Blog
Dentro del SOC
Reciclaje de ransomware: El regreso de Ryuk







In the era of international-scale cyber-warfare, focus has started to move away from small-time cyber thieves toward well-known, well-funded and sometimes government-backed cyber-crime organizations. Cyber-attacks sometimes work on discordant scales, however, and it doesn’t always take big budgets or key players for considerable damage to be dealt.
Numerous stories detail how the criminal and the curious alike have single-handedly breached some of the most secure systems in the world. At the more amusing end, there’s the story of Kristoffer von Hassel who discovered a novel exploit in Microsoft’s Xbox Live system at just five years old. And then of course there are those who hack their way right into promising security careers by breaching systems at major organizations. However, genuine damage has been done by individual threat actors as well.
These might be criminals using second-hand offensive tools, buying botnet armies for as little as $10 on the Dark Web, or using ransomware files downloaded for free. But ultimately, even a single cyber-criminal can inflict crippling damage upon large organizations if they are given the opportunity.
This is especially the case when the tools in their possession have been developed by some of the most notorious names in cyber-crime.
Copycat criminals
In early 2021, Darktrace detected a new instance of the once notorious Ryuk ransomware being launched against a business in the APAC region. The detection was intriguing.
The developers of Ryuk, a prolific cyber-criminal organization given the name ‘Wizard Spider’, had long since abandoned it in favor of a successor called ‘Conti’. Wizard Spider have launched some of the largest cyber-attacks in recent history, allegedly with the support of the Russian government, and are under investigation by Interpol and the FBI. They are not known for using outdated tools.
It soon became clear that this attack was not being launched by Wizard Spider at all, but by small-scale threat actors picking up the tools Wizard Spider left behind. And as the new attackers proved, these tools are still far from defunct.
Ryuk ransomware: A city-stopper for sale
Ryuk ransomware is commonly used to target large enterprise environments, even taking down entire city councils in some instances. Lake City, Florida and the City of Onkaparinga in South Australia are two of its known victims, along with numerous schools and hospitals across the US.
Once active in a system, Ryuk uses a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files, disabling Windows’ system restore feature as it does so, and generally demands payment via Bitcoin in return for a private decryption key.
Though Ryuk was not initially sold in the same manner as its predecessor, Hermes, on the Dark Web site ‘exploit[.]in’, it is now believed by some publications that the toolkit must be available somewhere for various threat actors to buy and tailor to their requirements. This explains its recurrence beyond Wizard Spider activities.
New dog, old tricks
Darktrace spotted the new instance of Ryuk during a trial with a real estate business in the APAC region. The first warning sign came when some basic .dat files were downloaded onto one of the business’ devices from an unknown Russian IP address. Darktrace immediately detected that this download was a likely breach and, had Antigena been set up in active mode, would have initiated a targeted response at this early stage.
The .dat files on the infected device allowed the attackers to use RDP (Remote Desktop Protocol) to spread further into the business’ network. Two days after the initial compromise, the threat actor had gained administrative credentials through a bruteforce attack and could begin scanning the network further.

Figure 1: Timeline of the attack
The witching hour
Just an hour after the attacker gained administrative credentials, at approximately 3:30am local time, ransomware files appeared in the business’ network. This timing was not accidental. The attackers knew that the security teams at the target business were home and asleep when the ransomware landed in the small hours of the morning, giving them plenty of time to conduct their attack.
This is precisely the kind of simple tactic which can multiply the scale of an attack without using large budgets or complex toolsets. The Ryuk ransomware rapidly began encrypting corporate files during the night, and by the time the security team returned in the morning, all they could do was shut down the entire network and hope to limit the spread of Ryuk, if only to save a few final devices.
The total attack time, from initial compromise to widespread data encryption, was just two and a half days. Whether due to understaffing or preoccupation, the security team did not find the time in that small window to respond to alerts, and, with Darktrace Antigena in passive mode, the attack was able to go ahead. This business’ need for Autonomous Response, which can protect against old and new attacks around the clock without the need for manual intervention, was painfully apparent.
Autonomous Response: Stop Ryuk before Ryuk stops you
Understanding Ryuk’s history and functionality does little good for organizations when it is still capable of eluding their defenses and catching security teams unawares. Darktrace’s Self-Learning AI is uniquely positioned to address these sophisticated threats, even as they evolve in the hands of different attackers and become unrecognizable to traditional rule-based security approaches.
Utilizing 24/7 Autonomous Response to stop both new and old threats at machine speed gives security teams the best chance of leveling the playing field against attackers. With Darktrace Antigena, the size or status of the attacking organization and their toolset is irrelevant – any anomalous and threatening behavior will be neutralized quickly and accurately, before damage can be done.
Thanks to Darktrace analyst Thomas Nommensen for his insights on the above threat find.
¿Te gusta esto y quieres más?
More in this series
Blog
Using AI to Help Humans Function Better During a Cyber Crisis



