Watch the Cyber Signals digital briefing where Vasu Jakkal, CVP of Microsoft Security, interviews top threat intelligence experts on the ransomware economy and how organizations can help protect themselves.
Just as many industries have shifted toward gig workers for efficiency, cybercriminals are renting or selling their ransomware tools for a portion of the profits, rather than performing the attacks themselves.
The Ransomware as a Service allows cybercriminals to purchase access to Ransomware payloads and data leakage as well as payment infrastructure. Ransomware ”gangs” are in reality RaaS programs like Conti or REvil, used by many different actors who switch between RaaS programs and payloads.
RaaS lowers the barrier to entry and obfuscates the identity of the attackers behind the ransoming. Some programs have 50+ “affiliates,” as they refer to the users of their service, with varying tools, tradecraft, and objectives. Just as anyone with a car can drive for a rideshare service, anyone with a laptop and credit card willing to search the dark web for penetration testing tools or out-of-the-box malware can join this economy.
This industrialization of cybercrime has created specialized roles, like access brokers who sell access to networks. A single compromise often involves multiple cybercriminals in different stages of the intrusion.
RaaS kits are easy to find on the dark web and are advertised in the same way goods are advertised across the internet.
A RaaS kit may include customer service support, bundled offers, user reviews, forums and other features. Cybercriminals can pay a set price for a RaaS kit while other groups selling RaaS under the affiliate model take a percentage of the profits.
Ransomware attacks involve decisions based on configurations of networks and differ for each victim even if the ransomware payload is the same. Ransomware culminates an attack which can include data exfiltration and other impact. Because of the interconnected nature of the cybercriminal economy, seemingly unrelated intrusions can build upon each other. Infostealer malware that steals passwords and cookies get treated with less severity, but cybercriminals sell these passwords to enable other attacks.
These attacks follow a template of initial access via malware infection or exploitation of a vulnerability then credential theft to elevate privileges and move laterally. Industrialization allows prolific and impactful ransomware attacks to be performed by attackers without sophistication or advanced skills. Since the shutdown of Conti we’ve observed shifts in the ransomware landscape. Some affiliates who were deploying Conti moved to payloads from established RaaS ecosystems like LockBit and Hive, while others simultaneously deploy payloads from multiple RaaS ecosystems.
New RaaS like QuantumLocker and Black Basta are filling the vacuum left by Conti’s shutdown. Since most Ransomware coverage focuses on payloads instead of actors, this payload switching is likely to confuse governments, law enforcement, media, security researchers, and defenders about who is behind the attacks.
Reporting on ransomware may seem like an endless scaling problem; however, the reality is a finite set of actors using the set of techniques.
Ransomware exists to extort payment from a victim. Most current RaaS programs also leak stolen data, known as double extortion. As outages cause backlash and government disruption of ransomware operators increases, some groups forgo ransomware and pursue data extortion.
Two extortion focused groups are DEV-0537 (aka LAPSUS$) and DEV-0390 (a former Conti affiliate). DEV-0390’s intrusions initiate from malware but use legitimate tools to exfiltrate data and extort payment. They deploy penetration testing tools like Cobalt Strike, Brute Ratel C4, and the legitimate Atera remote management utility to maintain access to a victim. DEV-0390 will escalate privileges by stealing credentials, locate sensitive data (often on corporate backup and file servers), and send the data to a cloud file sharing site using a file backup utility.
DEV-0537 uses a very different strategy and tradecraft. Initial access is obtained by purchasing credentials on the criminal underground or from employees at targeted organizations.
Understanding the interconnected nature of identities and trust relationships in modern technology ecosystems, they target telecommunications, technology, IT services, and support companies to leverage access from one organization to gain entry into partner or supplier networks. Extortion only attacks demonstrate that network defenders must look beyond end-stage ransomware and keep a close eye on data exfiltration and lateral movement.
If a threat actor is planning to extort an organization to keep their data private, a ransomware payload is the least significant and least valuable part of the attack strategy. Ultimately, it’s an operator’s choice what they choose to deploy, and ransomware is not always the big-ticket payout every threat actor is after.
While ransomware or double extortion can seem an inevitable outcome from an attack by a sophisticated attacker, ransomware is an avoidable disaster. Reliance on security weaknesses by the attackers means that investments in cyber hygiene go a long way.
Microsoft’s unique visibility gives us a lens into threat actor activity. Rather than rely on forum posts or chat leaks, our team of security experts study new ransomware tactics and develop threat intelligence that informs our security solutions.
Integrated threat protection across devices, identities, apps, email, data and the cloud help us identify attacks that would have been labeled as multiple actors, when they’re in fact a single set of cybercriminals. Our Digital Crimes Unit composed of technical, legal, and business experts continues to work with law enforcement to disrupt cybercrime
Microsoft has in-depth recommendations at https://go.microsoft.com/fwlink/?linkid=2262350.
Hear from Threat Intelligence Analyst Emily Hacker on how her team stays on top of the changing ransomware as a service landscape.
Methodology: For snapshot data, Microsoft platforms, including Defender and Azure Active Directory, and our Digital Crimes Unit provided anonymized data on threat activity, such as malicious email accounts, phishing emails, and attacker movement within networks. Additional insights are from the 43 trillion daily security signals gained across Microsoft, including the cloud, endpoints, the intelligent edge, and our Compromise Security Recovery Practice and Detection and Response teams.
Follow Microsoft Security