the miter
attack framework down below the next
thing it's going to do is kill some
annoying services so it's going to stop
things like your uh your Print Spooler
it's going to stop things like your SQL
Service uh uh vsss Rider uh and it's
going to uh get the environment into a
position where I can encrypt pretty much
everything on the network if some of
those services are running files may be
locked I may not be able to to hit them
so we want to make sure that won't
happen then Derma also automatically
does anti forensics which I think uh
makes our job very hard you can see it
right here that they clean out the event
logs automatically there's really
nothing manual that evil mat had to do
oh no no yeah I hit start on this one
and it just did all the work for me kind
of frightening uh the other thing it did
was search the network find all the
shares that were available Mount those
shares and encrypt the files in those
shares and it did this first before it
actually encrypted the local file system
uh normally this is done to avoid
detection because if a user sitting at
their desktop and this executes and
their desktop files get encrypted all of
a sudden they're going to know
something's wrong if they're shared
files get encrypted that's going to take
them a little bit longer to identify and
I've got a better chance of completing
that encryption cycle so that's again
why that order of operations runs in the
way it does we're seeing uh Ransom get
faster and faster and one of the
techniques that the criminals are using
to make sure it's um extremely fast is
that they're not even bothering to
encrypt your whole file in a lot of
cases they realize if they just do a
partial encryption of your QuickBooks
datab base or whatever it happens to be
um that you're going to be dead in the
water at that point and it's going to be
very difficult for you to reass assemble
things um so that is a trend that we're
seeing Splunk did a great research study
where they took different ransomware
strengths and lock bit adver was
advertising itself as the fastest
ransomware strain you can get and so
they were like okay is there truth in
malvertising which I thought was kind of
cute turns out there is um in the case
so they uh they set up 53 GB and 100,000
test files and they timed it to see how
long it would take the different
ransomers strains to go through it and
what they found was that lock bit uh the
median duration was 5 minutes and 50
seconds and the fastest time that it had
was just a little over 4 minutes I mean
that is impossible to respond to if it's
going to be less than 5 minutes for
ransomware to encrypt um over 50
gigabytes of data that's really ripping
through your network and that's again
because of that partial encryption
strategy all right so then once they've
primed your environment they've gained
their leverage whether it's through
exfiltration or through uh affecting the
availability of your information then
they're going to extort you so this is a
um I think this is a lock bit Ransom
note is that right Matt no this is our
Dharma Ransom oh this is our D Ransom
sorry this was how you ended our
scenario yep yeah so your files are
encrypted don't worry you can restore
them all there's a cool Skull this is
another ranser gang that we worked with
the vice society and these guys were
great because they were very well not
great they were evil um but they were
very verbose they wanted to explain why
they were there they wanted to have
relationships with journalists so I
wanted to show you a few examples first
there's the victim portal of course
where they just list all their victims
that's become standard on the dark web
and then here's a section for
journalists um if you're a journalist
and want to ask some questions they say
write to them and they're trying to get
back to everybody within 24 hours a lot
of these Ransom or gangs appear to have
like professional PR folks that are uh
watching their emails and responding on
a regular basis they had an FAQ on their
website um how did do decideed to team
up and start a dedicated ransomware
group group of friends that were
interested in pentest we decided to try
it that's funny that's how I started my
company too um can you explain your
decision to publish a certain company's
data they didn't pay they're just very
black and white about this
one so anything else you want to add
Matt about the extortion piece no no I
think we we covered basically everything
we wanted to go into yeah they're
getting they're just very professional
about it and that's the bottom line here
um you know we looked at some some
financial statistics early on and talked
about the fact that ranser Gs are making
more and more money uh but the amount of
money that they make has consistently
been underestimated a couple years ago
if you looked at some of the blockchain
analysis reports um like uh the Bitcoin
Ledger and things like that we were
estimating about 400 as an industry
about $400 million in ransomware
payments and then the Russia Ukraine war
came out and the hackers hacked
themselves they had a big internal
conflict within kti you can see that on
the screen here um and so glory to the
Ukraine they dumped out 150
cryptocurrency addresses so all of a
sudden boom we know what addresses Ki is
using we can calculate the amount of
money that we've been making and what we
found was at the time they had made up
to $2.7 billion worth of bitcoin that is
one Ransom Our Gang and that was eye
openening because it dwarfed all prior
estimates for the entire industry so
that just shows us how much they're
making and the fact is that they are
reinvest ing some of that in their
businesses so they're getting
increasingly sophisticated they have
ransomwares of service platforms they
have franchise models with very detailed
instructions they have employees they
have contractors they have public
relations teams they have sophisticated
data leak portals and we need to be not
just reactive but also proactive so we
talked about a few of the controls um
that you can use to prevent ransomware
we'd much rather prevent uh than have to
respond to it um if you do want to stop
by our booth we have the top security
controls of 2023 an actual handout not
just a wrist out um and that includes
things like deploy endpoint protection
cyber security training and awareness
pen testing nextg backups um and
incident response testing and training
and all of those are now nuanced it's
not just enough to check the checkbox on
backups they need to be a mutable
backups they need to not be sitting uh
in a virtual in a virtualized system so
um we have a little bit more detail on
each of those because it really the in
the details when it comes to ransomware
prevention these days so with that I
think we actually managed to whip
through these slides a little bit early
get you closer on time thank you guys so
much um
questions we'll take Applause and then
[Applause]
questions so when this type type of
thing happens and I have got to call
someone to help what's the Fe structure
how's that work like employee endpoints
servers like how do I get charged for
that so I believe your question is how
do you get charged for ransomware
response yeah okay so um in a lot of
cases companies have already set up a
retainer with their incident response
