The deployment of ransomware is the endgame of a cyber-attack. A threat actor must have accomplished several previous steps – including lateral movement and privilege escalation – to reach this final position. The ability to detect and counter the early moves is therefore just as important as detecting the encryption itself.
Attackers are using diverse strategies – such as ‘Living off the Land’ and carefully crafting their command and control (C2) – to blend in with normal network traffic and evade traditional security defenses. The analysis below examines the Tactics, Techniques and Procedures (TTPs) used by many ransomware actors by unpacking a compromise which occurred at a defense contractor in Canada.
Phases of a ransomware attack
Figure 1: Timeline of the attack.
The opening: Initial access to privileged account
The first indicator of compromise was a login on a server with an unusual credential, followed by unusual admin activity. The attacker may have gained access to the username and password in a number of ways, from credential stuffing to buying them on the Dark Web. As the attacker had privileged access from the get-go, there was no need for privilege escalation.
Lateral movement
Two days later, the attacker began to spread from the initial server. The compromised server began to send out unusual Windows Management Instrumentation (WMI) commands.
It began remotely controlling four other devices – authenticating on them with a single admin credential. One of the destinations was a domain controller (DC), another was a backup server.
By using WMI – a common admin tool – for lateral movement, the attacker opted to ‘live off the land’ rather than introduce a new lateral movement tool, aiming to remain unnoticed by the company’s security stack. The unusual use of WMI was picked up by Darktrace and the timings of the unusual WMI connections were pieced together by Cyber AI Analyst.
Models:
- New or Uncommon WMI Activity
- AI Analyst / Extensive Chain of Administrative Connections
Establish C2
The four devices then connected to the IP 185.250.151[.]172. Three of them, including the DC and backup server, established SSL beacons to the IP using the dynamic DNS domain goog1e.ezua[.]com.
The C2 endpoints had very little open-source intelligence (OSINT) available, but it seems that a Cobalt Strike-style script had used the endpoint in the past. This suggests complex tooling, as the attacker used dynamic SSL and spoofed Google to mask their beaconing.
Interestingly, through the entirety of the attack, only these three devices used SSL connections for beaconing, while later C2 occurred over unencrypted protocols. It appears these three critical devices were treated differently to the other infected devices on the network.
Models:
- Immediate breach of Anomalous External Activity from Critical Network Device, then several model breaches involving beaconing and SSL to dynamic DNS. (Domain Controller DynDNS SSL or HTTP was particularly specific to this activity.)
The middle game: Internal reconnaissance and further lateral movement
The attack chain took the form of two cycles of lateral movement, followed by establishing C2 at the newly controlled destinations.
Figure 2: Observed chain of lateral movement and C2.
So, after establishing C2, the DC made WMI requests to 20 further IPs over an extended period. It also scanned 234 IPs via ICMP pings, presumably in an attempt to find more hosts.
Many of these were eventually found with ransom notes, in particular when the targeted devices were hypervisors. The ransomware was likely deployed with remote commands via WMI.
Models:
- AI Analyst / Suspicious Chain of Administrative Connections (from the initial server to the DC to the hypervisor)
- AI Analyst / Extensive Suspicious WMI Activity (from the DC)
- Device / ICMP Address Scan, Scanning of Multiple Devices AI Analyst incident (from the DC)
Further C2
As the second stage of lateral movement stopped, a second stage of unencrypted C2 was seen from five new devices. Each started with GET requests to the IP seen in the SSL C2 (185.250.151[.]172), which used the spoofed hostname google[.]com.
Activity started on each device with HTTP requests for a URI ending in .png, before a more consistent beaconing to the URI /books/. Eventually, the devices made POST requests to the URI /ebooks/?k= (a unique identifier for each device). All this appears to be a way of concealing a C2 beacon in what looks like plausible traffic to Google.
In this way, by encrypting some C2 connections with SSL to a Dynamic DNS domain, while crafting other unencrypted HTTP to look like traffic to google[.]com, the attacker managed to operate undetected by the company’s antivirus tools.
Darktrace identified this anomalous activity and generated a large number of external connectivity model breaches.
Models:
- Eight breaches of Compromise / HTTP Beaconing to New Endpoint from the affected devices
Accomplish mission: Checkmate
Finally, the attacker deployed ransomware. In the ransom note, they stated that sensitive information had been exfiltrated and would be leaked if the company did not pay.
However, this was a lie. Darktrace confirmed that no data had been exfiltrated, as the C2 communications had sent far too little data. Lying about data exfiltration in order to extort a ransom is a common tactic for attackers, and visibility is crucial to determine whether a threat actor is bluffing.
In addition, Antigena – Darktrace’s Autonomous Response technology – blocked an internal download from one of the servers compromised in the first round of lateral movement, because it was an unusual incoming data volume for the client device. This was most likely the attacker attempting to transfer data in preparation for the end goal, so the block may have prevented this data from being moved for exfiltration.
