A Guide to Surviving a Ransomware Attack

Surviving ransomware is attainable with a blend of preparation and intentionality. Often, there is a misguided characterization of ransomware attacks that implies defenders possibly completely thwart an attack or that attackers create finish manage of their targets’ IT infrastructure. But the past pair of years have illustrated that defenders’ achievements in dealing with ransomware attacks slide together a broad spectrum of potential outcomes, some naturally improved than others.

It’s also simple to visualize that all groups who are in the ransomware enterprise have the exact same abilities, purpose for the identical plans, and function less than the exact small business styles. But as is the circumstance in any marketplace vertical, ransomware groups occur with a vast selection of capabilities and a wide range of plans and small business types.

And although it is in vogue to refer to REvil and DarkSide as “franchise models” which provide Ransomware-as-a-Company, it is essential to try to remember that the franchisees are effectively freelance cybercriminals. The franchiser gives again-business office functions for these freelancers although exerting minor affect on how they if not run.

Provided the higher than, let us think about every of the factors that might influence an attack’s consequence.

Attacker Skill and Persistence

The techniques of the attackers and the capabilities of the defenders – moreover some elements of luck – normally identify the doable extent to which an attack could development:

• Lower skills: Some attackers could be competent at attacking organizations with lagging security tactics but will generally meet their match in corporations that have robust defenses
• Completely wrong techniques: Attackers with skills and tooling handy in attacking common details centers will have problems breaking into targets who have moved all the things to the cloud
• Terrible luck: Businesses who are generally locked down but could have a temporary publicity which an attacker takes place to stumble across
• Excellent luck: Companies who have still left a persistent opening (e.g., open RDP access to the outside in an AWS enclave) may possibly have a operate of good luck as no attacker encounters it

Attacker Intention

Attack teams might also specialize in leak-centered vs. operation-centered goals.

Leak-centered objectives involve exfiltrating and threatening to leak confidential information belonging to the specific corporation. The most important knowledge in this regard is normally data connected to the target’s buyers and employees as the opportunity for reputational and legal liability functions as a potent incentive for ransom payment.

Alternately, public disclosure or sale of intellectual residence or trade secrets can also warrant the payment of ransom. The playbook for these kinds of attacks typically consists of sending the sufferer a sample of the details to exhibit what the attacker has. From there, it can escalate to publicizing a knowledge sample and calling the victim’s consumers to implement stress to the victim to spend the ransom.

An case in point of an attack with a leak-centered intention was the REvil-connected attack on Quanta, which exfiltrated specs of upcoming Apple merchandise layouts. The attackers 1st demanded a $50m ransom from Quanta but shortly resolved that Apple experienced deeper pockets and experimented with to extort $50m in return for not publicly leaking the facts or marketing it to an Apple competitor.

Operation-centered targets require attempts to cripple the skill of the sufferer organization to go on to operate. These attacks at times target on traditional IT devices and at other situations target methods which act as OT (Operational Technology), but which are usually assembled from legacy IT (e.g. Windows NT) technology.

The exfiltration of confidential data and public leak or sale of the data is typically not present in this plan. The DarkSide-related attack on Colonial Pipeline (who paid $4.5m in ransom) and the REvil-related attack on JBS Meals (who paid out $11m in ransom) squarely specific this aim: the ransoms were paid to try to ensure quick recovery in the ability of the firms to resume ordinary functions.

Degrees of Achievements

A number of components (together with luck) constrain the feasible results of a ransomware attack. Doable outcomes contain:

• The attackers make inadequate progress on a focused group and give up. This may perhaps be thanks to the perceived degree of difficulty in efficiently carrying out the attack or for the reason that some other targets that the attackers are concurrently pursuing search a lot more promising. Assume of this as chance cost. Possibly way, no ransom is demanded.
• The attackers realize success to a point and imagine on their own to have some leverage in demanding a ransom, but the ransom is finally not paid. The outcome in these situations is frequently some operational effects or reputational harm, but eventually survival and (hopefully) a sense of renewed determination to cyber security.
• The attackers succeed to a issue and the ransom request is modest adequate that the victim might opt for to pay the ransom as it is significantly less high priced than the recovery effort and hard work would be. This may well also be influenced by the victim getting a cyber coverage policy which gives ransomware protection.
• The attackers get access to the crown jewels and successfully can avoid the target group from operating their business enterprise. In this scenario, the sufferer firm might pay out the ransom (Colonial Pipeline, JBS Meals) and restore products and services reasonably immediately. Or they refuse to pay out it (see the RobbinHood attack of the city of Baltimore or the Samsam attack on the town of Atlanta) and generally end up rebuilding their IT infrastructure from the ground up.

Takeaways

You must tabletop numerous eventualities masking attackers pursuing the two leak-centered and functions-centered objectives and contemplate your reactions to partial and comprehensive achievement by the attackers:

• Know the extent of your cyber insurance coverage and what restrictions it has.
• If it will come to a ransom request, will your cyber insurance plan provider offer a person to handle ransom negotiations?
• Do you have an incident response agency on retainer?
• How sturdy is your catastrophe recovery plan?

Numerous of these varieties of concerns will surface area from tabletop routines which will help you be a lot more well prepared should really the fateful day get there.

Oliver Tavakoli is CTO at Vectra AI.

Enjoy additional insights from Threatpost’s Infosec Insiders local community by visiting our microsite.