Blog
Ransomware
RESPOND
9 stages of ransomware: How AI responds at every stage
Ransomware gets its name by commandeering and holding assets ransom, extorting their owner for money in exchange for discretion and full cooperation in returning exfiltrated data and providing decryption keys to allow business to resume.
Average ransom demands are skyrocketing, rising to $5.3 million in 2021, a 518% increase from the previous year. But the cost of recovering from a ransomware attack typically far exceeds the ransom payments: the average downtime after a ransomware attack is 21 days; and 66% of ransomware victims report a significant loss of revenue following a successful attack.
In this series, we break down this huge topic step by step. Ransomware is a multi-stage problem, requiring a multi-stage solution that autonomously and effectively contains the attack at any stage. Read on to discover how Self-Learning AI and Autonomous Response stops ransomware in its tracks.
1. Initial intrusion (email)
Initial entry – the first stage of a ransomware attack – can be achieved through RDP brute-forcing (exposed Internet service), malicious websites and drive-by downloads, an insider threat with company credentials, system and software vulnerabilities, or any number of other attack vectors.
But the most common initial attack vector is email. An organization’s biggest security weakness is often their people – and attackers are good at finding ways of exploiting this. Well-researched, targeted, legitimate-looking emails are aimed at employees attempting to solicit a reaction: a click of a link, an opening of an attachment, or persuading them to divulge credentials or other sensitive information.
Gateways: Stops what has been seen before
Most conventional email tools rely on past indicators of attack to try and spot the next threat. If an email comes in from a blocklisted IP address or email domain, and uses known malware that has previously been seen in the wild, the attack may be blocked.
But the reality is, attackers know the majority of defenses take this historical approach, and so constantly update their attack infrastructure to bypass these tools. By buying new domains for a few pennies each, or creating bespoke malware with just small adaptions to the code, they can outpace and outsmart the legacy approach taken by a typical email gateway.
Real-world example: Supply chain phishing attack
By contrast, Darktrace’s evolving understanding of ‘normal’ for every email user in the organization enables it to detect subtle deviations that point to a threat – even if the sender or any malicious contents of the email are unknown to threat intelligence. This is what enabled the technology to stop an attack that recently targeted McLaren Racing, with emails sent to a dozen employees in the organization each containing a malicious link. This possible precursor to ransomware bypassed conventional email tools – largely because it was sent from a known supplier – however Darktrace recognized the account hijack and held the email back.
2. Initial intrusion (server-side)
With organizations rapidly expanding their Internet-facing perimeter, this increased attack surface has paved the way for a surge in brute-force and server-side attacks.
A number of vulnerabilities against such Internet-facing servers and systems have been disclosed this year, and for attackers, targeting and exploiting public-facing infrastructure is easier than ever – scanning the Internet for vulnerable systems is made simple with tools like Shodan or MassScan.
Attackers may also achieve initial intrusion via RDP brute-forcing or stolen credentials, with attackers often reusing legitimate credentials from previous data dumps. This has much higher precision and is less noisy than a classic brute-force attack.
A lot of ransomware attacks use RDP as an entry vector. This is part of a wider trend of ‘Living off the Land’: using legitimate off-the-shelf tools (abusing RDP, SMB1 protocol, or various command line tools WMI or Powershell) to blur detection and attribution by blending in with typical administrator activity. Ensuring that backups are isolated, configurations are hardened, and systems are patched is not enough – real-time detection of every anomalous action is needed.
Antivirus, firewalls and SIEMs
In cases of malware downloads, endpoint antivirus will detect these if, and only if, the malware has been seen and fingerprinted before. Firewalls typically require configuration on a per-organization basis, and often need to be modified based on the needs of the business. If the attack hits the firewall where a rule or signature does not match it, again, it will bypass the firewall.
SIEM and SOAR tools also look for known malware being downloaded, leverage pre-programmed rules and use pre-programmed responses. While these tools do look for patterns, these patterns are defined in advance, and this approach relies on a new attack to have sufficiently similar traits to attacks that have been seen before.
Real-world example: Dharma ransomware
Darktrace detected a targeted Dharma ransomware attack against a UK organization exploiting an open RDP connection through Internet-facing servers. The RDP server began receiving a large number of incoming connections from rare IP addresses on the Internet. It is highly likely that the RDP credential used in this attack had been compromised at a previous stage – either via common brute-force methods, credential stuffing attacks, or phishing. Indeed, a technique growing in popularity is to buy RDP credentials on marketplaces and skip to initial access.
Figure 2: The model breaches that fired over the course of this attack, including anomalous RDP activity
Unfortunately, in this case, without Autonomous Response installed, the Dharma ransomware attack continued until its final stages, where the security team were forced into the heavy-handed and disruptive action of pulling the plug on the RDP server midway through encryption.
