Ransomware's New Normal

Don't be fooled by the drop in overall ransomware attacks this past year: Fewer but more targeted and lucrative campaigns against larger organizations are the new MO for holding data hostage.

While the number of ransomware attacks dropped 91% in the past year, according to data from Trend Micro, at the same time some 75% of organizations stockpiled cryptocurrency. The majority that did also paid their attackers the ransom, according to a Code42 study. Overall, more than 80% of ransomware infections over the past year were at enterprises, as cybercrime gangs began setting their sights on larger organizations capable of paying bigger ransom amounts than the random victim or consumer.

The evolution of the prolific GandCrab ransomware over the past few months demonstrates how this new generation of more selective attacks is more profitable to the cybercriminals using it - and underscores how the ransomware threat is far from over.

"[Ransomware is] not going anywhere anytime soon," says Adam Meyers, vice president of intelligence at CrowdStrike. "A few years ago, there was DDoS extortion ... it went away when no one was paying. But here they are doing ransomware attacks and making good on their demands."

Meyers says CrowdStrike recently added the GandCrab gang - which it calls Pinchy Spider - as the newest cybercrime group on its watch list of four groups attacking so-called "big game" targets and demanding anywhere from hundreds of thousands to millions of dollars in ransom to unlock their data. The other three cybercrime groups hacking bigger targets with ransomware are Boss Spider, the group behind SamSam; Indrik Spider, the group behind BitPaymer; and Grim Spider, which deploys Ryuk.

"They come in very much like a targeted intrusion attack by China or Iran [nation-states] would. They move laterally and deploy ransomware far and wide across the enterprise, charging a much higher ransom," Meyers explains. "It's an evolution in how ransomware is deployed, and it demonstrates how criminal actors have identified that they can make more money targeting enterprises in a way that is fairly devastating."

Pinchy Spider is best known for its GandCrab ransomware-as-a-service (RaaS) model that offers a "partnership" with its cybercrime customers, who get 60% of the profit and sometimes up to 70%.

The creators of Gandcrab call its RaaS licensing "Dashboard Essential," where newbie ransomware hackers pay $100 to infect 200 victims during a two-month period, according to a recent study by Sophos.

Chester Wisniewski, principal research scientist at Sophos, says he has seen ransom of $300,000 to $400,000 demanded by Gandcrab attackers. The creators also offer source-code licensing of the malware for $1,200. This allows buyers to make slight changes to the malware so it's undetectable by anti-malware programs, which Wisniewski says have been mostly effective at snuffing it out. "You can even replace their logo with your logo," Wisniewski says of the ransomware packaging options.

Ransomware gangs made the transition from opportunistic attacks to more targeted ones, mainly with a little help from Shodan. They typically search for ports with Remote Desktop Protocol (RDP) enabled and open, for example, he says. Then they search for RDPs in IP ranges that show business information they can use to target users in that IP. "The victim selected is slightly targeted, but they need one that belongs to an organization" they want to target, he says.

Once they gain a foothold with the first victim, they move around using standard penetration testing tools. "They act more like pen testers, not using bespoke malware but things like [Windows remote access tool] PsExec and Mimikatz to grab passwords out of memory," Wisniewski says. "They case the victim while they are in and figure out how they do backups so they can disable and delete them."

One GandCrab attack in mid-February was especially persistent: After at first failing to infect a computer in the target's network, the attackers returned to perform reconnaissance on the victim's network using legit tools Sysinternals Process Monitor, Process Hacker, and LAN Search, according to CrowdStrike, which studied the attack. On the third day of the attack, the attacker manually uninstalled the security software that was blocking its installation of GandCrab; with stolen RDP credentials, the attacker then spread GandCrab to other systems.

Silent SamSam
Meanwhile, the SamSam ransomware gang, aka Boss Spider, has been relatively quiet since the US Department of Justice handed down indictments of two of its operatives, Faramarz Shahi Savandi and Mohammed Mehdi Shah Mansouri, both Iranian citizens, for the ransomware attack against the city of Atlanta last year. "It shut down their operations in the wake of that indictment," CrowdStrike's Meyers notes.

The attackers hit some 3,800 workstations and servers with ransomware that locked the city out of its systems and incurred millions of dollars in losses. City officials did not pay the attackers the roughly $51,000 in cryptocurrency to decrypt their systems.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.