By Tonia Dudley
For several years, Cofense Intelligence has been predicting the threat of ransomware increasing. Organizations have barely been able to catch their breath from the SolarWinds breach and agency alerts on infrastructure vulnerabilities that needed to be patched.
We’ve come a long way from the days of advanced persistent threats (APT) when organizations kept attacks on the down-low; assumptions were made when suits would show up or statements were issued by major incident response firms. Remember the few years when “APT” made it to the buzzword bingo at RSA? We’ve seen some of the recent major incidents, such as SolarWinds, Colonial Pipeline, JBS and Fujifilm described in great detail that resemble an APT attack, yet without calling it APT.
Today, we’re in the era of ransomware attacks becoming more pervasive, with threats of leaking sensitive data if payment isn’t made. Historically, organizations would try to remediate the ransomware attack quietly or find a way to avoid payment. However, threat actors have found a way to increase their chances of payment – threaten to leak sensitive data with evidence to back up their threat. And it keeps happening.
With the increased focus in the headlines, certainly boards and executives are asking about the risk of exposure if an organization experienced a ransomware attack. There are a couple of resources that provide a holistic approach to preparing your organization for an attack — from US Cybersecurity and Infrastructure Security Agency (CISA) and UK National Cyber Security Centre (NCSC). These are both long-term strategy programs to implement, but we want to provide some quick steps you can take to prepare your organization in the meantime.
What We’ve Seen
As we noted in our blog last fall with the Ryuk threat, the initial delivery stage happens much earlier than the execution of the ransomware delivery, sometimes weeks or even months. While we continue to observe credential phishing as the top threat targeting organizations, we also analyze various stage 1 droppers that can lead to multiple stages of delivering malware or other malicious content. The secure email gateways (SEGs) have greatly improved their detection of file attachments to execute the malicious code, so threat actors have shifted to leveraging trusted hosting providers for delivery.
In Figure 1, we see the use of a zip file attachment with the password included in the message body. But notice they didn’t spell out “password”, most likely to avoid algorithms that look for word patterns. In a blog post from February, FireEye provides a deep analysis of the ICEID threat that can lead to ransomware. Cofense customers can stay ahead of this threat by preparing employees to first identify this suspicious message and quickly report it to their SOC. With the use of the API from our Intelligence, they can also publish the IOCs to their TIP to block execution at the endpoint or the network proxy. The IOCs provided also allow them to alert via the SIEM alerts for existing infections. With the added feature of Auto Quarantine, customers with Cofense Vision installed are able to trap these messages immediately when they hit the inbox.
Figure 1 – IceID Stage 1
As organizations continue to build a robust information security program, one of the metrics that is key to measuring the maturity of the program is mean time to detection (MTTD). For phishing attacks, MTTD can be reduced through effective conditioning of end users to identify phishing threats and report them. In fact, according to the Cofense Phishing Defense Center (PDC), 52% of well-conditioned users reported within five minutes of a suspicious email landing in their inbox. Learn more about Managed Phishing Detection and Response here.