3. Establish foothold and C2
Whether through a successful phish, a brute-force attack, or some other method, the attacker is in. Now, they make contact with the breached device(s) and establish a foothold.
This stage allows attackers to control subsequent stages of the attack remotely. During these command and control (C2) communications, further malware may also pass from the attacker to the devices. This helps them to establish an even greater foothold within the organization and readies them for lateral movement.
Attackers can adapt malware functionality with an assortment of ready-made plug-ins, allowing them to lie low inside the business undetected. More modern and sophisticated ransomware is able to adapt by itself to the surrounding environment, and operate autonomously, blending in to regular activity even when cut off from its command and control server. These ‘self-sufficient’ ransomware strains pose a big problem for traditional defenses reliant on stopping threats solely on the grounds of its malicious external connections.
Viewing connections in isolation vs understanding the business
Conventional security tools like IDS and firewalls tend to look at connections in isolation rather than in the context of previous and potentially relevant connections, making command and control very difficult to spot.
IDS and firewalls may block ‘known-bad’ domains or use some geo-blocking, but this is where an attacker would likely leverage new infrastructure.
These tools also don’t tend to analyze for things like the periodicity, such as whether a connection is beaconing at a regular or irregular interval, or the age and rarity of the domain in the context of the environment.
With Darktrace’s evolving understanding of the digital enterprise, suspicious C2 connections and the downloads which follow them are spotted, even when conducted using regular programs or methods. The AI technology correlates multiple subtle signs of threat – a small subset of which includes anomalous connections to young and/or unusual endpoints, anomalous file downloads, incoming remote desktop, and unusual data uploads and downloads.
Once they are detected as a threat, Darktrace RESPOND halts these connections and downloads, while allowing normal business activity to continue.
Real-world example: WastedLocker attack
When a WastedLocker ransomware attack hit a US agricultural organization, Darktrace immediately detected the initial unusual SSL C2 activity (based on a combination of destination rarity, JA3 unusualness and frequency analysis). Antigena (on this occasion configured in passive mode, and therefore not granted permission to take autonomous action) suggested instantly blocking the C2 traffic on port 443 and parallel internal scanning on port 135.
When beaconing was later observed to bywce.payment.refinedwebs[.]com, this time over HTTP to /updateSoftwareVersion, Antigena escalated its response by blocking the further C2 channels.
4. Lateral movement
Once an attacker has established a foothold within an organization, they begin to increase their knowledge of the wider digital estate and their presence within it. This is how they will find and access the files which they will ultimately attempt to exfiltrate and encrypt. It begins reconnaissance: scanning the network; building up a picture of its component devices; identifying the location of the most valuable assets.
Then the attacker begins moving laterally. They infect more devices and look to escalate their privileges – for instance, by obtaining admin credentials – thereby increasing their control over the environment. Once they have obtained authority and presence within the digital estate, they can progress to the final stages of the attack.
Modern ransomware has built-in functions that allow it to search automatically for stored passwords and spread through the network. More sophisticated strains are designed to build themselves differently in different environments, so the signature is constantly changing and it’s harder to detect.
Legacy tools: A blunt response to known threats
Because they rely upon static rules and signatures, legacy solutions struggle to prevent lateral movement and privilege escalation without also impeding essential business operations. Whilst in theory, an organization leveraging firewalls and NAC internally with proper network segmentation and a perfect configuration could prevent cross-network lateral movement, maintaining a perfect balance between protective and disruptive controls is near impossible.
Some organizations rely on Intrusion Prevent Systems (IPS) to deny network traffic when known threats are detected in packets, but as with previous stages, novel malware will evade detection, and this requires the database to be constantly updated. These solutions also sit at the ingress/egress points, limiting their network visibility. An Intrusion Detection System (IDS) may sit out-of-line, but doesn’t have response capabilities.
A self-learning approach
Darktrace’s AI learns ‘self’ for the organization, enabling it to detect suspicious activity indicative of lateral movement, regardless of whether the attacker uses new infrastructure or ‘lives off the land’. Potential unusual activity that Darktrace detects includes unusual scanning activity, unusual SMB, RDP, and SSH activity. Other models that fire at this stage include:
- Suspicious Activity on High-Risk Device
- Numeric EXE in SMB Write
- New or Uncommon Service Control
Autonomous Response then takes targeted action to stop the threat at this stage, blocking anomalous connections, enforcing the infected device’s ‘pattern of life’, or enforcing the group ‘pattern of life’ – automatically clustering devices into peer groups and preventing a device from doing anything its peer group hasn’t done.
Where malicious behavior persists, and only if necessary, Darktrace will quarantine an infected device.
Real-world example: Unusual chain of RDP connections
At an organization in Singapore, one compromised server led to the creation of a botnet, which began moving laterally, predominantly by establishing chains of unusual RDP connections. The server then started making external SMB and RPC connections to rare endpoints on the Internet, in an attempt to find further vulnerable hosts.
