Preventing an Imminent Ransomware Attack With Early Detection and Investigation

By Trend Micro Research

Compromised assets

The organization conducted a joint investigation with the Trend Micro incident response team and discovered that cybercriminals performed the following unauthorized and malicious activities within the company’s network:

• Cybercriminals stole top-level administrator privileges and used these privileges to conduct unauthorized activities.
• After the intrusion, malicious actors also viewed the organization’s files and removed traces of them doing so.
• Cybercriminals also attempted to steal passwords, based on traces found during the investigation.

Figure 2. The four devices within the enterprise’s LAN network compromised by the attack

The four devices in Figure 2 were confirmed to have been significantly compromised. In addition to these four, Trend Micro also confirmed that remote command execution requests have been sent to multiple other servers, which means that threat actors succeeded in logging in to the organization’s RDP. We will primarily discuss these four devices that are most relevant to the case in the following sections.

The range indicated by the red frame in Figure 2 is the organization’s internal LAN, which ideally contains an environment that malicious actors typically cannot access via the internet. In this case, it is assumed that threat actors intruded into the organization’s system via SSL-VPN equipment.

It is highly likely that the enterprise would have been substantially affected by the attack had intervention been sought later, especially since the threat actors had already succeeded in gaining initial access to domain administrator privileges.

In the following sections, we discuss the details of this case: how threat actors made the initial access, which vulnerabilities were exploited, what kind of attacks were carried out, how countermeasures were implemented, and the lessons that can be drawn from this event.

Attack vector

Figure 3. Threat actors gained initial access through the enterprise’s SSL-VPN and moved laterally onto other machines

The threat actors behind the attack first acquired an employee VPN account belonging to the local administrator’s group and compromised the SSL-VPN equipment. It is assumed that they first accessed the LAN through this route. However, this is not fully confirmed in our investigation because of the lack of any definitive trace or evidence, another security gap that we will get into later.

After the intrusion, the attackers used RDP to move laterally to multiple terminals within the organization. It was also confirmed that the attackers viewed some files and searched for or stole information from Server A.

Our investigations also confirmed that the malicious actors attacked Server C by exploiting the Zerologon vulnerability and acquired additional domain administrator privileges.

The team also saw execution traces of the credential dumping tool Mimikatz on Server C and discovered that the malicious actors deleted relevant log files in an attempt to evade detection.

A ransomware attack stopped in its tracks

Figure 4. Methods commonly used by ransomware attackers, as confirmed by the Trend Micro response support team. The ones highlighted in blue were observed in the case discussed.

The behaviors observed in our investigation are similar to the attack methods often seen in ransomware cases for which Trend Micro provides response support. Of the eight common methods threat actors often use to orchestrate and carry out a ransomware attack, five were executed in the case discussed in this feature.

We asked the victim organization to promptly implement the appropriate defense measures.

Defense vulnerabilities

We investigated the gaps, or defense vulnerabilities, that allowed the security breach by closing in on each stage of the attack. In this section, we compare the ideal defense system with that of the victim organization at the time of the attack.

Figure 5. Defense vulnerabilities found in the victim organization’s system

Table 1 lists the five defense vulnerabilities that were exploited in this breach and shows the security measures that should be implemented to reduce the risk of such attacks.

Table 1. Defense vulnerabilities and countermeasures

Ransomware actors do whatever it takes to profit from their victims. This means that they exhaustively search for gaps in a system, look for vulnerabilities to exploit, and expand their scope of attack without being noticed to then steal information and encrypt important files.

Implementing any of the previously mentioned measures does not necessarily mean that the security of the organization is guaranteed. Rather, reducing the number of vulnerabilities will eventually contribute to the reduction of the total risk that an organization inevitably has to contend with.

Organizations can implement extended detection and response (XDR) to mitigate the risks associated with vulnerabilities and increase an enterprise’s overall security level. XDR supports the protection of the entire organization’s system by continuously monitoring it using sensors placed in various layers, including endpoints, servers, and networks.

XDR helps detect any suspicious behavior at an early stage, such as the ones we reviewed in this case. It also helps determine the extent of an attack’s impact and acquires the information necessary for quick countermeasures and recovery.

Moreover, the following measures can be useful in reducing the risk of being on the receiving end of a similar attack in the future:

• Review your organization’s password management rules, such as those pertaining to expiration periods or password complexity requirements.
• Enforce the principle of least privilege. Delete unnecessary local administrator privileges and disable domain administrator privileges for normal operations.