TeslaCrypt

Of course, making a lot of money can also bring unwanted attention. It is speculated that this unwanted attention is what led to the person or group behind the TeslaCrypt ransomware family to cease operations in May 2016. While TeslaCrypt was not the most widely deployed ransomware family, its longevity—it was used in campaigns from early 2015 through May 2016—meant that that whoever was behind it made a great deal of money. From February through April 2015, researchers at FireEye determined that TeslaCrypt generated $77,000 for its developer.³ Following the escalated rate of deployment as the developer improved the software, TeslaCrypt likely generated more than $500,000.

The team behind TeslaCrypt famously stopped all operations in May of 2016. When a researcher from ESET antivirus company contacted them, the team apologized and made their private key available, which allowed ESET to develop a free decryption tool.

Other ransomware families have generated even more income. It is estimated that the team behind behind CryptoLocker made more than $3 million before it was shut down in late 2015.

There is a very clear financial motivation behind ransomware campaigns, but that does not mean that all ransomware hacker groups are the same. There are, undeniably, a lot of commonalities between the different hacker groups behind ransomware, but there are also a lot of differences. Some ransomware groups are sophisticated and well funded, with ransomware as their primary revenue source; while others are just getting started and have managed to cobble together a piece of ransomware that may or may not work. Still others are groups involved in sophisticated attacks that use ransomware as one small part of their arsenal. Understanding the differences among the different ransomware families and the hacker groups behind them can help organizations better protect their networks.

CryptXXX

The CryptXXX ransomware family is an example of a unsophisticated team that has morphed into a much more sophisticated one. The first iteration of the CryptXXX family was discovered in April 2016 as part of the Angler exploit kit. This version of CryptXXX had a flaw in the encryption process that allowed researchers at Kaspersky Labs to quickly develop a tool to decrypt any system that had been infected by that early version.⁴ Later versions of the malware used a different encryption scheme, one that deleted the VSS, making it impossible to restore a file from a local backup (offline backup restoration is still possible). There is some speculation that this newer variant of CryptXXX was developed by a different, more experienced team, building on the immature code.

The earlier a security team can identify and isolate a ransomware attack, the more likely they can stop it. That is why a holistic view of a ransomware attack is so important. Taking a holistic view allows security teams to stop a ransomware attack, using a combination of IOCs (indicators of compromise) and sound security practices, before the ransomware is downloaded to the target’s machine.

As mentioned before, to detect ransomware holistically requires an understanding of the who is behind the ransomware and what techniques they are using.

The CryptXXX ransomware is discussed in some detail in Part III of this book.

CryptoWall

At one point CryptoWall was the most popular ransomware family and was delivered in a variety of ways. Most likely authored by a Russian hacker team, CryptoWall was originally delivered through spam campaigns, usually through attachments. However, as it grew in popularity, the delivery mechanisms started to vary. Eventually CryptoWall was delivered through a series of well-known exploit kits including Angler, Magnitude, and Nuclear, often using malvertising on legitimate sites as the point of entry. This change in tactics is important because these exploit kits are well known and monitored closely by the security community. If a ransomware family switches to using an exploit kit for delivery, or jumps from one exploit kit to another, there are already known protections in place to detect that exploit kit. Stop the exploit kit and the ransomware never gets to install itself.

Take the Angler exploit kit, before its demise, as an example. More security vendors tracked the kit, monitoring its evasion techniques, anything from steps it would take to avoid specific antivirus programs to how it would change tactics and attempt to execute in memory.

By monitoring the activity of the developers of the Angler exploit kit, security teams were able to better ensure that Angler never got a foothold in the network; thus they were also protecting against CryptoWall. Of course, most security teams don’t have hours a week to spend tracking the changes in various exploit kits, which is why it is important to have a trusted security advisor that the security team can work with to share that information. Most organizations have multiple security vendors that they work with, and those security vendors are doing this work already. Getting updated alerts from these vendors on a regular basis helps security professionals to better prioritize patching and to develop more focused security strategies to deal with the threat of ransomware.