Other lateral movement activities detected by Darktrace included the repeated failing attempts to access multiple internal devices over the SMB file-sharing protocol with a range of different usernames, implying brute-force network access attempts.
5. Data exfiltration
In the past, ransomware was simply about encrypting an operating system and network files.
In a modern attack, as organizations insure against malicious encryption by becoming increasingly diligent with data backups, threat actors have moved towards ‘double extortion’, where they exfiltrate key data and destroy backups before the encryption takes place. Exfiltrated data is used to blackmail organizations, with attackers threatening to publish sensitive information online or sell it on to the organization’s competitors if they are not paid.
Modern ransomware variants also look for cloud file storage repositories such as Box, Dropbox, and others.
Many of these incidents aren’t public, because if IP is stolen, organizations are not always legally required to disclose it. However, in the case of customer data, organizations are obligated by law to disclose the incident and face the additional burden of compliance files – and we’ve seen these mount in recent years (Marriot, $23.8 million; British Airways, $26 million; Equifax, $575 million). There’s also the reputational blow associated with having to inform customers that a data breach has occurred.
Legacy tools: The same old story
For those that have been following, the narrative by now will sound familiar: to stop a ransomware attack at this stage, most defenses rely on either pre-programmed definitions of 'bad' or have rules constructed to combat different scenarios put organizations in a risky, never-ending game of cat and mouse.
A firewall and proxy might block connections based on pre-programmed policies based on specific endpoints or data volumes, but it’s likely an attacker will ‘live off the land’ and utilize a service that is generally allowed by the business.
The effectiveness of these tools will vary according to data volumes: they might be effective for ‘smash and grab’ attacks using known malware, and without employing any defense evasion techniques, but are unlikely to spot ‘low and slow’ exfiltration and novel or sophisticated strains.
On the other hand, because by nature it involves a break from expected behavior, even less conspicuous, low and slow data exfiltration is detected by Darktrace and stopped with Darktrace RESPOND. No confidential files are lost, and attackers are unable to extort a ransom payment through blackmail.
Real-world example: Unusual chain of RDP connections
It becomes more difficult to find examples of Darktrace RESPOND stopping ransomware at these later stages, as the threat is usually contained before it gets this far. This is the double-edged sword of effective security – early containment makes for bad storytelling! However, we can see the effects of a double extortion ransomware attack on an energy company in Canada. The organization had the Enterprise Immune System but no Antigena, and without anyone actively monitoring Darktrace’s AI detections, the attack was allowed to unfold.
The attacker managed to connect to an internal file server and download 1.95TB of data. The device was also seen downloading Rclone software – an open-source tool, which was likely applied to sync data automatically to the legitimate file storage service pCloud. Following the completion of the data exfiltration, the device ‘serverps’ finally began encrypting files on 12 devices with the extension *.06d79000. As with the majority of ransomware incidents, the encryption happened outside of office hours – overnight in local time – to minimize the chance of the security team responding quickly.
Read the full details of the attack
It should be noted that the exact order of the stages 3–5 above is not set in stone, and varies according to attack. Sometimes data is exfiltrated and then there is further lateral movement, and additional C2 beaconing. This entire period is known as the ‘dwell time’. Sometimes it takes place over only a few days, other times attackers may persist for months, slowly gathering more intel and exfiltrating data in a ‘low and slow’ fashion so as to avoid detection from rule-based tools that are configured to flag any single data transfer over a certain threshold. Only through a holistic understanding of malicious activity over time can a technology spot this level of activity and allow the security team to remove the threat before it reaches the latter and most damaging stages of ransomware.
6. Data encryption
Using either symmetric encryption, asymmetric encryption, or a combination of the two, attackers attempt to render as much data unusable in the organization’s network as they can before the attack is detected.
As the attackers alone have access to the relevant decryption keys, they are now in total control of what happens to the organization’s data.
Pre-programmed response and disruption
There are many families of tools that claim to stop encryption in this manner, but each contain blind spots which enable a sophisticated attacker to evade detection at this crucial stage. Where they do take action, it is often highly disruptive, causing major shutdowns and preventing a business from continuing its usual operations.
Internal firewalls prevent clients from accessing servers, so once an attacker has penetrated to servers using any of the techniques outlined above, they have complete freedom to act as they want.
Similarly, antivirus tools look only for known malware. If the malware has not been detected until this point, it is highly unlikely the antivirus will act here.
Stopping encryption autonomously
Even if familiar tools and methods are used to conduct it, Autonomous Response can enforce the normal ‘pattern of life’ for devices attempting encryption, without using static rules or signatures. This action can be taken independently or via integrations with native security controls, maximizing the return on other security investments. With a targeted Autonomous Response, normal business operations can continue while encryption is prevented.
7. Ransom note
It is important to note that in the stages before encryption, this ransomware attack is not yet “ransomware”. Only at this stage does it gets its name.