Within cyber security, crises are a regular occurrence. Whether due to the ever-changing tactics of threat actors or the emergence of new vulnerabilities, security teams find themselves under significant pressure and frequently find themselves in what psychologists term "crisis states."1
A crisis state refers to an internal state marked by confusion and anxiety to such an extent that previously effective coping mechanisms give way to ineffective decision-making and behaviors.2
Given the prevalence of crises in the field of cyber security, practitioners are more prone to consistently making illogical choices due to the intense pressure they experience. They also grapple with a constant influx of rapidly changing information, the need for swift decision-making, and the severe consequences of errors in judgment. They are often asked to assess hundreds of variables and uncertain factors.
The frequency of crisis states is expected to rise as generative AI empowers cyber criminals to accelerate the speed, scale, and sophistication of their attacks.
Why is it so challenging to operate effectively and efficiently during a crisis state? Several factors come into play.
Firstly, individuals are inclined to rely on their instincts, rendering them susceptible to cognitive biases. This makes it increasingly difficult to assimilate new information, process it appropriately, and arrive at logical decisions. Since crises strike unexpectedly and escalate rapidly into new unknowns, responders experience heightened stress, doubt and insecurity when deciding on a course of action.
These cognitive biases manifest in various forms. For instance, confirmation bias prompts people to seek out information that aligns with their pre-existing beliefs, while hindsight bias makes past events seem more predictable in light of present context and information.
Crises also have a profound impact on information processing and decision-making. People tend to simplify new information and often cling to the initial information they receive rather than opting for the most rational decision.
For instance, if an organization has successfully thwarted a ransomware attack in the past, a defender might assume that employing the same countermeasures will suffice for a subsequent attack. However, ransomware tactics are constantly evolving, and a subsequent attack could employ different strategies that evade the previous defenses. In a crisis state, individuals may revert to their prior strategy instead of adapting based on the latest information.
Given there are deeply embedded psychological tendencies and hard-wired decision-making processes leading to a reduction in logic during a crisis, humans need support from technology that does not suffer from the same limitations, particularly in the post-incident phase, where stress levels go into overdrive.
In the era of rapidly evolving novel attacks, security teams require a different approach: AI.
AI can serve as a valuable tool to augment human decision-making, from detection to incident response and mitigation. This is precisely why Darktrace introduced HEAL, which leverages self-learning AI to assist teams in increasing their cyber resilience and managing live incidents, helping to alleviate the cognitive burden they face.
Darktrace HEAL™ learns from your environment, including data points from real incidents and generates simulations to identify the most effective approach for remediation and restoring normal operations. This reduces the overwhelming influx of information and facilitates more effective decision-making during critical moments.
Furthermore, HEAL offers security teams the opportunity to safely simulate realistic attacks within their own environment. Using specific data points from the native environment, simulated incidents prepare security teams for a variety of circumstances which can be reviewed on a regular basis to encourage effective habit forming and reduce cognitive biases from a one-size-fits-all approach. This allows them to anticipate how attacks might unfold and better prepare themselves psychologically for potential real-world incidents.
With the right models and data, AI can significantly mitigate human bias by providing remediation recommendations grounded in evidence and providing proportionate responses based on empirical evidence rather than personal interpretations or instincts. It can act as a guiding light through the chaos of an attack, providing essential support to human security teams.
1 www.cybersecuritydive.com/news/incident-response-impacts-wellbeing/633593
2 blog.bcm-institute.org/crisis-management/making-decision-during-a-crisis
Blog
Dentro del SOC
Akira Ransomware: How Darktrace Foiled Another Novel Ransomware Attack



Threats Landscape: New Strains of Ransomware
In the face of a seemingly never-ending production line of novel ransomware strains, security teams across the threat landscape are continuing to see a myriad of new variants and groups targeting their networks. Naturally, new strains and threat groups present unique challenges to organizations. The use of previously unseen tactics, techniques, and procedures (TTPs) means that threat actors can often completely bypass traditional rule and signature-based security solutions, thus rendering an organization’s digital environment vulnerable to attack.
What is Akira Ransomware?
One such example of a novel ransomware family is Akira, which was first observed in the wild in March 2023. Much like many other strains, Akira is known to target corporate networks worldwide, encrypting sensitive files and demanding huge sums of money to retrieve the data and stop it from being posted online [1].
In late May 2023, Darktrace observed multiple instances of Akira ransomware affecting networks across its customer base. Thanks to its anomaly-based approach to threat detection, Darktrace DETECT™ successfully identified the novel ransomware attacks and provided full visibility over the cyber kill chain, from the initial compromise to the eventual file encryptions and ransom notes. In cases where Darktrace RESPOND™ was enabled in autonomous response mode, these attacks were mitigated the early stages of the attack, thus minimizing any disruption or damage to customer networks.

