News, news analysis, and commentary on the latest trends in cybersecurity technology.
Darktrace's Brianna Leddy on How Ransomware Groups Adapt to New DefensesDarktrace's Brianna Leddy on How Ransomware Groups Adapt to New Defenses
In this Tech Talk, Darktrace's Brianna Leddy and Dark Reading's Terry Sweeney discuss ways ransomware groups adapt their activities as enterprise security teams evolve their defenses and controls.
Ransomware groups are difficult to shut down because they are constantly adapting their techniques to evade newer security defenses and controls. In this Tech Talk, Brianna Leddy, director of analysis at Darktrace, says that just because an attack group ceases operations doesn't mean they won't reemerge in a different form.
For example, researchers believe that the DarkSide group behind the ransomware attack against Colonial Pipeline returned as BlackMatter, a ransomware-as-a-service group. DarkSide shut down its operations, presumably because of investigations by law enforcement and the US federal government clawing back the ransom payments.
This past year, several affiliate groups working with the group behind REvil ransomware were arrested. Even so, the fact that a site affiliated with REvil recently started redirecting to a new site seems like an indicator that the group is back in operation.
"I don't think it's the last that we've heard of this name," Leddy says.
Rebranding can also reflect a shift in tactics, Leddy says. As more organizations are scanning networks to look for malicious traffic, more attackers are beginning to "live off the land," Leddy says. Living off the land refers to abusing legitimate administrator tools and services to blend in their malicious activities among all other normal, day-to-day network traffic. Attackers are also increasingly targeting cloud services and backup servers to make it more difficult for organizations to recover their encrypted files from the attack group.
About the Author(s)
You May Also Like
Hacking Your Digital Identity: How Cybercriminals Can and Will Get Around Your Authentication MethodsOct 26, 2023
Modern Supply Chain Security: Integrated, Interconnected, and Context-DrivenNov 06, 2023
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023