Ranscam

While most ransomware families stick to the standard formula of encrypting files and decrypting them when the victim pays the ransom, not all do. This is why knowing which ransomware has infected a machine is a critical component of addressing the threat. There are a few exceptions to this rule, the most notable of which is Ranscam, a ransomware family that simply deletes all files on a machine after successful installation.⁶

Ranscam still prompts the victim to pay the ransom; but when the victim does pay, a message is displayed saying that the ransom was not paid and that therefore a file will be deleted (of course it is not deleting a file; all the files were deleted when it was installed). This can induce panic and trick the victim into paying again (which will generate the same message).

If Ranscam continues to be successful, security analysts expect more hacker groups, especially less sophisticated ones, to attempt this type of attack. Obviously, developing fake ransomware is easier than actually building ransomware, so this is potentially a low-barrier method for low-skilled groups to get the benefits of ransomware, without having to put in the work or put up the money.

Along the same lines, there are reports of attackers threatening to launch a ransomware attack unless the company pays the ransom ahead of time. There is usually no real threat to these emails, since the groups behind these emails usually are not sophisticated enough to launch a ransomware attack; but the hope is that they can scare enough people into paying.

Even if an organization has done nothing to prepare for a ransomware attack, once it happens, it is important to take a step back to take stock of the situation. By fully understanding what happened and doing some research before making a panicked decision, an organization can save itself some headache and maybe avoid further mistakes.

Evolving Targets

Nowhere is this rapid evolution in ransomware more apparent than in the study of ransomware targeting. Early versions of ransomware targeted home computer users almost exclusively. It was very rare to hear about a company being infected with ransomware. Ransomware is still delivered in large numbers to home users, with hacker groups, like the group behind Locky, indiscriminately spamming people hoping to get a successful infection and even occasionally someone who will pay them.

But it wasn’t long before hacker groups realized that organizations were more likely to pay ransoms to get their systems up and running again. Mass spam campaigns quickly turned into phishing campaigns and those campaigns started to see some success. This strategy makes sense, especially for ransomware delivered as an attachment. Many home users don’t have Microsoft Office installed on their computers, but almost every organization does. Given the popularity of Microsoft Office documents as an attack vector, launching ransomware attacks against organizations was a logical step.

In addition to being a more natural fit, these types of infections tend to be newsworthy. When a hospital in California is infected with ransomware it is in the news for days or weeks. When multiple healthcare organizations are infected with ransomware in seeming rapid succession, it makes the news for months and stays in the public conscience; at least it weighs heavily on the minds of security teams. It also alerts the attackers to the fact that healthcare organizations are potentially vulnerable to attacks. In turn, the attacker groups begin aggressively targeting healthcare organizations for as long as they continue to see success.

Advanced Hacking Groups Move In

The attacks don’t stop with phishing though. As the more advanced hacking groups, the so-called advanced persistent threat (APT) groups, see that others are having success, they begin to use ransomware in their attacks, often with devastating effects. This was clearly illustrated by an attack on Lukas Hospital located in Neuss, Germany, where a more traditional attack group gained remote access to the network. They used that access to delete all backups and then attempted to use the hospital’s active directory service to automatically deliver ransomware to all of the workstations on the network using the domain controller and scheduled tasks, along with group policy objects (GPOs). This was a huge and potentially devastating attack that fortunately was not as successful as it could have been. What saved the hospital was a combination of quick reporting by affected victims and a quick response from the security staff. As soon as the security staff discovered that there were multiple systems under attack from ransomware, they disconnected everything from the network. It was an extreme response but one that probably saved the hospital millions of dollars.

Another hacking group is focused on taking advantage of known weaknesses in the JBoss Management Console. JBoss is an open source application server maintained by Red Hat. This group uses a customized ransomware family called Samas (also known as SamSam), ransomware developed as a .NET executable. The group gains access to the application server and then uses it to distribute the Samas ransomware. This is a very specific methodology but, given the number of vulnerable JBoss servers that are publicly reachable, it has proven successful.