Initial access and privilege escalation
The Akira ransomware group typically uses spear-phishing campaigns containing malicious downloads or links as their primary initial access vector; however, they have also been known to use Remote Desktop Protocol (RDP) brute-force attacks to access target networks [2].
While Darktrace did observe the early access activities that are detailed below, it is very likely that the actual initial intrusion happened prior to this, through targeted phishing attacks that fell outside of Darktrace’s purview. The first indicators of compromise (IoCs) that Darktrace observed on customer networks affected by Darktrace were typically unusual RDP sessions, and the use of compromised administrative credentials.
On one Darktrace customer’s network (customer A), Darktrace DETECT identified a highly privileged credential being used for the first time on an internal server on May 21, 2023. Around a week later, this server was observed establishing RDP connections with multiple internal destination devices via port 3389. Further investigation carried out by the customer revealed that this credential had indeed been compromised. On May 30, Darktrace detected another device scanning internal devices and repeatedly failing to authenticate via Kerberos.
As the customer had integrated Darktrace with Microsoft Defender, their security team received additional cyber threat intelligence from Microsoft which, coupled with the anomaly alerts provided by Darktrace, helped to further contextualize these anomalous events. One specific detail gleaned from this integration was that the anomalous scanning activity and failed authentication attempts were carried out using the compromised administrative credentials mentioned earlier.
By integrating Microsoft Defender with Darktrace, customers can efficiently close security gaps across their digital infrastructure. While Darktrace understands customer environments and provides valuable network-level insights, by integrating with Microsoft Defender, customers can further enrich these insights with endpoint-specific information and activity.
In another customer’s network (customer B), Darktrace detected a device, later observed writing a ransom note, receiving an unusual RDP connection from another internal device. The RDP cookie used during this activity was an administrative RDP cookie that appeared to have been compromised. This device was also observed making multiple connections to the domain, api.playanext[.]com, and using the user agent , AnyDesk/7.1.11, indicating the use of the AnyDesk remote desktop service.
Although this external domain does not appear directly related to Akira ransomware, open-source intelligence (OSINT) found associations with multiple malicious files, and it appeared to be associated with the AnyDesk user agent, AnyDesk/6.0.1 [3]. The connections to this endpoint likely represented the malicious use of AnyDesk to remotely control the customer’s device, rather than Akira command-and-control (C2) infrastructure or payloads. Alternatively, it could be indicative of a spoofing attempt in which the threat actor is attempting to masquerade as legitimate remote desktop service to remain undetected by security tools.
Around the same time, Darktrace observed many devices on customer B’s network making anomalous internal RDP connections and authenticating via Kerberos, NTLM, or SMB using the same administrative credential. These devices were later confirmed to be affected by Akira ransomware.
Figure 1 shows how Darktrace detected one of those internal devices failing to login via SMB multiple times with a certain credential (indication of a possible SMB/NTLM brute force), before successfully accessing other internal devices via SMB, NTLM and RDP using the likely compromised administrative credential mentioned earlier.

Darktrace DETECT models observed for initial access and privilege escalation:
- Device / Anomalous RDP Followed By Multiple Model Breaches
- Anomalous Connection / Unusual Admin RDP Session
- New Admin Credentials on Server
- Possible SMB/NTLM Brute Force Indicator
- Unusual Activity / Successful Admin Brute-Force Activity
Internal Reconnaissance and Lateral Movement
The next step Darktrace observed during Akira ransomware attacks across the customer was internal reconnaissance and lateral movement.
In another customer’s environment (customer C), after authenticating via NTLM using a compromised credential, a domain controller was observed accessing a large amount of SMB shares it had never previously accessed. Darktrace DETECT understood that this SMB activity represented a deviation in the device’s expected behavior and recognized that it could be indicative of SMB enumeration. Darktrace observed the device making at least 196 connections to 34 unique internal IPs via port 445. SMB actions read, write, and delete were observed during those connections. This domain controller was also one of many devices on the customer’s network that was received incoming connections from an external endpoint over port 3389 using the RDP protocol, indicating that the devices were likely being remotely controlled from outside the network. While there were no direct OSINT links with this endpoint and Akira ransomware, the domain controller in question was later confirmed to be compromised and played a key role in this phase of the attack.
Moreover, this represents the second IoC that Darktrace observed that had no obvious connection to Akira, likely indicating that Akira actors are establishing entirely new infrastructure to carry out their attacks, or even utilizing newly compromised legitimate infrastructure. As Darktrace DETECT adopts an anomaly-based approach to threat detection, it can recognize suspicious activity indicative of an emerging ransomware attack based on its unusualness, rather than having to rely on previously observed IoCs and lists of ‘known-bads’.
Darktrace further observed a flurry of activity related to lateral movement around this time, primarily via SMB writes of suspicious files to other internal destinations. One particular device on customer C’s network was detected transferring multiple executable (.exe) and script files to other internal devices via SMB.
Darktrace recognized that these transfers represented a deviation from the device’s normal SMB activity and may have indicated threat actors were attempting to compromise additional devices via the transfer of malicious software.

