A few years ago, Sri Lankan enterprises were fortunate that they only had to learn about cyber-attacks, such as ransomware, through media and Tech blogs, depicting horrifying stories on how such attacks brought large enterprises to their knees. Attackers forced helpless organizations, which were large in size and significant in terms of brand, to pay massive amounts of ransom to retrieve their stolen data. These organizations were heavily dependent on information technology to carry out their work. Many of us didn’t think such attacks would hit home due to a perception that we may be less appealing to such attackers. But that has changed. The question that organizations face is not “if a cyber-attack will happen?” rather “when will a cyber-attack happen?”
The Ins and Outs of Ransomware-Attacks in Sri Lanka
Many customers have recently reached out to us when they were hit by such an attack or when they suspected they were being attacked. Therefore, we have had our fare-share of experience in helping organizations to identify, respond, protect themselves, and recover from these cyber security incidents. When there’s news of a cyber-attack close to home, customers often reach out to us and ask questions such as – What actually happened, Do you know how we can check if we will be targeted, What do we need to do to make sure we will not be victims. Taking all of this into consideration, we wanted to share our experiences in dealing with such attacks, explain how these generally happen and possible preventive measures you can take to protect your organization.
From what we’ve gathered, most of these attacks have the following major steps, which I have explained below:
1. Initial compromise
2. Privilege escalation
3. Lateral movement
4. Persistence
5. Data theft (Less Common)
6. Payload detonation
The Initial Compromise is where the attackers gain access into your network, and there could be many ways in which this could happen. It could be as easy as brute forcing a Remote Desktop (RDP) session you have opened to the Internet to help with your remote working or it could by exploiting any zero-day vulnerability (or a very recently discovered vulnerability which hasn’t been patched) of your Internet facing webserver. A few ways to reduce the risk of the initial compromise is to expose Remote Sessions via a secure remote access VPN (with multifactor authentication), make sure you regularly patch your Internet server and ensure you do not expose unwanted services to the Internet.
Once the attacker gains access to your network, they explore to understand what sort of activities can be performed on that network. In most cases, the attacker tends to perform what’s called Privilege Escalation – in simpler terms, this means they try to elevate their level of access. To do this, they would try out methods such as guessing the passwords (Yes, mycompany@123 can be a very common password) or look for passwords stored in text files (Yes, this sounds very trivial, but the truth is when administrators force you to maintain strong passwords we often resort to simple means of remembering them, i.e. text files) or more complex methods such as running exploitation tools like mimikatz to steal credentials. The higher the access the attacker gets, the more damage they can do to a network. As a preventive measure, you can always try to force users to use complex passwords and educate them on how to keep the passwords safe. You could also monitor your user activity to detect abuse and misuse.
The next step of the attack is the Lateral Movement. In other words, once the attacker gains higher privileges on your network, it starts spreading the payload to all possible victim devices to cause more harm than damaging a single machine. Many would ask what makes a ransomware attack so devastating? The answer is its behavior of launching attacks on multiple devices within a small timeframe. This is what makes them so devastating and enables them to bring down organizations within a few minutes or hours. Most attackers utilize vulnerabilities on your network (e.g. the eternalblue exploit) or they would abuse legitimate tools to spread the payload. The abuse of legitimate tools can be very hard to detect as in most cases since the activity is done in such a manner that it mimics legitimate user behavior. Therefore, it’s very difficult to differentiate if the entire activity is malicious or not without proper context. For example, consider an attacker gaining access to the server that you use to distribute software in your organization. They can use this same tool to distribute the malware as well. A few methods of detecting and preventing lateral movement would be to properly segment user privileges, make sure all your devices have UpToDate security patches, your network is properly segmented and firewalled (a common thing we see is that although you tend to protect your network from the external entities, you rarely practice segmentation internally. Hence, when a network gets compromised, it is easy for the attacker to travel within your network), monitor suspicious usage of privileged accounts and limit what privileged accounts could do in your network.
The next step of the attack would be to make themselves Persistent in your environment. Many attackers put in a lot of effort to gain access to your network and the effort is mostly proportional to the amount of security you maintain on the network. Once this is done, the attacker would hate to lose access via a reboot or change of credentials or other interruptions. Hence, they deploy methods such as using the group policy feature of windows environments, registering as a service, creating scheduled tasks, and creating new accounts to make sure they will not lose their control abruptly. A few methods of detecting and preventing such attempts would be to limit what actions user accounts can perform, monitoring suspicious user creations (e.g. users created during off hours) and monitoring group policy or other services related changes.