The RAA ransomware is another ransomware family that specifically targets business users. First uncovered in June 2016, RAA was initially delivered as a .js spam attachment and targeted primarily at organizations in Russia (the campaign was distributed broadly, but the ransom note was written in Russian).⁷ The content of the spam was clearly directed at corporate users since it mentioned “overdue invoices.” As with most ransomware campaigns, RAA quickly evolved; and rather than simply delivering the spam as a .js attachment, they began delivering it as a password-protected ZIP file. This allows attackers to bypass many network email protection systems as well as most end-point antivirus software solutions.

Ransomware is also being used as a distraction tool by advanced attacker groups. Similar to the way distributed denial of service (DDoS) attacks are often used to mask a real attack, the same can be done with ransomware. If an attacker is trying to move stealthily through a targeted organization and is concerned that he may be discovered, it is trivial to launch a ransomware attack on a system that is not critical to the attacker’s access. Because the tactics and techniques of ransomware vice targeted attacks are so different, security teams will be looking for a completely different set of indicators, which allows the attack group to continue their activity unimpeded while the security team remains distracted.

Even teams that are not normally associated with financially motivated attacks have started getting involved in ransomware. Several security companies have noted ransomware activity from Chinese hacker groups that normally engage strictly in cyber espionage activity.⁸ There is some speculation that the September 2015 pact between the United States and China has contributed to the increase in ransomware attacks by traditionally Chinese espionage-focused threat actors. In the agreement that President Obama and President Xi Jinping signed, both countries agreed that cyber espionage activity would have limited scope and would not involve economic activity. Since the agreement there has a been a noticeable drop-off in Chinese cyber espionage activity, but the hacker groups still exist. That has led to speculation that it is these groups that have taken to using ransomware to replace lost income.

What does all this mean? While “everyone” is still a target for ransomware, developers and the groups have begun to focus more specifically on organizations, rather than individual users. These attacks tend to be more profitable, since organizations are more likely to pay and to pay larger sums. While a typical home user may pay up to the equivalent of a few hundred dollars to decrypt an infected machine, an organization will often pay tens of thousands, even hundreds of thousands, of dollars to decrypt and retrieve their data.

Different RaaS Models

There are several types of RaaS models available to “wannabe hackers.” Some of these are surprisingly simple, like the one in Figure 3-1. In the ad, the developer of the Encryptor ransomware provides details about the ransomware for potential customers, including screenshots and what the customer can customize in the delivery. The developer also discusses how successful the campaigns have been so far and how much his customers have made, as well as how much the developer has made.

This is an example of an easy-to-find RaaS campaign that was heavily advertised on various TOR sites for a tool that was not very effective (in fact, the Encryptor RaaS infrastructure was completely shut down by authorities in September 2016 and all of their servers were seized). While there are other, much more effective ransomware services out there, this model of service offering is one that is used most often. The developer builds the ransomware and uses a control panel to let customers configure it, never giving the customer direct access to the binary. Rather than paying the developer to launch a ransomware campaign, the developer just takes a cut from every victim who pays. The customer of the RaaS provider has to provide a list of emails to target.

Other RaaS offerings include different perks. For example, the ransomware family ORX-Locker took a page from the multilevel marketing businesses that are popular today and offered a 3% referral fee for ransom brought in from someone referred by an existing user. The ORX-Locker team also offered 24/7 support via chat and email for their customers who were running into problems.

While the Encryptor and ORX-Locker were rather immature RaaS offerings, newer variants have improved not only backend systems but also the ransomware itself. The hacking team behind the Cerber ransomware not only developed a well-designed user interface for their customers, including up to the minute automated tracking of payments and the ability to set different ransom amounts for each campaign, they also developed effective ransomware code with none of the amateur flaws found in the Encryptor RaaS and ORX-Locker code.

These types of distribution models are generally known as affiliate models, which was referenced in the discussion of the Locky ransomware. Sophisticated hacker teams offer more advanced capabilities as part of their RaaS. These groups also cater to more sophisticated customers. The Cerber ransomware RaaS is one such example. In order to sign up a customer must provide references and proof of access to a working exploit kit. This ensures that the Cerber code is less likely to be mishandled by someone who is new to the world of hacking.