A ransom note is deployed. The attackers request payment in return for a decryption key and threaten the release of sensitive exfiltrated data. The organization must decide whether to pay the ransom or lose their data, possibly to their competition or the public. The average demand made by ransomware threat actors rose in 2021 to $5.3 million, with meat processing company JBS paying out $11 million and DarkSide receiving over $90 million in Bitcoin payments following the Colonial Pipeline incident.
All of the stages up until this point represent a typical, traditional ransomware attack. But ransomware is shifting from indiscriminate encryption of devices to attackers targeting business disruption in general, using multiple techniques to hold their victims to ransom. Additional methods of extortion include not only data exfiltration, but corporate domain hijack, deletion or encryption of backups, attacks against systems close to industrial control systems, targeting company VIPs… the list goes on.
Sometimes, attackers will just skip straight from stage 2 to 6 and jump straight to extortion. Darktrace recently stopped an email attack which showed an attacker bypassing the hard work and attempting to jump straight to extortion in an email. The attacker claimed to have compromised the organization’s sensitive data, requesting payment in bitcoin for its same return. Whether or not the claims were true, this attack shows that encryption is not always necessary for extortion, and this type of harassment exists in multiple forms.
As with the email example we explored in the first post of this series, Darktrace/Email was able to step in and stop this email where other email tools would have let it through, stopping this potentially costly extortion attempt.
Whether through encryption or some other kind of blackmail, the message is the same every time. Pay up, or else. At this stage, it’s too late to start thinking about any of the options described above that were available to the organization, that would have stopped the attack in its earliest stages. There is only one dilemma. “To pay or not to pay” – that is the question.
Often, people believe their payment troubles are over after the ransom payment stage, but unfortunately, it’s just beginning to scratch the surface…
8. Clean-up
Efforts are made to try to secure the vulnerabilities which allowed the attack to happen initially – the organization should be conscious that approximately 80% of ransomware victims will in fact be targeted again in the future.
Legacy tools largely fail to shed light on the vulnerabilities which allowed the initial breach. Like searching for a needle in an incomplete haystack, security teams will struggle to find useful information within the limited logs offered by firewalls and IDSs. Antivirus solutions may reveal some known malware but fail to spot novel attack vectors.
With Darktrace’s Cyber AI Analyst, organizations are given full visibility over every stage of the attack, across all coverage areas of their digital estate, taking the mystery out of ransomware attacks. They are also able to see the actions that would have been taken to halt the attack by Darktrace RESPOND.
9. Recovery
The organization begins attempts to return its digital environment to order. Even if it has paid for a decryption key, many files may remain encrypted or corrupted. Beyond the costs of the ransom payment, network shutdowns, business disruption, remediation efforts, and PR setbacks all incur hefty financial losses.
The victim organization may also suffer additional reputation costs, with 66% of victims reporting a significant loss of revenue following a ransomware attack, and 32% reporting losing C-level talent as a direct result from ransomware.
Conclusion
While the high-level stages described above are common in most ransomware attacks, the minute you start looking at the details, you realize every ransomware attack is different.
As many targeted ransomware attacks come through ransomware affiliates, the Tools, Techniques and Procedures (TTPs) displayed during intrusions vary widely, even when the same ransomware malware is used. This means that even comparing two different ransomware attacks using the same ransomware family, you are likely to encounter completely different TTPs. This makes it impossible to predict what tomorrow’s ransomware will look like.
This is the nail in the coffin for traditional tooling which is based on historic attack data. The above examples demonstrate that Self-Learning technology and Autonomous Response is the only solution that stops ransomware at every stage, across email and network.
Like this and want more?
More in this series
Blog
Darktrace/Email in Action: Why AI-Driven Email Security is the Best Defense Against Sustained Phishing Campaigns
_11zon.jpg)
Stopping the bad while allowing the good
Since its inception, email has been regarded as one of the most important tools for businesses, revolutionizing communication and allowing global teams to become even more connected. But besides organizations heavily relying on email for their daily operations, threat actors have also recognized that the inbox is one of the easiest ways to establish an initial foothold on the network.
Today, not only are phishing campaigns and social engineering attacks becoming more prevalent, but the level of sophistication of these attacks are also increasing with the help of generative AI tools that allow for the creation of hyper-realistic emails with minimal errors, effectively lowering the barrier to entry for threat actors. These diverse and stealthy types of attacks evade traditional email security tools based on rules and signatures, because they are less likely to contain the low-sophistication markers of a typical phishing attack.
In a situation where the sky is the limit for attackers and security teams are lean, how can teams equip themselves to tackle these threats? How can they accurately detect increasingly realistic malicious emails and neutralize these threats before it is too late? And importantly, how can email security block these threats while allowing legitimate emails to flow freely?
