The Definitive Guide to Ransomware: Readiness, Response, and Remediation
Total Page：16
File Type：pdf, Size：1020Kb
The definitive guide to ransomware: Readiness, response, and remediation A prescriptive approach to ransomware attacks and insight into powerful risk mitigation techniques Table of contents Executive summary 03 About this document 05 Definitions 06 Ransomware infections — A daily risk 07 Not all ransomware is created equally 08 No admin privileges needed 08 Typical ransomware activity 09 Destructive ransomware attacks 11 The ransomware-induced data breach 12 End users: The first line of defense 12 The incident lifecycle 13 Preparation 14 Developing and rehearsing an incident response plan 25 Incident response: Detection 27 Incident response: Analysis 32 Incident response: Containment 35 Incident response: Eradication 38 Incident response: Recovery 39 What are the requirements to notify authorities? 41 Paying a ransom: Things to consider 42 Incident response: Post-incident activity 44 IBM Security X-Force resources 45 IBM Security 2 Executive summary Ransomware: an online attack perpetrated by cybercriminals who demand ransom to release hold on encrypted or stolen data. In the past decade, attacks that fall under the ‘ransomware’ umbrella have evolved from a consumer-level nuisance of fake antivirus products, to sophisticated malware with advanced encryption capabilities that now primarily target public and private sector organizations. And while threat intelligence can help uncover which organizations may be considered primary targets at any given time, no single industry, geography or size of business is immune. As the footprint of ransomware keeps evolving, so too does the amount of ransom demanded to release data. Ransom amounts that used to total double digits have grown to seven and eight figure numbers. In even more extreme cases, attackers demand victimized companies pay as much as $40M to $80M U.S. to have data released back to their control. Ransomware has evolved along a third axis, as well: the extortion-like business model threat actors use to force payment from victims. If victims fail to pay within the allotted time, criminals escalate the attack and threaten to release confidential data publicly, or even auction it to the highest bidder on the dark web. And in yet another evolutionary twist, ransomware is now sometimes blended with destructive attacks, ultimately aimed at destroying and disrupting operations despite claims to return the data once the ransom is paid. Ransomware is one of cybercrime’s strongest business models today, pushing aside long held staples like banking Trojans, phishing, DDoS, and cryptojacking. Ransomware has crippled organizations across the globe carrying with it a cumulative price tag well into the billions of dollars. In an even darker twist, ransomware has even begun reaping a toll on human life itself. IBM Security 3 The urgency of informed response When a ransomware attack is discovered, every second counts. Uninterrupted, time is the ally of the attacker. As time passes, more data and files are encrypted, more devices are infected, ultimately driving up both cost and damage. Immediate—yet methodical and informed—action must be taken. Alerting IT security teams and allowing them to launch the incident response process that they have prepared to combat ransomware should be a first step. If you have a retainer contract with a third party provider it is advisable to engage them as well. Other parties to consider contacting are federal law enforcement and regulators, depending on the local requirements for the geographies in which your company operates. IBM Security 4 About this document This document was created with a twofold intent: 1. Provide a CISO-level overview of ransomware history, its current prevalence and resources to help fortify organizations; 2. Provide technical-level guidance on techniques to protect networks before an attack can happen, and recovery guidance if an attacker should make it through defenses. It is divided into distinct sections that address phases before, during and after an attack, with the most critical and time-sensitive being in the initial response section. If your organization is currently experiencing a ransomware incident, it is highly recommended you immediately review the Incident Response: Containment section and return to the remainder of this document at a later time for an overall background on ransomware attacks. While we mention several IBM Security X-Force resources in the sections of this document, we have included them at the end as well to provide you a summary of sources. IBM Security 5 Definitions Malware variants and versions For the purpose of this guide, the terms malware ‘version’ and ‘variant’ have distinct meaning. — The term version refers to the same malware program which encompasses newer or older versions of the same program with varying features. — The term variant is used to describe separate and different ‘families’ of ransomware. For example, there are several variants of ransomware that encrypt a user’s files and then demand a ransom. These variants are commonly written