Cómo las bandas de ransomware aprovechan el cumplimiento de la seguridad
Compliance regulations like CCPA and GDPR are created with good intentions. They aim to secure user data, ensure privacy, and build trust between the companies and consumers. However, these regulations have become a double-edged sword for many organizations.
One reason for this is the rise of double extortion ransomware, where data is exfiltrated before files are encrypted. In this scenario, threat actors threaten to release sensitive company information online if the ransom is not paid. Companies can face hefty fines if they fail to comply with regulation, and thus they are pressured into paying the ransom just to keep the breach quiet.
Consequences of non-compliance
Today’s businesses face a range of demanding privacy regulations that are frequently being updated. This includes General Data Protection Regulation, or GDPR, the California Consumer Privacy Act, or CCPA, and regulations from the New York State Department Of Financial Services, or NYDFS.
With the shift to remote and dynamic working, and the ever-increasing complexity of business operations, there has been great pressure for companies to upgrade infrastructure and ensure that they are meeting all regulations.
Non-compliance can lead to significant financial penalties and drawn-out legal actions. If organizations fail to protect their data, the fees can be disastrous. GDPR can fine companies up to €20 million, or 4% of a company’s annual global turnover. For example, since 2017, Google has been fined a combined total of $9.5 billion by EU regulators.
Weaponization of compliance
Ultimately, compliance serves the important purpose of giving citizens more control and rights over their data. However, cyber-criminals have realized that they can use the threat of non-compliance as a pressure point against organizations. Stolen data, if released to the public, can lead to huge regulatory fines.
We have seen this phenomenon in double extortion ransomware attacks, where threat actors steal sensitive data before they encrypt the files. Moreover, several ransomware actors, such as the Babuk gang, now have begun to forsake encryption in favor of extortion. This is because threat actors realize that exfiltration is more effective when many organizations continually back up files as a precaution against the threat of ransomware locking down files.
Ransomware actors often auction intellectual property, customer data, and company secrets on the Dark Web. The Maze ransomware group established this trend back when it created a website in late 2019 to publicly ‘name and shame’ organizations that had been compromised. These attacks included theft of information such as stolen PDF files, in addition to IP addresses and device names which were then uploaded and made publicly available on its website.
Over 70% of ransomware attacks now involve exfiltration.
The tactic was made infamous by the cyber-criminal group REvil, who publicly announced their intentions on a Russian hacker forum in December 2019:
“Each attack is accompanied by a copy of commercial information. In case of refusal of payment, the data will either be sold to competitors or laid out in open sources. GDPR. Do not want to pay us – pay x10 more to the government. No problems.”
In these cases, threat actors are essentially saying, ‘if you pay us this small ransom, we will keep your data safe. If you don’t pay us, we have the power to release your data, and then you can take your chances with a huge compliance fine.’
Organizations may prefer to negotiate with cyber-criminals and keep the breach – or threat of breach – quiet. This is what the ransomware attackers are banking on.
How AI can help: Stopping ransomware and strengthening compliance
Compliance fines are not cheap. It took over three years of legal proceedings for Equifax to settle their 2017 data breach. They finally settled with paying $700 million to regulators, including the Federal Trade Commission and the Consumer Financial Protection Bureau (CFPB). Home Depot and Uber have also famously faced financial penalties of hundreds of millions of dollars.
These regulatory fines are compounding the potential consequences of ransomware. The continued ability of attackers to adapt and find new weaknesses means that it is crucial for companies to identify and contain ransomware in its earliest stages, with machine speed and precision.
La IA de Darktrace ha logrado esto en repetidas ocasiones, como cuando se detuvo una intrusión de WastedLocker antes de que se desplegara el ransomware. Al evolucionar constantemente su conocimiento de la organización, la Cyber AI detecta e investiga automáticamente toda actividad inusual en la empresa y puede responder de forma autónoma en tiempo real para detener las amenazas en su camino.
Figure 1: Darktrace’s customizable CCPA tags allow for specialized alerting on activity related to personal data as defined by CCPA
Además, la tecnología de Darktrace puede utilizarse para actuar sobre tipos específicos de alertas basados en diferentes modelos de amenaza de cumplimiento. Por ejemplo, las empresas que deseen garantizar el cumplimiento de los requisitos de la CCPA pueden utilizar una "etiqueta CCPA" específica para determinados dispositivos que tengan, o puedan tener, datos de consumidores sujetos a la CCPA. Cuando los datos relevantes de los dispositivos etiquetados abandonan el entorno o están involucrados en cualquier actividad anormal, la IA de Darktrace lo detecta inmediatamente y lanza automáticamente una investigación sobre el incidente.