Darktrace DETECT models observed for internal reconnaissance and lateral movement:
- Device / RDP Scan
- Anomalous Connection / SMB Enumeration
- Anomalous Connection / Possible Share Enumeration Activity
- Scanning of Multiple Devices (Cyber AI Analyst Incident)
- Device / Possible SMB/NTLM Reconnaissance
- Compliance / Incoming Remote Desktop
- Compliance / Outgoing NTLM Request from DC
- Unusual Activity / Internal Data Transfer
- Security Integration / Lateral Movement and Integration Detection
- Device / Anomalous SMB Followed By Multiple Model Breaches
Ransomware deployment
In the final phase of Akira ransomware attacks detected on Darktrace customer networks, Darktrace DETECT identified the file extension “.akira” being added after encryption to a variety of files on the affected network shares, as well as a ransom note titled “akira_readme.txt” being dropped on affected devices.
On customer A’s network, after nearly 9,000 login failures and 2,000 internal connection attempts indicative of scanning activity, one device was detected transferring suspicious files over SMB to other internal devices. The device was then observed connecting to another internal device via SMB and continuing suspicious file activity, such as appending files on network shares with the “.akira” extension, and performing suspicious writes to SMB shares on other internal devices.
Darktrace’s autonomous threat investigator, Cyber AI Analyst™, was able to analyze the multiple events related to this encryption activity and collate them into one AI Analyst incident, presenting a detailed and comprehensive summary of the entire incident within 10 minutes of Darktrace’s initial detection. Rather than simply viewing individual breaches as standalone activity, AI Analyst can identify the individual steps of an ongoing attack to provide complete visibility over emerging compromises and their kill chains. Not only does this bolster the network’s defenses, but the autonomous investigations carried out by AI Analyst also help to save the security team’s time and resources in triaging and monitoring ongoing incidents.

In addition to analyzing and compiling Darktrace DETECT model breaches, AI Analyst also leveraged the host-level insights provided by Microsoft Defender to enrich its investigation into the encryption event. By using the Security Integration model breaches, AI Analyst can retrieve timestamp and device details from a Defender alert and further investigate any unusual activity surrounding the alert to present a full picture of the suspicious activity.
In customer B’s environment, following the unusual RDP sessions and rare external connections using the AnyDesk user agent, an affected device was later observed writing around 2,000 files named "akira_readme.txt" to multiple internal SMB shares. This represented the malicious actor dropping ransom notes, containing the demands and extortion attempts of the actors.