Instead of relying on past attack data, Darktrace’s Self-Learning AI detects the slightest deviation from a user’s pattern of life and responds autonomously to contain potential threats, stopping novel attacks in their tracks before damage is caused. It doesn’t define ‘good’ and ‘bad’ like traditional email tools, rather it understands each user and what is normal for them – and what’s not.
This blog outlines how Darktrace/Email™ used its understanding of ‘normal’ to accurately detect and respond to a sustained phishing campaign targeting a real-life company.
Responding to a sustained phishing attack
Over the course of 24 hours, Darktrace detected multiple emails containing different subjects, all from different senders to different recipients in one organization. These emails were sent from different IP addresses, but all came from the same autonomous system number (ASN).
The emails themselves had many suspicious indicators. All senders had no prior association with the recipient, and the emails generated a high general inducement score. This score is generated by structural and non-specific content analysis of the email – a high score indicates that the email is trying to induce the recipient into taking a particular action, which may lead to account compromise.
Additionally, each email contained a visually prominent link to a file storage service, hidden behind a shortened bit.ly link. The similarities across all these emails pointed to a sustained campaign targeting the organization by a single threat actor.
With all these suspicious indicators, many models were breached. This drove up the anomaly score, causing Darktrace/Email to hold all suspicious emails from the recipients’ inboxes, safeguarding the recipients from potential account compromise and disallowing the threats from taking hold in the network.
Imagining a phishing attack without Darktrace/Email
So what could have happened if Darktrace had not withheld these emails, and the recipients had clicked on the links? File storage sites have a wide variety of uses that allow attackers to be creative in their attack strategy. If the user had clicked on the shortened link, the possible consequences are numerous. The link could have led to a login page for unsuspecting victims to input their credentials, or it could have hosted malware that would automatically download if the link was clicked. With the compromised credentials, threat actors could even bypass MFA, change email rules, or gain privileged access to a network. The downloaded malware might also be a keylogger, leading to cryptojacking, or could open a back door for threat actors to return to at a later time.
The limits of traditional email security tools
Secure email gateways (SEGs) and static AI security tools may have found it challenging to detect this phishing campaign as malicious. While Darktrace was able to correlate these emails to determine that a sustained phishing campaign was taking place, the pattern among these emails is far too generic for specific rules as set in traditional security tools. If we take the characteristic of the freemail account sender as an example, setting a rule to block all emails from freemail accounts may lead to more legitimate emails being withheld, since these addresses have a variety of uses.
With these factors in mind, these emails could have easily slipped through traditional security filters and led to a devastating impact on the organization.
Conclusion
As threat actors step up their attacks in sophistication, prioritizing email security is more crucial than ever to preserving a safe digital environment. In response to these challenges, Darktrace/Email offers a set-and-forget solution that continuously learns and adapts to changes in the organization.
Through an evolving understanding of every environment in which it is deployed, its threat response becomes increasingly precise in neutralizing only the bad, while allowing the good – delivering email security that doesn’t come at the expense of business growth.
Blog
Inside the SOC
Black Basta: Old Dogs with New Tricks
What is Black Basta?
Over the past year, security researchers have been tracking a new ransomware group, known as Black Basta, that has been observed targeted organizations worldwide to deploy double extortion ransomware attacks since early 2022. While the strain and group are purportedly new, evidence seen suggests they are an offshoot of the Conti ransomware group [1].
The group behind Black Basta run a Ransomware as a Service (RaaS) model. They work with initial access brokers who will typically already have a foothold in company infrastructure to begin their attacks. Once inside a network, they then pivot internally using numerous tools to further their attack.
Black Basta Ransomware
Like many other ransomware actors, Black Basta uses double extortion as part of its modus operandi, exfiltrating sensitive company data and using the publication of this as a second threat to affected companies. This is also advertised on a dark web site, setup by the group to apply further pressure for affected companies to make ransom payments and avoid reputational damage.
The group also seems to regularly take advantage of existing tools to undertake the earlier stages of their attacks. Notably, the Qakbot banking trojan, seems to be the malware often used to gain an initial foothold within compromised environments.
Analysis of the tools, procedures and infrastructure used by Black Basta belies a maturity to the actors behind the ransomware. Their models and practices suggest those involved are experienced individuals, and security researchers have drawn possible links to the Conti ransomware group.
As such, Black Basta is a particular concern for security teams as attacks will likely be more sophisticated, with attackers more patient and able to lie low on digital estates for longer, waiting for the opportune moment to strike.
Cyber security is an infinite game where defender and attacker are stuck as cat and mouse; as new attacks evolve, security vendors and teams respond to the new indicators of compromise (IoCs), and update their existing rulesets and lists. As a result, attackers are forced to change their stripes to evade detection or sometimes even readjust their targets and end goals.
Anomaly Based Detection
By using the power of Darktrace’s Self-Learning AI, security teams are able to detect deviations in behavior. Threat actors need to move through the kill chain to achieve their aims, and in doing so will cause affected devices within networks to deviate from their expected pattern of life. Darktrace’s anomaly-based approach to threat detection allows it recognize these subtle deviations that indicate the presence of an attacker, and stop them in their tracks.
Additionally, the ecosystem of cyber criminals has matured in the last few decades. It is well documented how many groups now operate akin to legitimate companies, with structure, departments and governance. As such, while new attack methods and tactics do appear in the wild, the maturity in their business models belie the experience of those behind the attack.
As attackers grow their business models and develop their arsenal of attack vectors, it becomes even more critical for security teams to remain vigilant to anomalies within networks, and remain agnostic to underlying IoCs and instead adopt anomaly detection tools able to identify tactics, techniques, and procedures (TTPs) that indicate attackers may be moving through a network, ahead of deployment of ransomware and data encryption.
Darktrace’s Coverage of Black Basta
In April 2023, the Darktrace Security Operations Center (SOC) assisted a customer in triaging and responding to an ongoing ransomware infection on their network. On a Saturday, the customer reached out directly to the Darktrace analyst team via the Ask the Expert service for support after they observed encrypted files and locked administrative accounts on their network. The analyst team were able to investigate and clarify the attack path, identifying affected devices and assisting the customer with their remediation. Darktrace DETECT™ observed varying IoCs and TTPs throughout the course of this attack’s kill chain; subsequent analysis into these indicators revealed this had likely been a case of Black Basta seen in the wild.
Initial Intrusion
The methods used by the group to gain an initial foothold in environments varies – sometimes using phishing, sometimes gaining access through a common vulnerability exposed to the internet. Black Basta actors appear to target specific organizations, as opposed to some groups who aim to hit multiple at once in a more opportunistic fashion.
In the case of the Darktrace customer likely affected by Black Basta, it is probable that the initial intrusion was out of scope. It may be that the path was via a phishing email containing an Microsoft Excel spreadsheet that launches malicious powershell commands; a noted technique for Black Basta. [3][4] Alternatively, the group may have worked with access brokers who already had a foothold within the customer’s network.
One particular device on the network was observed acting anomalously and was possibly the first to be infected. The device attempted to connect to multiple internal devices over SMB, and connected to a server that was later found to be compromised and is described throughout the course of this blog. During this connection, it wrote a file over SMB, “syncro.exe”, which is possibly a legitimate Remote Management software but could in theory be used to spread an infection laterally. Use of this tool otherwise appears sporadic for the network, and was notably unusual for the environment.
Given these timings, it is possible this activity is related to the likely Black Basta compromise. However, there is some evidence online that use of Syncro has been seen installed as part of the execution of loaders such as Batloader, potentially indicating a separate or concurrent attack [5].
Internal Reconnaissance + Lateral Movement
However the attackers gained access in this instance, the first suspicious activity observed by Darktrace originated from an infected server. The attacker used their foothold in the device to perform internal reconnaissance, enumerating large portions of the network. Darktrace DETECT’s anomaly detection noted a distinct rise in connections to a large number of subnets, particularly to closed ports associated with native Windows services, including:
- 135 (RPC)
- 139 (NetBIOS)
- 445 (SMB)
- 3389 (RDP)
During the enumeration, SMB connections were observed during which suspiciously named executable files were written:
- delete.me
- covet.me
Data Staging and Exfiltration
Around 4 hours after the scanning activity, the attackers used their knowledge gained during enumeration about the environment to begin gathering and staging data for their double extortion attempts. Darktrace observed the same infected server connecting to a file storage server, and downloading over 300 GiB of data. Darktrace DETECT identified that the connections had been made via SMB and was able to present a list of filenames to the customer, allowing their security team to determine the data that had likely been exposed to the attackers.
The SMB paths detected by Darktrace showed a range of departments’ file areas being accessed by threat actors. This suggests they were interested in getting as much varied data as possible, presumably in an attempt to ensure a large amount of valuable information was at their disposal to make any threats of releasing them more credible, and more damaging to the company.
Shortly after the download, the device made an external connection over SSH to a rare domain, dataspt[.]com, hosted in the United States. The connection itself was made over an unusual port, 2022, and Darktrace recognized that the domain was new for the network.
During this upload, the threat actors uploaded a similar volume of data to the 300GiB that had been downloaded internally earlier. Darktrace flagged the usual elements of this external upload, making the identification and triage of this exfiltration attempt easier for the customer.
On top of this, Darktrace’s autonomous investigation tool Cyber AI Analyst™ launched an investigation into this on-going activity and was able to link the external upload events to the internal download, identifying them as one exfiltration incident rather than two isolated events. AI Analyst then provided a detailed summary of the activity detected, further speeding up the identification of affected files.