With a proven ability to protect against machine-speed threats, and the ability to strengthen compliance with customizable alerts, the Darktrace Immune System platform provides a powerful defense against double extortion ransomware.
Compliance is just one of the many strategic concerns facing ransomware victims. In addition to customer trust, valuable IP, and long-term reputation, attackers and defenders are in a constant ‘cat and mouse’ game, such that threat actors will continue to seek out new pressure points to extort their targets.
Figure 2: Current varieties of double extortion ransomware
Organizations accordingly will benefit from using sophisticated technologies that neutralize ransomware before it has encrypted or exfiltrated files, stopping advanced threats in their earliest stages.
¿Te gusta esto y quieres más?
Reciba el último blog en su bandeja de entrada
Gracias. Hemos recibido su envío.
¡Ups! Algo salió mal al enviar el formulario.
¿Te gusta esto y quieres más?
Stay up to date on the latest industry news and insights.
Darktrace son expertos de talla mundial en inteligencia de amenazas, caza de amenazas y respuesta a incidentes, y proporcionan apoyo al SOC las 24 horas del día a miles de clientes de Darktrace en todo el mundo. Inside the SOC está redactado exclusivamente por estos expertos y ofrece un análisis de los ciberincidentes y las tendencias de las amenazas, basado en la experiencia real sobre el terreno.
SOBRE EL AUTOR
Mariana is the VP of Cyber Innovation at Darktrace, and works closely with the development, analyst, and marketing teams to advise technical and non-technical audiences on how best to augment cyber resilience, and how to implement AI technology as a means of defense. She speaks regularly at international events, with a specialism in presenting on sophisticated, AI-powered email attacks. She holds an MBA from the University of Chicago, and speaks several languages including French, Italian, and Portuguese.
share this article
Stay up to date on the latest industry news and insights.
Using AI to Help Humans Function Better During a Cyber Crisis
Within cyber security, crises are a regular occurrence. Whether due to the ever-changing tactics of threat actors or the emergence of new vulnerabilities, security teams find themselves under significant pressure and frequently find themselves in what psychologists term "crisis states."1
A crisis state refers to an internal state marked by confusion and anxiety to such an extent that previously effective coping mechanisms give way to ineffective decision-making and behaviors.2
Given the prevalence of crises in the field of cyber security, practitioners are more prone to consistently making illogical choices due to the intense pressure they experience. They also grapple with a constant influx of rapidly changing information, the need for swift decision-making, and the severe consequences of errors in judgment. They are often asked to assess hundreds of variables and uncertain factors.
The frequency of crisis states is expected to rise as generative AI empowers cyber criminals to accelerate the speed, scale, and sophistication of their attacks.
Why is it so challenging to operate effectively and efficiently during a crisis state? Several factors come into play.
Firstly, individuals are inclined to rely on their instincts, rendering them susceptible to cognitive biases. This makes it increasingly difficult to assimilate new information, process it appropriately, and arrive at logical decisions. Since crises strike unexpectedly and escalate rapidly into new unknowns, responders experience heightened stress, doubt and insecurity when deciding on a course of action.
These cognitive biases manifest in various forms. For instance, confirmation bias prompts people to seek out information that aligns with their pre-existing beliefs, while hindsight bias makes past events seem more predictable in light of present context and information.
Crises also have a profound impact on information processing and decision-making. People tend to simplify new information and often cling to the initial information they receive rather than opting for the most rational decision.
For instance, if an organization has successfully thwarted a ransomware attack in the past, a defender might assume that employing the same countermeasures will suffice for a subsequent attack. However, ransomware tactics are constantly evolving, and a subsequent attack could employ different strategies that evade the previous defenses. In a crisis state, individuals may revert to their prior strategy instead of adapting based on the latest information.
Given there are deeply embedded psychological tendencies and hard-wired decision-making processes leading to a reduction in logic during a crisis, humans need support from technology that does not suffer from the same limitations, particularly in the post-incident phase, where stress levels go into overdrive.
