Upload File

threat landscape - stallion.lv · why ransomware? •valueof’stolenrecords’has’declined...

  • Home
  • Documents
  • THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of
28
1 | © 2016, Palo Alto Networks. Confidential and Proprietary. T HREAT L ANDSCAPE Mikko Kuljukka Systems Engineer Palo Alto Networks

Upload: haque

Post on 07-Sep-2018

215 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

1 | © 2016, Palo Alto Networks. Confidential and Proprietary.

THREAT LANDSCAPE

Mikko KuljukkaSystems EngineerPalo Alto Networks

Page 2: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Ransomware

2 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 3: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Bitcoin USD rates

How big of a problem?

• $1 billion in 2016

• >6 million unique samples

• >55 million sessions

• >100 families.

• Typical payment is 1 BTC;; tailored for organizations.

• Targeted attacks seen, butlargely victim agnostic.

3 | © 2017, Palo Alto Networks.

AutoFocus: Ransomware Total

Page 4: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Why ransomware?

• Value of stolen records has declined

• Monitored by financial authorities and law enforcement

• PoS systems form a sub-­set of the total target

• Motivation to pay

• Anonymity -­ Bitcoin and Tor

• MaaS / RaaS lowers cost-­of-­entry, fuels ecosystem

4 | © 2017, Palo Alto Networks.

Page 5: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

KeRanger

• First discoveredransomware forMac OS.

• Authors back-­doored a popular BitTorrent clientfor OSX in early 2016.

• It attempted to encrypt about 300 types of files after 72 hours.

5 | © 2017, Palo Alto Networks

Page 6: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Samsa / SamSam

• Targeted campaign from 2016.

• Leveraged unpatched instancesof JBoss to spread.

• Ransom reached around45 BTC (approximately $20,000).

• Almost 100 distinct samples.

• Diversifying in target verticals & attack/spread techniques.

• Profits over $500k6 | © 2017, Palo Alto Networks.

Page 7: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

7 | © 2017, Palo Alto Networks.

Cerber Armenia, Azerbaijan, Belarus, Georgia, Kyrgyzstan, Kazakhstan, Moldova, Russia, Turkmenistan, Tajikistan, Ukraine, Uzbekistan

Page 8: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

8 | © 2017, Palo Alto Networks.

Locky

Page 9: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

• Jaff ransomware

• Distributed through similar channels as Locky and Dridex

• Using different key derivation format from Locky

• Capable of offline decryption.

• DOCM file embedded in PDF

• PDF uses JavaScript to load DOCM

9 | © 2015, Palo Alto Networks. Confidential and Proprietary.

LOCKY -­> JAFF (DOCM -­> PDF(DOCM))

Page 10: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

• Friday May 12th, 2017

• v2.0 of WanaCrypt0r, spreading using SMB protocol exploit

• Kill switch

• 17th May: 36 BTCs (~$63k) in multiple wallets• Ransom of ~$300 infers ~210 victims

10 | © 2015, Palo Alto Networks. Confidential and Proprietary.

WanaCrypt0r (Wanacry, Wcry)

Page 11: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

WanaCrypt0r

• Initial attack vector indications (theories):• Spam and/or phishing email.• Direct attack against MS17-­010• RDP

• Port 445 scans on local networks and random external IP ranges.• Checks all IPs on the class-­C network of each given vulnerable host

• No C2 per se

• Uses TOR network to communicate encryption keys

• DOUBLEPULSAR backdoor reportedly used to execute the malware after successful ETERNALBLUE exploitation

11 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Page 12: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

WanaCrypt0r Exploit

• EternalBlue vulnerability (CVE-­2017-­0144) on Windows • SYSTEM-­level remote code execution (RCE) in the handling of the Server Message Block (SMB) protocol

• Publicly disclosed in Equation Group dump by Shadow Brokers in their 5thleak, April 14th 2017

• Microsoft patch available in March 2017 (MS17-­010)

12 | © 2015, Palo Alto Networks. Confidential and Proprietary.

Page 13: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

EternalRocks

• Wannacry exploits + 5 more

• Sleeps for 24h and downloads Tor for C2

• No apparent kill switch

• Does not contain any malicious payload yet

13 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 14: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Ransomware trends

• Indiscriminate high-­volume / low-­ransom attacks continue to be popular

• Social engineering is heavily used

• Targeted, high-­value ransom is on the rise.

