Cyber-crime continues to evolve – especially over the last year in terms of ransomware. Ransomware used to be largely a spray-and-pray proposition where attackers used automated tools to spread and encrypt as fast as possible, with immediate ransom demands. Those did enough damage.
However, cyber security researchers are reporting a new, more patient and human-driven extortion scheme where criminals infect many networks but only select larger organizations with deeper pockets. In these larger target networks, they may dwell for as long as a year while they stealthily reconnoiter and spread.
Once they identify and compromise the organization’s most critical systems, they pull the trigger, encrypt and demand ransom. The activity appears to be from Russian organized cyber crime and the attacks as a set are identified as TEMP.Mixmaster by some researchers, and is associated with a cyber-crime group identified as GRIM SPIDER by other researchers.
In these attacks, the initial compromise is via TrickBot, usually via the time-honored attached-document-bearing-macros routine. Then using a wide variety of techniques, attackers patiently spread through the network gaining credentials and access as they go – and more importantly – identifying important resources along the way. Tools and techniques used include:
- Obfuscated PowerShell
- PowerShell Empire
- Common commands and utilities like sc, adfind, psexec
- Scheduled Tasks
- Remote Desktop
Ultimately, attackers end up using Ryuk to encrypt and demand ransom. Ryuk is very different than your average spray-and-pray automated ransomware. Ryuk is custom designed for manual control of smaller volume operations, involving the most crucial assets of the organization identified by attackers over the course of months and up to a year in some cases.
In this webinar, we’ll take apart TEMP.Mixmaster attacks, including the 2 main pieces of malware TrickBot and Ryuk.
Then we’ll share many techniques for detection of this kind of attack – there are plenty of events in the Security Log, Sysmon and PowerShell logs, if you know what to look for. And we’ll discuss what you can do to prevent and slow down attackers. Using PowerShell security features like Constrained Language Mode and much more.
My colleague Jeff Warren is doing much of the research for this event and will take a large part in its presentation as well. Jeff really knows AD security and the Windows Security Log. He’s a security researcher at STEALTHbits who is sponsoring this webinar. After this real-training-for-free coverage, he will do a live demo of Empire in action and show how we can detect and help mitigate it.
Please join us for this real training for free session.