Figure 3-1. An ad on a TOR-enabled website for the Encryptor ransomware

RaaS has become so commonplace in underground forums and marketplaces that even hacker groups not normally associated with ransomware have started bundling those services in with the other services they offer. Figure 3-2 shows an ad from a group simply calling themselves Russia Hackers, who are offering to create a customized CTB-Locker variant for two bitcoins. Note that the offer is nestled between offers to change someone’s grades and to launch a DDoS attack.

Figure 3-2. Hackers selling customized versions of CTB-Locker

The Russia Hackers and CTB-Locker teams are not offering any backend support. Instead, they deliver the ransomware binary, and the customers are responsible for managing the distribution, most likely using their own exploit kit or spamming tool. There are some customizable features that can be built into the binary, but that is the extent of the involvement of the team selling the binary. Note that the group Russia Hackers is not the hacking team that originally developed the CTB-Locker. The hacking group behind CTB-Locker actually sells kits for around $3,000. For $3,000, the buyers get support in getting their ransomware business up and running, as well as recommendations for delivery mechanisms and suggested ransoms. The buyer is also able to create an affiliate program and sell variants of CTB-Locker to others who want to get into the ransomware business.

RaaS makes it easier for newer hackers to quickly get into the ransomware delivery business and possibly raise money quickly, although most hackers make very little, if any, money. RaaS also makes it more difficult for security teams, whether they are working for a security vendor or trying to protect a network, to stop the ransomware threat.

RaaS Disrupts Security Tools

As discussed earlier in this section, the best way to stop ransomware is to do it before the ransomware is installed. Whether that is blocking a bad domain or IP address or preventing the loader that will retrieve the ransomware from installing, the earlier a ransomware (or any) attack can be stopped, the better. Unfortunately, with RaaS, that is more difficult to do. Each customer of the RaaS service, the wannabe hackers, will have a different set of targets; and many will have different delivery mechanisms, which makes it harder to tie a ransomware family to specific TTPs, and ultimately makes it harder to take preventative steps to stop the ransomware. This is exemplified by the evolution of Locky from being delivered via a simple Microsoft Office document with macros to being delivered using a number of exploit kits. Multiple TTPs, often happening simultaneously, make it more difficult to identify patterns in targets, and delivery mechanisms and can slow down reporting of effective methods for stopping the ransomware.

Think about it: if a particular family of ransomware has traditionally been delivered to targets in North America via spam attachments in a ZIP file, it is somewhat easy for a security team to mitigate this threat. But if that same ransomware is now being served via compromised banner ads on legitimate websites, security teams now have to reverse engineer the ransomware and look at its behavior to determine if it is a new family of ransomware or just a new strain of an existing family.

Remember, whether the discussion is ransomware or some other form of malware, a piece of malicious code is seen an average of six times in the wild by various security vendors before it is changed. There are a number of obfuscation techniques that sophisticated, and even unsophisticated, attackers use to alter the appearance of their ransomware or other malware to avoid being detected by traditional antivirus signatures. The executable itself may use the same things, but it looks different to the underlying operating system and to many security programs. A piece of ransomware delivered two different ways by two different groups will look, superficially, like two different programs. It is only upon close analysis that security teams will be able to determine that they are the same.

This is because the fundamentals of the ransomware don’t change between variants (with the exception, of course, of version changes, where there can be significant behavioral changes). Both ransomware variants will still use the same encryption schemes; they will both encrypt the same set of files; they will both make the same registry changes; they will both append the same extensions to the end of the newly encrypted files; and there will be more similarities than differences in behavior.

Why does any of this matter? After all, ransomware is ransomware—if a person or organization is infected, they are stuck; it doesn’t matter if it is Locky, CryptXXX, or some brand new ransomware no one has seen, right? Not exactly. Knowing which ransomware has hit a target system goes a long way toward determining the course of action.