Figure 3: Antigena model breach.
Figure 4: Device is blocked from SMB communication with the compromised server three seconds later.
Models:
- Unusual Incoming Data Volume
- High Volume Server Data Transfer
Unfortunately, Antigena was not active on the majority of the devices involved in the incident. If in active mode, Antigena would have stopped the early stages of this activity, including the unusual administrative logins and beaconing. The customer is now working to fully configure Antigena, so they benefit from 24/7 Autonomous Response.
Cyber AI Analyst investigates
Darktrace’s AI spotted and reported on beaconing from several devices including the DC, which was the highest scoring device for unusual behavior at the time of the activity. It condensed this information into three incidents – ‘Possible SSL Command and Control’, ‘Extensive Suspicious Remote WMI Activity’, and ‘Scanning of Remote Devices’.
Crucially, Cyber AI Analyst not only summarized the admin activity from the DC but also linked it back to the first device through an unusual chain of administrative connections.
Figure 5: Cyber AI Analyst incident showing a suspicious chain of administrative connections linking the first device in the chain of connections to a hypervisor where a ransom note was found via the compromised DC, saving valuable time in the investigation. It also highlights the credential common to all of the lateral movement connections.
Finding lateral movement chains manually is a laborious process well suited to AI. In this case, it enabled the security team to quickly trace back to the device which was the likely source of the attack and find the common credential in the connections.
Play the game like a machine
To get the full picture of a ransomware attack, it is important to look beyond the final encryption to previous phases of the kill chain. In the attack above, the encryption itself did not generate network traffic, so detecting the intrusion at its early stages was vital.
Despite the attacker ‘Living off the Land’ and using WMI with a compromised admin credential, as well as spoofing the common hostname google[.]com for C2 and applying dynamic DNS for SSL connections, Darktrace was able to identify all the stages of the attack and immediately piece them together into a meaningful security narrative. This would have been almost impossible for a human analyst to achieve without labor-intensive checking of the timings of individual connections.
With ransomware infections becoming faster and more frequent, with the threat of offensive AI looming closer and the Dark Web marketplace thriving, with security teams drowning under false positives and no time left on the clock, AI is now an essential part of any security solution. The board is set, the time is ticking, the stakes are higher than ever. Your move.
Thanks to Darktrace analyst Daniel Gentle for his insights on the above threat find.
IoCs:
IoCComment185.250.151[.]172IP address used for both HTTP and SSL C2goog1e.ezua[.]comDynamic DNS Hostname used for SSL C2
Darktrace model detections:
- AI Analyst models:
- Extensive Suspicious WMI Activity
- Suspicious Chain of Administrative Connections
- Scanning of Multiple Devices
- Possible SSL Command and Control
- Meta model:
- Device / Large Number of model breaches
- External connectivity models:
- Anonymous Server Activity / Domain Controller DynDNS SSL or HTTP
- Compromise / Suspicious TLS Beaconing to Rare External
- Compromise / Beaconing Activity To External Rare
- Compromise / SSL to DynDNS
- Anomalous Server Activity / External Activity from Critical Network Device
- Compromise / Sustained SSL or HTTP Increase
- Compromise / Suspicious Beaconing Behaviour
- Compromise / HTTP Beaconing to New Endpoint
- Internal activity models:
- Device / New or Uncommon WMI Activity
- User / New Admin Credentials on Client
- Device / ICMP Address Scan
- Anomalous Connection / Unusual Incoming Data Volume
- Unusual Activity / High Volume Server Data Transfer
![External Sites Summary Graph showing the rarity of the hostname “92n7au[.]uhabq9[.]com” on a customer network.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/670d96b065612663d098df74_670d956f4dda5eb6ac9e650f_Screenshot%25202024-10-14%2520at%25203.04.22%25E2%2580%25AFPM.png)
![Screenshot of a Model Alert Event log showing a device connecting to the endpoint “is5jg[.]3zweuj[.]com” over port 32091.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/670d96b065612663d098df7d_670d959854eb594420fdc971_Screenshot%25202024-10-14%2520at%25203.05.03%25E2%2580%25AFPM.png)
![Screenshot of a Model Alert Event Log showing the device posting the string “i8xps1” to the hostname “72zf6.rxqfd[.]com.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/670d96b065612663d098df80_670d95c562c6e392c7dc3ba8_Screenshot%25202024-10-14%2520at%25203.05.49%25E2%2580%25AFPM.png)
![Screenshot of a Model Alert Event Log showing the device posting the string “sqyjyadwwq” to the hostname “9yrh7.mea5ms[.]com”.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/670d96b065612663d098df7a_670d95e4b1dbad771717553c_Screenshot%25202024-10-14%2520at%25203.06.20%25E2%2580%25AFPM.png)
