Alex Morgan — Threat Intelligence Analyst
Key Takeaways
- Ransomware actors increasingly leverage supply chain vulnerabilities for initial access, impacting critical infrastructure.
- Persistence mechanisms include sophisticated registry manipulations and scheduled tasks that ensure re-execution after system reboots.
- Visualization of command and control (C2) traffic can reveal patterns indicative of exfiltration and lateral movement.
Executive Summary
During our investigation of a recent ransomware incident, we observed an organized methodology employed by the cyber actors, demonstrating a thorough understanding of both the infrastructure they target and the tactics available to them. The threat actor gained initial access through a compromised third-party vendor, employing phishing tactics that set the stage for a larger infiltration. This analysis details the actor’s tactics, techniques, and procedures (TTPs) as they executed their attack, focusing on how they achieved persistence, lateral movement, and ultimately their objectives — data exfiltration and ransom demands.
Initial Access
The initial access vector involved a phishing email crafted to impersonate a legitimate vendor. This email contained a malicious attachment, which, when opened, executed a PowerShell command embedded within a macro-enabled .docm file. The actor utilized T1566.001 – Phishing: Malicious Link as their primary technique. Our analysis revealed that the dropped payload was a custom dropper designed to retrieve additional modules from the actor’s command and control server, leading to a further compromise of the environment.
Execution & Persistence
Once the dropper executed, it deployed a secondary stage payload, which we identified as a variant of the Conti ransomware. This payload employed various persistence techniques, including modifications to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, adding a new registry key to ensure re-execution at user login. Additionally, the actor created a scheduled task that triggered every hour, executing the ransomware binary from a common directory to evade detection, confirming use of T1053.005 – Scheduled Task/Job: Scheduled Task.
Command and Control
For C2, we identified that the threat actor employed encrypted HTTP traffic with a randomized domain generation algorithm (DGA). The communication observed utilized domains that changed frequently, making detection by traditional methods challenging. We noted a pattern in the traffic that suggested multiple C2 callbacks to cloud services, indicative of T1071.001 – Application Layer Protocol: Web Protocols. The embedded logic in the malware allowed it to adapt to network changes, maintaining its connection unless explicitly disrupted.
Lateral Movement & Discovery
Post-compromise, the actor employed PSEXEC and WMI for lateral movement within the network. We observed the malware querying \localhost\c$ and accessing other system shares using credentials harvested via Mimikatz. Our investigation confirmed that T1021.001 – Remote Services: Remote Scheduled Tasks was used extensively to deploy additional payloads across the compromised environment. The thorough reconnaissance phase conducted included scanning for workstation groups and identifying user privileges, allowing the actor to escalate their access effectively.
Impact & Objectives
The overarching objective of this operation appeared to be data exfiltration, followed by a ransom demand aimed at substantial recovery costs for the organization. Our analysis revealed attempts to compress and encrypt sensitive files located in shared directories, particularly focusing on financial records and intellectual property within various sectors. Utilizing T1486 – Data Encrypted for Impact, the ransomware sought to encrypt the files, rendering them unusable and effectively crippling the operational capabilities of the victimized organization.
MITRE ATT&CK Mapping
- T1566.001 – Phishing: Malicious Link: The technique used for initial access through phishing emails.
- T1053.005 – Scheduled Task/Job: Scheduled Task: Mechanism for ensuring persistence across system reboots.
- T1071.001 – Application Layer Protocol: Web Protocols: Utilized for encrypted command and control communications.
- T1021.001 – Remote Services: Remote Scheduled Tasks: Observed in lateral movement strategies.
- T1486 – Data Encrypted for Impact: Key ransomware function to encrypt data for extortion purposes.
Detection Opportunities
- Monitor for unusual registry modifications at
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. - Set alerts for periodic scheduled task creation or modifications that execute unrecognized binaries.
- Implement network analytics to detect anomalies in HTTP traffic patterns, especially connections to newly generated domains.
Analyst Notes
Given the evolving tactics used by ransomware actors, organizations must enhance their defensive strategies through comprehensive user training programs on phishing, robust network segmentation, and continuous endpoint monitoring solutions. Regularly updating threat intelligence feeds can provide valuable insights into emerging TTPs, allowing defenders to stay ahead of actor methodologies. Moreover, developing incident response simulations based on real-world scenarios can significantly bolster preparedness against similar ransomware attacks in the future.
Source: Original Report