## It's not FINished ###### Mitchell Clarke and Tom Hall ----- #### § Principal Consultant § London, UK § 2.5 years at Mandiant ##### snozberries_au ----- #### § Principal Consultant § London, UK § Five years at Mandiant ##### – thall_sec ----- ### Ransomware Operation Trends Self Manual Propagating Detonation Spray and Targeted Pray Deployment Partnership Self Models Managed ----- ### APT #### § An attacker has domain admin access to my ##### environment #### § There are multiple persistence mechanisms § They likely stole business sensitive data ----- ### APT Ransomware #### § An attacker has domain admin access to my ##### environment #### § There are multiple persistence mechanisms § They likely stole business sensitive data § All of my IT infrastructure is down § I can’t function as a business ----- # REvil/Sodinokibi ----- ### REvil Ransomware as a Service #### § First seen May 2019 § Operated by UNKN § Affiliate model: ###### – Multiple threat actors use the REvil RaaS – Affiliates are vetted and buy in – Affiliates receive 60% - 75% of payouts depending on performance ----- ### REvil Ransomware as a Service #### § Each affiliate gains access to the RaaS platform: ###### – Malware generation – Ransom demands and payment service – Victim communications – Coin laundering ----- ### Sodinokibi Ransomware #### § On the most part, ransomed systems remain ##### functional ###### – System-related file extensions and directories are untouched #### § To date, no issues found in crypto § Each infected system has a unique private key: ###### – Encrypted and stored in registry – Decrypted with attacker key ----- ### Time to Ransomware Deployment #### § It depends on the affiliate § For comprehensive domain-wide ransomware ##### deployment: ###### – Up to three to four months – Some affiliates appear to have a backlog of victims ----- # REvil/Sodinokibi ----- ### Initial Compromise **Establish Foothold** #### § Mass exploitation of high-profile vulnerabilities for Escalate Privileges ##### internet-facing infrastructure: **Reconnaissance** ###### – VPN – SharePoint **Lateral Movement** ###### – RDP – Remote Access Applications Maintain Presence #### § Lateral movement via third parties **Data Theft** #### § Credential stuffing of internet infrastructure § Phishing Ransomware **Deployment** ----- ### Establish Foothold **Establish Foothold** ##### Depends on the affiliate: Escalate Privileges #### § Cobalt Strike § VPN abuse Reconnaissance § Web shells Lateral Movement <%@ Page Language="C#" Debug="true" Trace="false" %> <%@ Import Namespace="System.Diagnostics" %> **Maintain Presence** <%@ Import Namespace="System.IO" %>