Priya Nair — Digital Forensics Analyst
Key Takeaways
- The ransomware identified in the latest attack utilizes T1071.001 – Application Layer Protocol: Web Protocols for C2 communication.
- Initial access was gained through a compromised RDP session, demonstrating the critical threat of weak password policies.
- The demand for organizational adherence to strict T1078 – Valid Accounts controls is underscored by the attack vector utilized.
Executive Summary
During our recent investigation into a sophisticated ransomware attack, we observed a clear pattern of exploitation that began with initial access gained through Remote Desktop Protocol (RDP). The attackers targeted credentials using brute force techniques, indicating an established foothold in the environment via weak password hygiene. This was followed by execution of the ransomware payload, ultimately leading to significant data encryption and a ransom demand.
Initial Access
Our analysis revealed that the initial access vector exploited by the threat actor involved exploiting weak passwords to gain access to RDP sessions across multiple machines. Specifically, we identified that endpoints with the following attributes were targeted: open RDP ports exposed to the internet and poor password policies that allowed for easy enumeration by rainbow tables. Several compromised accounts were observed in the logs collected during the incident, exposing the use of T1078 – Valid Accounts as the primary technique for establishing initial access.
Execution & Persistence
Once the attacker successfully authenticated to the targeted systems, they deployed a customized variant of Conti ransomware. The implant utilized PowerShell scripts to execute the main payload, following a standard methodology of executing commands through powershell.exe and employing T1059.001 – Command and Scripting Interpreter: PowerShell. Persistence was achieved by creating scheduled tasks that would ensure the payer remained active even after reboots, specifically under the names taskmgr and update_service.
Command and Control
The subsequent stage of our review uncovered that the ransomware communicated with its command and control (C2) infrastructure using HTTP over SSL, leveraging domain fronting techniques to obscure the actual endpoint. Analysis of the traffic highlighted several indicators of compromise (IOCs), with the beaconing occurring every 30 seconds at specific endpoints. This allowed the threat actor to maintain a consistent connection for exfiltration of data and encryption instructions, all while employing the methodology documented in T1071.001 – Application Layer Protocol: Web Protocols.
Lateral Movement & Discovery
In the context of lateral movement, the threat actor executed multiple reconnaissance tactics to identify additional systems within the network. Utilizing T1087 – Account Discovery, they harvested user account information using a combination of PowerShell commands which were able to list user profiles and services across the Active Directory domain. Once they had gathered sufficient intelligence on the network topology, additional payloads were deployed to other high-value systems to maximize impact.
Impact & Objectives
The ultimate objective of the threat actor appeared to be both financial gain and disruption of services. Following successful encryption of local data on infected machines, a ransom note was displayed, demanding payment in cryptocurrency. It was noted that alongside encryption, the actor also held an additional threat of data leaks, indicating the use of T1486 – Data Encrypted for Impact along with exfiltration capabilities. Various operational files within the organization’s archives were encrypted, rendering them inaccessible and creating a significant operational disruption.
MITRE ATT&CK Mapping
- T1078 – Valid Accounts: Exploited weak passwords to gain unauthorized access to RDP sessions.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Utilized PowerShell commands for executing payloads and maintaining persistence.
- T1071.001 – Application Layer Protocol: Web Protocols: Engaged HTTP over SSL for command and control communications.
- T1087 – Account Discovery: Enumerated user accounts to facilitate lateral movement.
- T1486 – Data Encrypted for Impact: Encrypted sensitive operational data to compel ransom payment.
Detection Opportunities
- Monitoring for failed RDP login attempts can provide early warning of password brute force attacks.
- Implementing anomaly detection on scheduled tasks could help identify unauthorized persistence mechanisms.
- Network traffic analysis should focus on outbound HTTPS connections to known or suspicious domains.
Analyst Notes
Organizations must prioritize the enforcement of strong password policies, especially for services exposed to the internet. Additionally, maintaining a robust monitoring capability for RDP access attempts and employing threat hunting methodologies to detect lateral movements can significantly reduce the risk of similar attacks in the future. Embedding real-time alerting for scheduled tasks and PowerShell executions will enable proactive defense mechanisms against future ransomware deployments.
Source: Original Report