In the era of rapidly evolving novel attacks, security teams require a different approach: AI.
AI can serve as a valuable tool to augment human decision-making, from detection to incident response and mitigation. This is precisely why Darktrace introduced HEAL, which leverages self-learning AI to assist teams in increasing their cyber resilience and managing live incidents, helping to alleviate the cognitive burden they face.
Darktrace HEAL™ learns from your environment, including data points from real incidents and generates simulations to identify the most effective approach for remediation and restoring normal operations. This reduces the overwhelming influx of information and facilitates more effective decision-making during critical moments.
Furthermore, HEAL offers security teams the opportunity to safely simulate realistic attacks within their own environment. Using specific data points from the native environment, simulated incidents prepare security teams for a variety of circumstances which can be reviewed on a regular basis to encourage effective habit forming and reduce cognitive biases from a one-size-fits-all approach. This allows them to anticipate how attacks might unfold and better prepare themselves psychologically for potential real-world incidents.
With the right models and data, AI can significantly mitigate human bias by providing remediation recommendations grounded in evidence and providing proportionate responses based on empirical evidence rather than personal interpretations or instincts. It can act as a guiding light through the chaos of an attack, providing essential support to human security teams.
Akira Ransomware: How Darktrace Foiled Another Novel Ransomware Attack
Threats Landscape: New Strains of Ransomware
In the face of a seemingly never-ending production line of novel ransomware strains, security teams across the threat landscape are continuing to see a myriad of new variants and groups targeting their networks. Naturally, new strains and threat groups present unique challenges to organizations. The use of previously unseen tactics, techniques, and procedures (TTPs) means that threat actors can often completely bypass traditional rule and signature-based security solutions, thus rendering an organization’s digital environment vulnerable to attack.
What is Akira Ransomware?
One such example of a novel ransomware family is Akira, which was first observed in the wild in March 2023. Much like many other strains, Akira is known to target corporate networks worldwide, encrypting sensitive files and demanding huge sums of money to retrieve the data and stop it from being posted online .
In late May 2023, Darktrace observed multiple instances of Akira ransomware affecting networks across its customer base. Thanks to its anomaly-based approach to threat detection, Darktrace DETECT™ successfully identified the novel ransomware attacks and provided full visibility over the cyber kill chain, from the initial compromise to the eventual file encryptions and ransom notes. In cases where Darktrace RESPOND™ was enabled in autonomous response mode, these attacks were mitigated the early stages of the attack, thus minimizing any disruption or damage to customer networks.
Initial access and privilege escalation
The Akira ransomware group typically uses spear-phishing campaigns containing malicious downloads or links as their primary initial access vector; however, they have also been known to use Remote Desktop Protocol (RDP) brute-force attacks to access target networks .
While Darktrace did observe the early access activities that are detailed below, it is very likely that the actual initial intrusion happened prior to this, through targeted phishing attacks that fell outside of Darktrace’s purview. The first indicators of compromise (IoCs) that Darktrace observed on customer networks affected by Darktrace were typically unusual RDP sessions, and the use of compromised administrative credentials.
On one Darktrace customer’s network (customer A), Darktrace DETECT identified a highly privileged credential being used for the first time on an internal server on May 21, 2023. Around a week later, this server was observed establishing RDP connections with multiple internal destination devices via port 3389. Further investigation carried out by the customer revealed that this credential had indeed been compromised. On May 30, Darktrace detected another device scanning internal devices and repeatedly failing to authenticate via Kerberos.
As the customer had integrated Darktrace with Microsoft Defender, their security team received additional cyber threat intelligence from Microsoft which, coupled with the anomaly alerts provided by Darktrace, helped to further contextualize these anomalous events. One specific detail gleaned from this integration was that the anomalous scanning activity and failed authentication attempts were carried out using the compromised administrative credentials mentioned earlier.
By integrating Microsoft Defender with Darktrace, customers can efficiently close security gaps across their digital infrastructure. While Darktrace understands customer environments and provides valuable network-level insights, by integrating with Microsoft Defender, customers can further enrich these insights with endpoint-specific information and activity.
In another customer’s network (customer B), Darktrace detected a device, later observed writing a ransom note, receiving an unusual RDP connection from another internal device. The RDP cookie used during this activity was an administrative RDP cookie that appeared to have been compromised. This device was also observed making multiple connections to the domain, api.playanext[.]com, and using the user agent , AnyDesk/7.1.11, indicating the use of the AnyDesk remote desktop service.
Although this external domain does not appear directly related to Akira ransomware, open-source intelligence (OSINT) found associations with multiple malicious files, and it appeared to be associated with the AnyDesk user agent, AnyDesk/6.0.1 . The connections to this endpoint likely represented the malicious use of AnyDesk to remotely control the customer’s device, rather than Akira command-and-control (C2) infrastructure or payloads. Alternatively, it could be indicative of a spoofing attempt in which the threat actor is attempting to masquerade as legitimate remote desktop service to remain undetected by security tools.
Around the same time, Darktrace observed many devices on customer B’s network making anomalous internal RDP connections and authenticating via Kerberos, NTLM, or SMB using the same administrative credential. These devices were later confirmed to be affected by Akira ransomware.
Figure 1 shows how Darktrace detected one of those internal devices failing to login via SMB multiple times with a certain credential (indication of a possible SMB/NTLM brute force), before successfully accessing other internal devices via SMB, NTLM and RDP using the likely compromised administrative credential mentioned earlier.
Darktrace DETECT models observed for initial access and privilege escalation:
Device / Anomalous RDP Followed By Multiple Model Breaches
The next step Darktrace observed during Akira ransomware attacks across the customer was internal reconnaissance and lateral movement.
In another customer’s environment (customer C), after authenticating via NTLM using a compromised credential, a domain controller was observed accessing a large amount of SMB shares it had never previously accessed. Darktrace DETECT understood that this SMB activity represented a deviation in the device’s expected behavior and recognized that it could be indicative of SMB enumeration. Darktrace observed the device making at least 196 connections to 34 unique internal IPs via port 445. SMB actions read, write, and delete were observed during those connections. This domain controller was also one of many devices on the customer’s network that was received incoming connections from an external endpoint over port 3389 using the RDP protocol, indicating that the devices were likely being remotely controlled from outside the network. While there were no direct OSINT links with this endpoint and Akira ransomware, the domain controller in question was later confirmed to be compromised and played a key role in this phase of the attack.
Moreover, this represents the second IoC that Darktrace observed that had no obvious connection to Akira, likely indicating that Akira actors are establishing entirely new infrastructure to carry out their attacks, or even utilizing newly compromised legitimate infrastructure. As Darktrace DETECT adopts an anomaly-based approach to threat detection, it can recognize suspicious activity indicative of an emerging ransomware attack based on its unusualness, rather than having to rely on previously observed IoCs and lists of ‘known-bads’.
Darktrace further observed a flurry of activity related to lateral movement around this time, primarily via SMB writes of suspicious files to other internal destinations. One particular device on customer C’s network was detected transferring multiple executable (.exe) and script files to other internal devices via SMB.
Darktrace recognized that these transfers represented a deviation from the device’s normal SMB activity and may have indicated threat actors were attempting to compromise additional devices via the transfer of malicious software.
Darktrace DETECT models observed for internal reconnaissance and lateral movement:
Device / RDP Scan
Anomalous Connection / SMB Enumeration
Anomalous Connection / Possible Share Enumeration Activity
Scanning of Multiple Devices (Cyber AI Analyst Incident)
Device / Possible SMB/NTLM Reconnaissance
Compliance / Incoming Remote Desktop
Compliance / Outgoing NTLM Request from DC
Unusual Activity / Internal Data Transfer
Security Integration / Lateral Movement and Integration Detection
Device / Anomalous SMB Followed By Multiple Model Breaches
In the final phase of Akira ransomware attacks detected on Darktrace customer networks, Darktrace DETECT identified the file extension “.akira” being added after encryption to a variety of files on the affected network shares, as well as a ransom note titled “akira_readme.txt” being dropped on affected devices.
On customer A’s network, after nearly 9,000 login failures and 2,000 internal connection attempts indicative of scanning activity, one device was detected transferring suspicious files over SMB to other internal devices. The device was then observed connecting to another internal device via SMB and continuing suspicious file activity, such as appending files on network shares with the “.akira” extension, and performing suspicious writes to SMB shares on other internal devices.