As a result of this ongoing activity, an Enhanced Monitoring model breach, a high-fidelity DETECT model type that detects activities that are more likely to be indicative of compromise, was escalated to Darktrace’s Security Operations Center (SOC) who, in turn were able to further investigate and triage this ransomware activity. Customers who have subscribed to Darktrace’s Proactive Threat Notification (PTN) service would receive an alert from the SOC team, advising urgent follow up action.
Darktrace DETECT models observed during ransomware deployment:
- Security Integration / Integration Ransomware Incident
- Security Integration / High Severity Integration Detection
- Security Integration / Integration Ransomware Detected
- Device / Suspicious File Writes to Multiple Hidden SMB Shares
- Compliance / SMB Drive Write
- Compromise / Ransomware / Suspicious SMB Activity (Proactive Threat Notification Alerted by the Darktrace SOC)
- Anomalous File / Internal / Additional Extension Appended to SMB File
- Anomalous File / Internal / Unusual SMB Script Write
- Compromise / Ransomware / Ransom or Offensive Words Written to SMB
- Anomalous Server Activity /Write to Network Accessible WebRoot
- Anomalous Server Activity /Write to Network Accessible WebRoot
Darktrace RESPOND
When Darktrace is configured in autonomous response mode, RESPOND is able to follow up successful threat identifications by DETECT with instant autonomous actions that stop malicious actors in their tracks and prevent them from achieving their end goals.
In the examples of Darktrace customers affected by Akira outlined above, only customer A had RESPOND enabled in autonomous response mode during their ransomware attack. The autonomous response capability of Darktrace RESPOND helped the customer to minimize disruption to the business through multiple targeted actions on devices affected by ransomware.
One action carried out by RESPOND was to block all on-going traffic from affected devices. In doing so, Darktrace effectively shuts down communications between devices affected by Akira and the malicious infrastructure used by threat actors, preventing the spread of data on the client network or threat actor payloads.
Another crucial RESPOND action applied on this customer’s network was combat Akira was to “Enforce a Pattern of Life” on affected devices. This action is designed to prevent devices from performing any activity that would constitute a deviation from their expected behavior, while allowing them to continue their ‘usual’ business operations without causing any disruption.
While the initial intrusion of the attack on customer A’s network likely fell outside of the scope of Darktrace’s visibility, Darktrace RESPOND was able to minimize the disruption caused by Akira, containing the ransomware and allowing the customer to further investigate and remediate.
Darktrace RESPOND model breaches:
- Antigena / Network / External Threat / Antigena Ransomware Block
- Antigena / Network / External Threat / Antigena Suspicious Activity Block
- Antigena / Network / Significant Anomaly / Antigena Enhanced Monitoring from Server Block
- Antigena / Network / External Threat / Antigena Suspicious Activity Block
- Antigena / Network / External Threat / Antigena File then New Outbound Block
- Antigena / Network / Insider Threat / Antigena Unusual Privileged User Activities Block
- Antigena / Network / Significant Anomaly / Antigena Breaches Over Time Block
- Antigena / Network / Significant Anomaly / Antigena Significant Anomaly from Client Block
- Antigena / Network /Insider Threat /Antigena SMB Enumeration Block
Conclusion
Novel ransomware strains like Akira present a significant challenge to security teams across the globe due to the constant evolution of attack methods and tactics, making it huge a challenge for security teams to stay up to date with the most current threat intelligence.
Therefore, it is paramount for organizations to adopt a technology designed around an intelligent decision maker able to identify unusual activity that could be indicative of a ransomware attack without depending solely on rules, signatures, or statistic lists of malicious IoCs.
Darktrace DETECT identified Akira ransomware at every stage of the attack’s kill chain on multiple customer networks, even when threat actors were utilizing seemingly legitimate services (or spoofed versions of them) to carry out malicious activity. While this may have gone unnoticed by traditional security tools, Darktrace’s anomaly-based detection enabled it to recognize malicious activity for what it was. When enabled in autonomous response mode, Darktrace RESPOND is able to follow up initial detections with machine-speed preventative actions to stop the spread of ransomware and minimize the damage caused to customer networks.
There is no silver bullet to defend against novel cyber-attacks, however Darktrace’s anomaly-based approach to threat detection and autonomous response capabilities are uniquely placed to detect and respond to cyber disruption without latency.
Credit to: Manoel Kadja, Cyber Analyst, Nahisha Nobregas, SOC Analyst.
Appendices
IOC - Type - Description/Confidence
202.175.136[.]197 - External destination IP -Incoming RDP Connection
api.playanext[.]com - External hostname - Possible RDP Host
.akira - File Extension - Akira Ransomware Extension
akira_readme.txt - Text File - Akira Ransom Note
AnyDesk/7.1.11 - User Agent -AnyDesk User Agent
MITRE ATT&CK Mapping
Tactic & Technique
DISCOVERY
T1083 - File and Directory Discovery
T1046 - Network Service Scanning
T1135 - Network Share Discovery
RECONNAISSANCE
T1595.002 - Vulnerability Scanning
CREDENTIAL ACCESS, COLLECTION
T1557.001 - LLMNR/NBT-NS Poisoning and SMB Relay
DEFENSE EVASION, LATERAL MOVEMENT
T1550.002 - Pass the Hash
DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS
T1078 - Valid Accounts
DEFENSE EVASION
T1006 - Direct Volume Access
LATERAL MOVEMENT
T1563.002 - RDP Hijacking
T1021.001 - Remote Desktop Protocol
T1080 - Taint Shared Content
T1021.002 - SMB/Windows Admin Shares
INITIAL ACCESS
T1190 - Exploit Public-Facing Application
T1199 - Trusted Relationship
PERSISTENCE, INITIAL ACCESS
T1133 - External Remote Services
PERSISTENCE
T1505.003 - Web Shell
IMPACT
T1486 - Data Encrypted for Impact