by different groups, known by different names by anti-virus companies, and contain unique functionality designed to achieve the same overall goal. Each variant can have multiple versions and versions are often upgraded over time to add features and capabilities. IBM Security 6 Ransomware infections — A daily risk IBM Security X-Force has seen a rapid increase in the number of customers who report being victims of ransomware attacks. Contracting ransomware is unfortunately all too easy, with most cases of infection beginning with unwitting employees who may get tricked by a well-crafted email to launch malware on devices attached to company networks. Ransomware is commonly delivered to the victim through an unsolicited email (from a known or unknown sender) as an attachment. It can also be injected into a user’s browser session through a web browser vulnerability. These vulnerabilities are exploited by threat actors using tools to compromise systems and plant “web-shells” or “backdoors” or even remote access trojans, all of which enable further compromise of the victim’s systems and network infrastructure. With an initial foothold in the compromised network, attackers plot lateral movement, privilege escalation, and the eventual deployment of ransomware on as many devices as possible. Due to the common initial infection method, employee education must be a key element in prevention efforts. IBM Security 7 Not all ransomware is created equally Malware used in ransomware attacks began to evolve rapidly starting in 2015, with new malware families and organized cybercrime syndicates joining the ransomware arena. But, while most modern-day ransomware uses effective and often irreversible encryption ciphers, not all ransomware is equal. Much like any cybercrime operation, technical abilities depend on attacker skill and sophistication, which translate into some attacks being impossible to break without a decryption key, and others, though less common, that can be reverse-engineered and overcome without paying the criminals. Whether or not malware can be mitigated with a decryption key or resolved through reverse engineering is an important element to understand in an attack. This information informs not only how to respond to the infection, but also allows teams to better forecast return to normal operations, and aids decision making efforts on all aspects of communicating with—or avoiding communicating with—the attackers. No admin privileges needed Ransomware attacks quickly become systemic issues largely because unlike other malware, most ransomware does not require administrative privileges. Instead, it relies on the permission level the most basic user would use on their assigned networked device. Ransomware attacks that worm through networks are known to plant malicious code in corporate file share servers and use those folders to move to other user devices without additional effort. These factors make ransomware a very viable threat to businesses where a large number of employees must access networks daily. It is not an easy feat to prevent ransomware attacks, but it is possible to reduce and mitigate risk and to better contain an attack if the network is infiltrated. IBM Security 8 Typical ransomware activity When a computer becomes infected with ransomware, the malware may generate network traffic if it sends encrypted system information to a C&C server (C2). However, communication with a C2 is not necessary for encryption. It is common for today’s ransomware to contain the public key needed for encryption and use it locally without fetching from a remote server. Ransomware that must reach out to a C2 node to retrieve a key before beginning to encrypt can have a higher likelihood of failing if it cannot connect to the C2. It can also be detected before it can complete its mission. Another common action taken by most ransomware variants is terminating a list of hardcoded processes and services that may interfere with file encryption, such as databases, security applications, and backup services. Some variants also search for and attempt to uninstall known anti-virus programs or other security applications. Other typical activity is to prevent and disable system restore features which can be enabled by the operating system. Many variants will run commands to do one or more of the following tasks: delete volume shadow copies, wipe free space, clear event logs or disable system restore features. Since it often lands on individual user devices, most ransomware variants target files commonly created and utilized by users for encryption and not files the operating system uses to keep the computer operational. The goal is to keep the computer functioning so the victims can opt to pay. IBM Security 9 The file types targeted for encryption can vary within different versions of the same ransomware and across variants, however, most include the following categories of files: 1. Microsoft Office files (.doc, .docx, .xls, .xlsx, .ppt, .pptx, .rtf) 2. Open Office files (.odt, .ods, .odp) 3. Adobe PDF files 4. Popular image files (.JPG, .PNG, raw camera files, etc.) 5. ext files (.txt, .RTF, etc.) 6.