Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/14/2019
06:45 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Ransomware's New Normal

GandCrab's evolution underscores a shift in ransomware attack methods.

Don't be fooled by the drop in overall ransomware attacks this past year: Fewer but more targeted and lucrative campaigns against larger organizations are the new MO for holding data hostage.

While the number of ransomware attacks dropped 91% in the past year, according to data from Trend Micro, at the same time some 75% of organizations stockpiled cryptocurrency. The majority that did also paid their attackers the ransom, according to a Code42 study. Overall, more than 80% of ransomware infections over the past year were at enterprises, as cybercrime gangs began setting their sights on larger organizations capable of paying bigger ransom amounts than the random victim or consumer.

The evolution of the prolific GandCrab ransomware over the past few months demonstrates how this new generation of more selective attacks is more profitable to the cybercriminals using it - and underscores how the ransomware threat is far from over.

"[Ransomware is] not going anywhere anytime soon," says Adam Meyers, vice president of intelligence at CrowdStrike. "A few years ago, there was DDoS extortion ... it went away when no one was paying. But here they are doing ransomware attacks and making good on their demands."

Meyers says CrowdStrike recently added the GandCrab gang - which it calls Pinchy Spider - as the newest cybercrime group on its watch list of four groups attacking so-called "big game" targets and demanding anywhere from hundreds of thousands to millions of dollars in ransom to unlock their data. The other three cybercrime groups hacking bigger targets with ransomware are Boss Spider, the group behind SamSam; Indrik Spider, the group behind BitPaymer; and Grim Spider, which deploys Ryuk.

"They come in very much like a targeted intrusion attack by China or Iran [nation-states] would. They move laterally and deploy ransomware far and wide across the enterprise, charging a much higher ransom," Meyers explains. "It's an evolution in how ransomware is deployed, and it demonstrates how criminal actors have identified that they can make more money targeting enterprises in a way that is fairly devastating."

Pinchy Spider is best known for its GandCrab ransomware-as-a-service (RaaS) model that offers a "partnership" with its cybercrime customers, who get 60% of the profit and sometimes up to 70%.

The creators of Gandcrab call its RaaS licensing "Dashboard Essential," where newbie ransomware hackers pay $100 to infect 200 victims during a two-month period, according to a recent study by Sophos.

Chester Wisniewski, principal research scientist at Sophos, says he has seen ransom of $300,000 to $400,000 demanded by Gandcrab attackers. The creators also offer source-code licensing of the malware for $1,200. This allows buyers to make slight changes to the malware so it's undetectable by anti-malware programs, which Wisniewski says have been mostly effective at snuffing it out. "You can even replace their logo with your logo," Wisniewski says of the ransomware packaging options.

Ransomware gangs made the transition from opportunistic attacks to more targeted ones, mainly with a little help from Shodan. They typically search for ports with Remote Desktop Protocol (RDP) enabled and open, for example, he says. Then they search for RDPs in IP ranges that show business information they can use to target users in that IP. "The victim selected is slightly targeted, but they need one that belongs to an organization" they want to target, he says.

Once they gain a foothold with the first victim, they move around using standard penetration testing tools. "They act more like pen testers, not using bespoke malware but things like [Windows remote access tool] PsExec and Mimikatz to grab passwords out of memory," Wisniewski says. "They case the victim while they are in and figure out how they do backups so they can disable and delete them."

One GandCrab attack in mid-February was especially persistent: After at first failing to infect a computer in the target's network, the attackers returned to perform reconnaissance on the victim's network using legit tools Sysinternals Process Monitor, Process Hacker, and LAN Search, according to CrowdStrike, which studied the attack. On the third day of the attack, the attacker manually uninstalled the security software that was blocking its installation of GandCrab; with stolen RDP credentials, the attacker then spread GandCrab to other systems.

Silent SamSam
Meanwhile, the SamSam ransomware gang, aka Boss Spider, has been relatively quiet since the US Department of Justice handed down indictments of two of its operatives, Faramarz Shahi Savandi and Mohammed Mehdi Shah Mansouri, both Iranian citizens, for the ransomware attack against the city of Atlanta last year. "It shut down their operations in the wake of that indictment," CrowdStrike's Meyers notes.

The attackers hit some 3,800 workstations and servers with ransomware that locked the city out of its systems and incurred millions of dollars in losses. City officials did not pay the attackers the roughly $51,000 in cryptocurrency to decrypt their systems.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .