{"id":97524,"date":"2021-09-27T10:00:13","date_gmt":"2021-09-27T17:00:13","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=97524"},"modified":"2023-08-10T14:47:18","modified_gmt":"2023-08-10T21:47:18","slug":"a-guide-to-combatting-human-operated-ransomware-part-2","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2021\/09\/27\/a-guide-to-combatting-human-operated-ransomware-part-2\/","title":{"rendered":"A guide to combatting human-operated ransomware: Part 2"},"content":{"rendered":"

This blog is part two of a two-part series focused on how Microsoft DART helps customers with human-operated ransomware. For more guidance on human-operated ransomware and how to defend against these extortion-based attacks, refer to our human-operated ransomware docs page<\/a>.<\/em><\/p>\n

In part one<\/a> of this blog series, we described the process and execution used in our customer engagements to provide perspective on the unique issues and challenges regarding human-operated ransomware. We also explained how Microsoft\u2019s Detection and Response Team (DART) leverages Microsoft solutions to help combat this threat. In this post, we will tackle the risks of human-operated ransomware and detail DART\u2019s security recommendations for tactical containment actions and post-incident activities in the event of an attack.<\/p>\n

Understanding the risks of human-operated ransomware<\/h2>\n

Beyond the immediate threat of file encryption, there are several additional risks associated with human-operated ransomware events, some of which may be observed well after an investigation and the removal of the threat from the network. These risks include:<\/p>\n

1. Disruption of business operations<\/h3>\n

Immediate actions need to be taken to reduce the blast radius of a ransomware event. In these cases, disabling portions of the network may feel like a self-inflicted denial of service, but they are necessary to counter the ransomware spread. The resulting business disruption may become public. If any affected systems are public-facing, it may require crisis communications.<\/p>\n

2. Data theft<\/h3>\n

Most attackers are highly motivated to monetize their access to your network. In several cases investigated by DART, an attacker has performed reconnaissance for sensitive files (like contracts, financial documents, and internal communications), copied this data, and exfiltrated it before any ransomware was dropped. Taking this information before ransomware is deployed allows the attacker to have data to sell, leak, or simply show as proof that the attacker has had access to sensitive files.<\/p>\n

3. Extortion<\/h3>\n

Data theft by ransomware operators opens an organization to extortion. It is not uncommon for threat actors to demand payment to prevent the leak of stolen data. These threats are typically sent via email with sample stolen documents attached as proof of possession. In some cases where DART has observed this activity, a threat actor accessed a cloud-based email account that was not protected by multifactor authentication<\/a> (MFA) and sent threatening emails to the board of directors. The threat of extortion is still high, even when the threat actors are unsuccessful at deploying ransomware.<\/p>\n

At DART, we often get asked, \u201cCan you tell us which data was stolen?\u201d To prove this requires concrete evidence, which would be either:<\/p>\n