Darktrace’s autonomous threat investigator, Cyber AI Analyst™, was able to analyze the multiple events related to this encryption activity and collate them into one AI Analyst incident, presenting a detailed and comprehensive summary of the entire incident within 10 minutes of Darktrace’s initial detection. Rather than simply viewing individual breaches as standalone activity, AI Analyst can identify the individual steps of an ongoing attack to provide complete visibility over emerging compromises and their kill chains. Not only does this bolster the network’s defenses, but the autonomous investigations carried out by AI Analyst also help to save the security team’s time and resources in triaging and monitoring ongoing incidents.
In addition to analyzing and compiling Darktrace DETECT model breaches, AI Analyst also leveraged the host-level insights provided by Microsoft Defender to enrich its investigation into the encryption event. By using the Security Integration model breaches, AI Analyst can retrieve timestamp and device details from a Defender alert and further investigate any unusual activity surrounding the alert to present a full picture of the suspicious activity.
In customer B’s environment, following the unusual RDP sessions and rare external connections using the AnyDesk user agent, an affected device was later observed writing around 2,000 files named "akira_readme.txt" to multiple internal SMB shares. This represented the malicious actor dropping ransom notes, containing the demands and extortion attempts of the actors.
As a result of this ongoing activity, an Enhanced Monitoring model breach, a high-fidelity DETECT model type that detects activities that are more likely to be indicative of compromise, was escalated to Darktrace’s Security Operations Center (SOC) who, in turn were able to further investigate and triage this ransomware activity. Customers who have subscribed to Darktrace’s Proactive Threat Notification (PTN) service would receive an alert from the SOC team, advising urgent follow up action.
Darktrace DETECT models observed during ransomware deployment:
When Darktrace is configured in autonomous response mode, RESPOND is able to follow up successful threat identifications by DETECT with instant autonomous actions that stop malicious actors in their tracks and prevent them from achieving their end goals.
In the examples of Darktrace customers affected by Akira outlined above, only customer A had RESPOND enabled in autonomous response mode during their ransomware attack. The autonomous response capability of Darktrace RESPOND helped the customer to minimize disruption to the business through multiple targeted actions on devices affected by ransomware.
One action carried out by RESPOND was to block all on-going traffic from affected devices. In doing so, Darktrace effectively shuts down communications between devices affected by Akira and the malicious infrastructure used by threat actors, preventing the spread of data on the client network or threat actor payloads.
Another crucial RESPOND action applied on this customer’s network was combat Akira was to “Enforce a Pattern of Life” on affected devices. This action is designed to prevent devices from performing any activity that would constitute a deviation from their expected behavior, while allowing them to continue their ‘usual’ business operations without causing any disruption.
While the initial intrusion of the attack on customer A’s network likely fell outside of the scope of Darktrace’s visibility, Darktrace RESPOND was able to minimize the disruption caused by Akira, containing the ransomware and allowing the customer to further investigate and remediate.
Novel ransomware strains like Akira present a significant challenge to security teams across the globe due to the constant evolution of attack methods and tactics, making it huge a challenge for security teams to stay up to date with the most current threat intelligence.
Therefore, it is paramount for organizations to adopt a technology designed around an intelligent decision maker able to identify unusual activity that could be indicative of a ransomware attack without depending solely on rules, signatures, or statistic lists of malicious IoCs.
Darktrace DETECT identified Akira ransomware at every stage of the attack’s kill chain on multiple customer networks, even when threat actors were utilizing seemingly legitimate services (or spoofed versions of them) to carry out malicious activity. While this may have gone unnoticed by traditional security tools, Darktrace’s anomaly-based detection enabled it to recognize malicious activity for what it was. When enabled in autonomous response mode, Darktrace RESPOND is able to follow up initial detections with machine-speed preventative actions to stop the spread of ransomware and minimize the damage caused to customer networks.
There is no silver bullet to defend against novel cyber-attacks, however Darktrace’s anomaly-based approach to threat detection and autonomous response capabilities are uniquely placed to detect and respond to cyber disruption without latency.
Credit to: Manoel Kadja, Cyber Analyst, Nahisha Nobregas, SOC Analyst.
IOC - Type - Description/Confidence
202.175.136[.]197 - External destination IP -Incoming RDP Connection
api.playanext[.]com - External hostname - Possible RDP Host