organization and it's actually it you
need to know who you're going to call
ahead of time you probably want to
understand if you have cyber Insurance
um who is covered under your cyber
insurance policy how you get approval to
engage a third-party vendor whether the
insurance you know exactly how you
interface with the insurance company to
get coverage for those things so that's
just one thing to think about um and
yeah you may have uh if you want 24/7
response you're probably going to be
paying a retainer for that ahead of time
because the IR firm will have staff
available um otherwise you just pay by
the hour in a lot of cases did I miss
anything uh no your incident response
plan ideally should have a an order of
operations if something like that hits
so who do you contact First how do you
contact them uh how do you contact them
after hours or on weekends and what is
the what is the next step from there yes
what is theity of
a response on retainer versus just
reaching out to somebody Insurance great
question uh do you need to have an IR
firm on retainer vers versus reach out
through Insurance you know honestly
these days I see companies that have an
IR firm on retainer but they haven't
checked to make sure they're covered by
insurance and so what happens in in an
incident is that the IR company starts
uh they're not covered by Insurance the
insurance company takes that
investigation away and all of a sudden
you're with a company you've never
worked with so it's really important to
make sure that those things are
harmonized um and sometimes when cyber
Insurance changes it doesn't know
security doesn't know or they don't know
the details it's like oh yeah we have a
new policy and um a lot of the work I've
been doing lately is just making sure
that incident response plans are being
are realistic and are taking into
account the Cyber Insurance piece of
it yes for um small companies 100
employees they don't even have an IR
plan they one it manager but uh
ransomware is assess be their biggest
threat there's like reporting tools like
you know siza has uh their Ransom
reporting uh yes stage FBI has there U
cyber crime reporting about sides if
they don't you know they they haven't
even they're kind of shocked they're
surprised by an attack what are there
resources like is Sia offering resources
it's just two small potatoes unless
they're like critical infrastructure you
know what I mean like what what what can
they do if they're behind the game they
don't have backups
yeah what can small businesses do and
every every organization is behind the
game honestly but it's especially hard
for small businesses um sisa does have
some resources I'll turn it over to you
in a second but not to not overemphasize
this um cyber insurance is critical for
smbs especially breach response
insurance so for those of you who aren't
super familiar with cyber Insurance you
can get coverage for the cash loss you
can get coverage for business
Interruption all those are important
pieces for preparing for ransom attack
but I think the biggest uh most helpful
part for smbs is the breach response
support and certain cyber insurers not
all of them actually have their own like
meta incident response team so you call
them and you say it's like kind of like
AAA I'm stuck on the side of the road
you call them and say I'm experiencing a
ranser attack and they have someone that
handles these things day in and day out
jumping in guiding you through the
investigation you'll probably get a
breach attorney assigned to you uh
you'll probably get an IR firm assigned
to you and somebody who knows what
they're doing is overseeing that um if
you don't have cyber insurance it's a
good idea to have like a virtual ceso a
fractional ceso guiding you through that
as well um I've had the privilege of
working with my some of my clients in
that capacity too and you know just
having that oversight to make sure that
you're crossing the te's and dotting the
eyes um do you want to speak at all to
the sissor resources yeah I I'll speak
to that first off though just have them
call me we we'll take care of it uh no
when you're when we're talking about
response if you if you don't have a
formalized plan you don't have a you
know a big cyber insurance policy or
something like that I mean I it it it
seems fairly intuitive when a crime has
been committed but contact law
enforcement uh the the FBI actually has
a a great uh amount of resources that
can be useful for an organization in
that initial kind of response phase they
can guide a little bit of the action
there I mean they're they're not
obviously going to take over and do any
remediation but they can provide some
advice on kind of where to go next well
they don't advertise when they have a
decrypter you know that might be
something that they're keeping close to
their vest that they can provide to
victims but law enforcement may not
advertise that because they don't want
the bad guys to know they have it yep so
any other questions yeah we got one yeah
so you mentioned that you have the help
a person to read a one time passcode
you're trying to reset their password
how do you effectively train your
employes readback one time pass people
on the phone and other circumstances but
do do it in this one specific C yes so
the question is back to social
engineering attacks and helped us and
that's a really good point how do you
train employees to read codes only to
certain people on the phone um and
remember by the way we just did a whole
in-depth talk on this um if you look at
our YouTube channel it's scams and fraud
um and so we can really go into depth
there but um first of all in the case
where your employees or your customers
are calling a call center they should be
contacting a number that they already
have on file that they trust as opposed
to people who are getting callers from
all over the place right so it's kind of
flipped um if you're calling a number
that you know and trust that's different
than you receive a call and you need to
verify that identity um humans are
always going to make mistakes and I
think we just be need to be moving away
from fishing prone authentication uh our
federal government has already banned
agencies from doing that um and so check
out our talk uh because we do talk about
Alternatives maybe last
question all right cool oh one more in
the back sorry on 14 you have 0% off for
government oh yeah I was wondering if
someone would notice
that uh yes on slide 14 um the report
the stats are that government has done
zero layoffs at least in this particular
survey did you have a question about
that you know
why well I think it's unlikely that
government's going to go out of business
and they don't have quite the same
issues um obviously they do suffer you
know these organizations suffer
tremendously but it's not the same as if
you know a small Health there was a
small healthcare clinic in Florida that
got hit with ransomware and had to lay
off 50% of their staff because they just
literally didn't have the cash flow um
and some of these uh smbs in particular
are already like handt mouth uh paycheck
to paycheck essentially as a business
and so A disruption of two to three
weeks can be devastating for them so on
that happy note uh thank you guys so
much for coming we appreciate it and
we'll be in our booth
afterwards