Before moving to the final stage of the attack, attackers may opt to steal your data – Data Theft. This isn’t a very common move, but we have witnessed some instances. If attackers sense that your data would have a substantial black-market value or that your brand image would be gravely damaged by certain information becoming public, then they would decide to exfiltrate your data. A common method of stealing data could be uploading the files to a file share site (it’s very common for administrators to allow file sharing sites to make their day-to-day work easy but keep in mind attackers too could exploit these same paths). The methods of preventing or minimizing such data loss would be to implement Rights Management Systems (this will help you to make sure that even if the data is exfiltrated the attacker cannot use it), implementing Data Loss Prevention Systems (will detect/prevent when data is been exfiltrated) and block file sharing sites that aren’t needed for work-related matters.
The final step of the attack would be Payload Detonation. Unfortunately, it’s at this stage most organizations learn that they have been attacked, and by the time the initial panic phase has passed, a lot of damage might have been done already.
There are two types of payloads that we have come across – Cryptominer and Ransomware. Cryptominers do not exhibit any visible damages on your machines and would rather utilize your resources such as CPU and RAM to perform crypto currency mining. In such a situation, you will notice heating up, slow performance, huge bills for your cloud consumption, and abrupt crashing of your devices.
Ransomware is the more devastating type of payloads we see. It will start encrypting the commonly used file types, such as documents, videos and photos, and at the end, it will display a note stating what the attackers have done, laying out their demands, what will happen if you do not comply, and in case you want to comply how the money should be transferred. Attackers use crypto currency as the medium of paying ransoms as this method is more difficult or impossible to trace. Once the ransomware is detonated, it could effectively bring down your entire IT infrastructure. It could encrypt the end user devices as well as the servers that host your critical systems, such as application servers, database servers and email servers. In case the attacker has stolen your data, this is the stage where they will communicate to you about the ransom you need to pay to prevent the data from being released to the Internet. They would even go ahead and share a sample of the stolen data to make sure you know they’re serious.
Reputational Damage Is Far Worse Than Data Leaks
Many organizations do not opt to pay (or cannot afford to pay to recover everything that has been encrypted). Hence, they resort to restoring their systems from scratch, which takes a lot of time and effort. This, in turn, results in massive delays before the organization can get back online to serve their customers. Although the most visible damage of these attacks is done to the IT infrastructure, the biggest, unforeseen damages are to the brand identities of these organizations. News travels fast and bad news will travel even faster. No organization will ever want their names associated with such an event, and any negative media coverage and reputational damage could be made far worse by releasing your confidential data to the public domain.
A pertinent question customers ask during the final stage of an attack is “Why can’t my signature-based antivirus software detect this malicious file (payload)?” The answer is that in many scenarios, attackers change the signature (hash) of the payload before using it during the attack. Many legacy antivirus software solely depend on signature updates, and if the signature isn’t in the database, it is very easy for the attacker to bypass the antivirus tool.
Quick Detection, Quick Response and Strong Recovery Plan
Many organizations take a long time to detect such attacks. And when they do, it is sadly at the final stage of an attack. One main reason for this is that most customers utilize legacy detection mechanisms that have a very narrow visibility instead of adopting more current detection mechanisms which have a broader, in-depth view of the environment.
Based on our recent experiences and observations, many organizations take a long time to get their critical business services up and running or in other words, they take considerable amount of time to execute their business continuity plan (BCP). Moreover, although many organizations have satisfactory BCPs and DRPs (Disaster Recovery Plan) in place, almost all of them are rendered little or no use to safeguard from these attacks. Most of these plans have been formulated to protect organizations against events such as natural disasters, power failures, terrorist threats, assuming the backups will be available to start their recovery. Attackers generally know this and will start by targeting the backup systems as the initial attack points before moving toward other critical assets. This way the attackers know they can force the victim to pay up since they have no other means of recovering.
Another interesting fact about these attacks is that most of the activities happen either during early hours or during holidays. The main reason is that attackers try to leverage human weaknesses (even security operations centers are less alert during these times) to their advantage.
In summary, based on our observations, we can no longer consider Sri Lanka as a country with a very slim chance of being attacked. And these attackers seem to always find enough ways to circumvent defenses employed by most organizations and continue undetected till the very last stage. Many organizations need to rethink and plan their BCPs and DRPs to safeguard from ransomware attacks.
In the past, organizations believed in the concept of “Survival of the Strongest,” i.e. if you keep increasing your defenses, you can prevent any cyber-attack. But now, we believe organizations need to equally focus on the concept of “Survival of the Fastest,” which means it is inevitable that your organization will be targeted by an attacker sooner or later, and when that time comes, what matters is how fast you can detect, contain and recover. In other words, the speed at which you react to contain and recover from such an attack will define how your organization will withstand such an event.
