Defending against ransomware: a live threat scenario

Andrew Tsonchev, Director of Cyber Analysis | Monday May 8, 2017

In 2016 alone, cyber-criminals launched 638 million ransomware attacks. That’s 20 ransomware attempts every second.

The cyber security industry has tried to stem the tide by stopping ransomware at the network border, which can help detect some known ransomware threats. The problem is that ransomware is constantly evolving and mutating, with new strains popping up every day.

At Darktrace, our technology detects ransomware without prior knowledge, a vital capability since no matter how strong the network border is, these types of threats inevitably find a way inside.

Let’s take a look at how Darktrace’s unsupervised machine learning detected and responded to a real ransomware attack at a large financial services organization. As with most ransomware, it all started with a phishing email.

  1. Darktrace first noticed anomalous behavior when an employee checked his personal webmail on a corporate laptop. The device started making HTTP requests to a rare external domain: Thu Nov 17, 20:20:22 192.168.103.106 connected to webmail.northrock.bm [80]
  2. The employee opened what he believed to be a Word document, but was actually a malicious .zip file containing a ransomware payload. The device then connected to a second rare external domain. It was not until the next day that OSINT vendors identified the domain as malicious: Thu Nov 17, 20:20:55 192.168.103.106 connected to www.inhabitantap[.]top [80]
  3. Darktrace then observed the device downloading a suspicious .exe file from the anomalous domain: File Transfer (EXE) — FileTransfer::Exe file found with filetype (application/x-dosexec) [80] SHA1: 7099508c86c3b40268a4039afa5aabafb6f36d90
  4. At this point, the ransomware executable had already bypassed multiple perimeter security protocols on the device. The ransomware then began to search for available SMB shares. Unlike the encryption of data on individual devices, SMB encryption jeopardizes data across the entire corporate network. Darktrace highlighted this activity as a major deviation from normal: 20:26:01

    1 SMB Move Success — share= rename_to=[REDACTED].thor file=[REDACTED].xls [445]
    An unusual time for this activity

    20:26:01

    1 SMB Read Success — share= file=[REDACTED].xls [445]

    An unusual time for this activity
  5. Nine seconds after the start of the SMB encryption activities, Darktrace raised an alert signifying that the anomaly required further investigation. As the behavior persisted over the next 24 seconds, Darktrace continually revised its understanding of the deviation as it progressed into a serious threat.

  6. At this point, Darktrace’s Enterprise Immune System determined that the threat required an immediate response, but the security team had gone home for the weekend and wasn’t on site to manually remediate the situation. The Enterprise Immune System stepped in and automatically interrupted all attempts to write encrypted files to network file shares. In so doing, Darktrace neutralized the threat 33 seconds after the malicious activity began.

    SMB write successes are observed as the device encrypts files on the network share (shown in gray). The green spikes represent the ‘significance’ of the activity as understood by Darktrace. This pattern of SMB activity represented a major deviation from the device’s normal behavior.

At every stage of the attack, the Enterprise Immune System continuously monitored the situation and raised alerts of increasing severity. Despite the speed with which the attack unfolded, and despite multiple endpoint solutions failing to identify the executable, the Enterprise Immune System identified the device’s behavior as highly anomalous, and in a matter of seconds, it destroyed the threat.

To learn more about the threats Darktrace finds, check out our Threat Use Cases page which details how external attackers changed data on a biometric scanner and attempted to take control of an industrial power station.

Andrew Tsonchev

Andrew is a technical expert on cyber security and advises Darktrace’s strategic customers on advanced threat defense, AI and autonomous response. He has a background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. His comments on cyber security and the threat to critical national infrastructure have been reported in international media, including CNBC and the BBC World.

Trust attacks and the evolution of ransomware

Dave Palmer, Director of Technology | Wednesday April 5, 2017

Ransomware attacks are both indiscriminate and effective. They target everyone from Wall Street corporations to small-town hospitals; from CEOs to union leaders. In 2016 alone, ransomware attacks spiked by 6,000 percent, raking in over $1 billion from unsuspecting victims. For attackers, ransomware is as tried-and-true as they come.

But as the threat landscape continues to grow and evolve, so too does ransomware. Attackers have started to realize that targeting trust can be just as lucrative as targeting data. Reputation has become one of a company’s most valuable assets and is now under assault.

Traditional ransomware can often be dealt with behind the scenes. Whether the organization mitigates the ransomware on their own, recovers the files through a backup system, or even if they pay the ransom, the situation can be resolved without involving customers or press.

But the newest strain of ransomware – dubbed ‘Doxware’ – is not so discrete. Doxware packages a company’s data and threatens to release it to the public. This might include confidential documents like patient records and proprietary blueprints, or personal information like passwords and credit card numbers – the more sensitive the better.

85 percent of industry leaders now consider reputational damage the most significant impact of a cyber-attack. The rise of Doxware shows that cyber-criminals are good at adapting to new market opportunities, and they have a multitude of weapons at their disposal to inflict that damage. Meanwhile, legacy security tools still try to defend networks at the border or concentrate on finding ‘known bad’. Unless these novel attacks are stopped at an early stage, they’re bound to undermine organizational reputation.

As ‘trust attacks’ are becoming increasingly mainstream, safeguarding reputation has become an essential component of cyber security. To protect their brand and trustworthiness, organizations have to be able to evolve in step with the rapidly changing threat landscape, proactively protecting their assets from subtle, stealthy cyber-attacks.

When it comes to ransomware, paying the ransom isn’t a failsafe option, because there’s no guarantee the attacker will decrypt the data. Likewise, bracing for a public data dump via Doxware is equally inadvisable. The best alternative is to detect the threat while it’s still emerging.

At Darktrace, we see ransomware on a daily basis. The reason we can catch it comes down to the detection approach. We’re not looking for a specific signature or a pre-identified ransomware strain. Instead, the technology is constantly learning and re-learning what normal looks like, so when a new type of malware is launched, we don’t have to play catch-up. We detect it straight away.

Here’s an example of a ransomware attack that got through the perimeter at a California non-profit and how it was detected within minutes, allowing the security team to stop it before it spread to a second computer.

Dave Palmer

Dave is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over 19 years of experience at the forefront of government intelligence operations, Dave has worked across UK intelligence agencies GCHQ and MI5, where he was responsible for delivering mission-critical infrastructure services, including replacing and securing entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He acts as an advisor to cyber security start-ups and growth-stage companies from the UK Government’s Cyber Security Accelerator and CyLon. His insights on AI and the future of cyber security are also regularly featured in the UK media. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.