Preparing for Exploitation
All the activity documented so far had occurred on a Wednesday evening. It was at this point that the burst of activity calmed, and the ransomware lay in wait within the environment. Other devices around the network, particularly those connected to by the original infected server and a domain controller, were observed performing some elements of anomalous activity, but the attack seemed to largely take a pause.
However, on the Saturday morning, 3 days later, the compromised server began to change the way it communicated with attackers by reaching out to a new command and control (C2) endpoint. It seemed that attackers were gearing up for their attack, taking advantage of the weekend to strike while security teams often run with a reduced staffing.
Darktrace identified connections to a new endpoint within 4 minutes of it first being seen on the customer’s environment. The server had begun making repeated SSL connections to the new external endpoint, faceappinc[.]com, which has been flagged as malicious by various open-source intelligence (OSINT) sources.
The observed JA3 hash (d0ec4b50a944b182fc10ff51f883ccf7) suggests that the command-line tool BITS Admin was being used to launch these connections, another suggestion of the use of mature tooling.
In addition to this, Darktrace also detected the server using an administrative credential it had never previously been associated with. Darktrace recognized that the use of this credential represented a deviation from the device’s usual activity and thus could be indicative of compromise.
The server then proceeded to use the new credential to authenticate over Keberos before writing a malicious file (“management.exe”) to the Temp directory on a number of internal devices.
Encryption
At this point, the number of anomalous activities detected from the server increased massively as the attacker seems to connect networkwide in an attempt to cause as quick and destructive an encryption effort as possible. Darktrace observed numerous files that had been encrypted by a local process. The compromised server began to write ransom notes, named “instructions_read_me.txt” to other file servers, which presumably also had successfully deployed payloads. While Black Basta actors had initially been observed dropping ransom notes named “readme.txt”, security researchers have since observed and reported an updated variant of the ransomware that drops “instructions_read_me_.txt”, the name of the file detected by Darktrace, instead [6].
Another server was also observed making repeated SSL connections to the same rare external endpoint, faceappinc[.]com. Shortly after beginning these connections, the device made an HTTP connection to a rare IP address with no hostname, 212.118.55[.]211. During this connection, the device also downloaded a suspicious executable file, cal[.]linux. OSINT research linked the hash of this file to a Black Basta Executable and Linkable File (ELF) variant, indicating that the group was highly likely behind this ransomware attack.
Of particular interest again, is how the attacker lives off the land, utilizing pre-installed Windows services. Darktrace flagged that the server was observed using PsExec, a remote management executable, on multiple devices.
Darktrace Assistance
Darktrace DETECT was able to clearly detect and provide visibility over all stages of the ransomware attack, alerting the customer with multiple model breaches and AI Analyst investigation(s) and highlighting suspicious activity throughout the course of the attack.
For example, the exfiltration of sensitive data was flagged for a number of anomalous features of the meta-data: volume; rarity of the endpoint; port and protocol used.
In total, the portion of the attack observed by Darktrace lasted about 4 days from the first model breach until the ransomware was deployed. In particular, the encryption itself was initiated on a Saturday.
The encryption event itself was initiated on a Saturday, which is not uncommon as threat actors tend to launch their destructive attacks when they expect security teams will be at their lowest capacity. The Darktrace SOC team regularly observes and assists in customer’s in the face of ransomware actors who patiently lie in wait. Attackers often choose to strike as security teams run on reduced hours of manpower, sometimes even choosing to deploy ahead of longer breaks for national or public holidays, for example.
In this case, the customer contacted Darktrace directly through the Ask the Expert (ATE) service. ATE offers customers around the clock access to Darktrace’s team of expert analysts. Customers who subscribe to ATE are able to send queries directly to the analyst team if they are in need of assistance in the face of suspicious network activity or emerging attacks.
In this example, Darktrace’s team of expert analysts worked in tandem with Cyber AI Analyst to investigate the ongoing compromise, ensuring that the investigation and response process were completed as quickly and efficiently as possible.
Thanks to Darktrace’s Self-Learning AI, the analyst team were able to quickly produce a detailed report enumerating the timeline of events. By combining the human expertise of the analyst team and the machine learning capabilities of AI Analyst, Darktrace was able to quickly identify anomalous activity being performed and the affected devices. AI Analyst was then able to collate and present this information into a comprehensive and digestible report for the customer to consult.
Conclusion
It is likely that this ransomware attack was undertaken by the Black Basta group, or at least using tools related to their method. Although Black Basta itself is a relatively novel ransomware strain, there is a maturity and sophistication to its tactics. This indicates that this new group are actually experienced threat actors, with evidence pointing towards it being an offshoot of Conti.
The Pyramid of Pain is a well trodden model in cyber security, but it can help us understand the various features of an attack. Indicators like static C2 destinations or file hashes can easily be changed, but it’s the underlying TTPs that remain the same between attacks.
In this case, the attackers used living off the land techniques, making use of tools such as BITSAdmin, as well as using tried and tested malware such as Qakbot. While the domains and IPs involved will change, the way these malware interact and move about systems remains the same. Their fingerprint therefore causes very similar anomalies in network traffic, and this is where the strength of Darktrace lies.
Darktrace’s anomaly-based approach to threat detection means that these new attack types are quickly drawn out of the noise of everyday traffic within an environment. Once attackers have gained a foothold in a network, they will have to cause deviation from the usual pattern of a life on a network to proceed; Darktrace is uniquely placed to detect even the most subtle changes in a device’s behavior that could be indicative of an emerging threat.
Machine learning can act as a force multiplier for security teams. Working hand in hand with the Darktrace SOC, the customer was able to generate cohesive and comprehensive reporting on the attack path within days. This would be a feat for humans alone, requiring significant resources and time, but with the power of Darktrace’s Self-Learning AI, these deep and complex analyses become as easy as the click of a button.
Credit to: Matthew John, Director of Operations, SOC, Paul Jennings, Principal Analyst Consultant
Appendices
Darktrace DETECT Model Breaches
Internal Reconnaissance
Device / Multiple Lateral Movement Model Breaches
Device / Large Number of Model Breaches
Device / Network Scan
Device / Anomalous RDP Followed by Multiple Model Breaches
Device / Possible SMB/NTLM Reconnaissance
Device / SMB Lateral Movement
Anomalous Connection / SMB Enumeration
Anomalous Connection / Possible Share Enumeration Activity
Device / Suspicious SMB Scanning Activity
Device / RDP Scan
Anomalous Connection / Active Remote Desktop Tunnel
Device / Increase in New RPC Services
Device / ICMP Address Scan
Download and Upload
Unusual Activity / Enhanced Unusual External Data Transfer
Unusual Activity / Unusual External Data Transfer
Anomalous Connection / Uncommon 1 GiB Outbound
Anomalous Connection / Data Sent to Rare Domain
Anomalous Connection / Download and Upload
Compliance / SSH to Rare External Destination
Anomalous Server Activity / Rare External from Server
Anomalous Server Activity / Outgoing from Server
Anomalous Connection / Application Protocol on Uncommon Port
Anomalous Connection / Multiple Connections to New External TCP Port
Device / Anomalous SMB Followed By Multiple Model Breaches
Unusual Activity / SMB Access Failures
Lateral Movement and Encryption
User / New Admin Credentials on Server
Compliance / SMB Drive Write
Device / Anomalous RDP Followed By Multiple Model Breaches
Anomalous Connection / High Volume of New or Uncommon Service Control
Anomalous Connection / New or Uncommon Service Control
Device / New or Unusual Remote Command Execution
Anomalous Connection / SMB Enumeration
Additional Beaconing and Tooling
Device / Initial Breach Chain Compromise
Device / Multiple C2 Model Breaches
Compromise / Large Number of Suspicious Failed Connections
Compromise / Sustained SSL or HTTP Increase
Compromise / SSL or HTTP Beacon
Compromise / Suspicious Beaconing Behavior
Compromise / Large Number of Suspicious Successful Connections
Compromise / High Volume of Connections with Beacon Score
Compromise / Slow Beaconing Activity To External Rare
Compromise / SSL Beaconing to Rare Destination
Compromise / Beaconing Activity To External Rare
Compromise / Beacon to Young Endpoint
Compromise / Agent Beacon to New Endpoint
Anomalous Server Activity / Rare External from Server
Anomalous Connection / Multiple Failed Connections to Rare Endpoint
Anomalous File / EXE from Rare External Location
IoC - Type - Description + Confidence
dataspt[.]com - Hostname - Highly Likely Exfiltration Server
46.22.211[.]151:2022 - IP Address and Unusual Port - Highly Likely Exfiltration Server
faceappinc[.]com - Hostname - Likely C2 Infrastructure
Instructions_read_me.txt - Filename - Almost Certain Ransom Note
212.118.55[.]211 - IP Address - Likely C2 Infrastructure
delete[.]me - Filename - Potential lateral movement script
covet[.]me - Filename - Potential lateral movement script
d0ec4b50a944b182fc10ff51f883ccf7 - JA3 Client Fingerprint - Potential Windows BITS C2 Process
/download/cal.linux - URI - Likely BlackBasta executable file
1f4dcfa562f218fcd793c1c384c3006e460213a8 - Sha1 File Hash - Likely BlackBasta executable file
References
[1] https://blogs.blackberry.com/en/2022/05/black-basta-rebrand-of-conti-or-something-new
[2] https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and-the-black-basta-ransomware-group-targeting-u.s.-companies
[4] https://unit42.paloaltonetworks.com/atoms/blackbasta-ransomware/
[6] https://www.pcrisk.com/removal-guides/23666-black-basta-ransomware