Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/14/2019
06:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Ransomware's New Normal

GandCrab's evolution underscores a shift in ransomware attack methods.

Don't be fooled by the drop in overall ransomware attacks this past year: Fewer but more targeted and lucrative campaigns against larger organizations are the new MO for holding data hostage.

While the number of ransomware attacks dropped 91% in the past year, according to data from Trend Micro, at the same time some 75% of organizations stockpiled cryptocurrency. The majority that did also paid their attackers the ransom, according to a Code42 study. Overall, more than 80% of ransomware infections over the past year were at enterprises, as cybercrime gangs began setting their sights on larger organizations capable of paying bigger ransom amounts than the random victim or consumer.

The evolution of the prolific GandCrab ransomware over the past few months demonstrates how this new generation of more selective attacks is more profitable to the cybercriminals using it - and underscores how the ransomware threat is far from over.

"[Ransomware is] not going anywhere anytime soon," says Adam Meyers, vice president of intelligence at CrowdStrike. "A few years ago, there was DDoS extortion ... it went away when no one was paying. But here they are doing ransomware attacks and making good on their demands."

Meyers says CrowdStrike recently added the GandCrab gang - which it calls Pinchy Spider - as the newest cybercrime group on its watch list of four groups attacking so-called "big game" targets and demanding anywhere from hundreds of thousands to millions of dollars in ransom to unlock their data. The other three cybercrime groups hacking bigger targets with ransomware are Boss Spider, the group behind SamSam; Indrik Spider, the group behind BitPaymer; and Grim Spider, which deploys Ryuk.

"They come in very much like a targeted intrusion attack by China or Iran [nation-states] would. They move laterally and deploy ransomware far and wide across the enterprise, charging a much higher ransom," Meyers explains. "It's an evolution in how ransomware is deployed, and it demonstrates how criminal actors have identified that they can make more money targeting enterprises in a way that is fairly devastating."

Pinchy Spider is best known for its GandCrab ransomware-as-a-service (RaaS) model that offers a "partnership" with its cybercrime customers, who get 60% of the profit and sometimes up to 70%.

The creators of Gandcrab call its RaaS licensing "Dashboard Essential," where newbie ransomware hackers pay $100 to infect 200 victims during a two-month period, according to a recent study by Sophos.

Chester Wisniewski, principal research scientist at Sophos, says he has seen ransom of $300,000 to $400,000 demanded by Gandcrab attackers. The creators also offer source-code licensing of the malware for $1,200. This allows buyers to make slight changes to the malware so it's undetectable by anti-malware programs, which Wisniewski says have been mostly effective at snuffing it out. "You can even replace their logo with your logo," Wisniewski says of the ransomware packaging options.

Ransomware gangs made the transition from opportunistic attacks to more targeted ones, mainly with a little help from Shodan. They typically search for ports with Remote Desktop Protocol (RDP) enabled and open, for example, he says. Then they search for RDPs in IP ranges that show business information they can use to target users in that IP. "The victim selected is slightly targeted, but they need one that belongs to an organization" they want to target, he says.

Once they gain a foothold with the first victim, they move around using standard penetration testing tools. "They act more like pen testers, not using bespoke malware but things like [Windows remote access tool] PsExec and Mimikatz to grab passwords out of memory," Wisniewski says. "They case the victim while they are in and figure out how they do backups so they can disable and delete them."

One GandCrab attack in mid-February was especially persistent: After at first failing to infect a computer in the target's network, the attackers returned to perform reconnaissance on the victim's network using legit tools Sysinternals Process Monitor, Process Hacker, and LAN Search, according to CrowdStrike, which studied the attack. On the third day of the attack, the attacker manually uninstalled the security software that was blocking its installation of GandCrab; with stolen RDP credentials, the attacker then spread GandCrab to other systems.

Silent SamSam
Meanwhile, the SamSam ransomware gang, aka Boss Spider, has been relatively quiet since the US Department of Justice handed down indictments of two of its operatives, Faramarz Shahi Savandi and Mohammed Mehdi Shah Mansouri, both Iranian citizens, for the ransomware attack against the city of Atlanta last year. "It shut down their operations in the wake of that indictment," CrowdStrike's Meyers notes.

The attackers hit some 3,800 workstations and servers with ransomware that locked the city out of its systems and incurred millions of dollars in losses. City officials did not pay the attackers the roughly $51,000 in cryptocurrency to decrypt their systems.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17545
PUBLISHED: 2019-10-14
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVE-2019-17546
PUBLISHED: 2019-10-14
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2019-17547
PUBLISHED: 2019-10-14
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CVE-2019-17501
PUBLISHED: 2019-10-14
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen).
CVE-2019-17539
PUBLISHED: 2019-10-14
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.