• Database attacks:

• NoSQL: MongoDB’s default security settings

• SQL: MySQL, bruteforce passwords

• RaaS

• IOT on the horizon

14 | © 2017, Palo Alto Networks.

Page 15: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Ransomware trends and oddities

• Non-­financial (coercion) ransom

• Pop-­corn time

• Jigsaw

• Doxware / When backups don’t matter3

“Dox: search for and publish private or identifying information about (a particular individual) on the Internet, typically with malicious intent.”

15 | © 2017, Palo Alto Networks.

In order to have relationship with us, and pay the ransom;must go the following steps.1. Launch a subdomain named:

killxxxxxx.xxxxxx.xxx.xx2. Make a txt file named:

Ransomware.txt including:

Page 16: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Banking Trojans

16 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 17: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Banking Trojans

• User gets infected the normal way

• Trojan starts to monitor when user visits supported sites

• Trojan captures PINs and/or uses webinjects to change or add to user’s input

• Trojan mimics the real site and “proxies” user’s input to them

17 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 18: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Banking Trojans

• Less money than ransomware

• Stealthier

• Needs more sophistication and customization than ransomware

• Very old strains still alive too• Zeus (2007)• Dridex (2014)• Ursnif/Gozi (2007)• Xbot (Android)

18 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 19: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

IOT

19 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 20: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Why IOT?

• Lifecycle of a thermostat is longer than that of a laptop

• In some cases they are impossible to patch

• In most cases, no endpoint protection

• Unless the attack is destructive or impairing, users might not notice

• Owners don’t care, don’t realize the threat

• Vendors don’t care, don’t realize the threat

• Lots of default passwords because of 2 above

20 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 21: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Botnet platforms

• Leet• 650Gbps and 150 Mpps

• Mirai• 280 Gbps and 130 Mpps

• Easy money for the herders

21 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 22: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

IOT Ransomware

22 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 23: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Malware delivery

23 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 24: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Delivery methods

• Filename.pdf_______________.exe still a good choise

• Regular purchase_order.exe :s work well too

• Malicious scripts in documents that rely on user approval

• Phishing

• Exploits and exploit kits valid for real actors due to the cost

• Shadow Brokers 0-­day subscription service• $21k/month

24 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 25: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Protection

25 | © 2016, Palo Alto Networks. Confidential and Proprietary.

Page 26: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

26 | © 2016, Palo Alto Networks. Confidential and Proprietary.

The three threat vectors by D. Rumsfeld

• IPS

• AV

• URLF

• Threat feeds

• Sandboxing

• User Education

• Technique blocking

• Automated defences

• Layered defence

• Segmentation

• Surface reduction

• Behavioral analysis

Known Knowns Known Unknowns Unknown Unknowns

Page 27: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

COMPLETEVISIBILITY

REDUCEATTACKSURFACE

PREVENTKNOWNTHREATS

PREVENTUNKNOWNTHREATS

27 | © 2017, Palo Alto Networks. Confidential and Proprietary.

PREVENTING SUCCESSFUL ATTACKS

Page 28: THREAT LANDSCAPE - stallion.lv · Why ransomware? •Valueof’stolenrecords’has’declined •Monitored’by’financial’authorities’and’law’enforcement •PoSsystemsform’a’subRset’of

Next-­Gen Security Platform

28 | © 2016, Palo Alto Networks. Confidential and Proprietary.


Healthcare Data Under Siege - ThreatSTOP › sites › default › files › healthcareransomware_… · Healthcare Data Under Siege: Ransomware and the Cyber Threat Landscape. Introduction

Defend Your Data from Ransomware Attacksdiscover.zyxel.com/rs/471-TTL-126/images/Ransomware...Defend Your Data from Ransomware Attacks The Threat of Ransomware The WannaCry attack

Ransomware: Evolution & Cyber Threat Landscapepages.accudatasystems.com/rs/729-XKH-207/images/Ransomware - … · 2 –M-Trends 2015: A View from the Front Lines. RANSOMWARE: THREATACTORS,

Cyber Threat Landscape - ETDA · 2019-06-21 · Top four cyber threats ... ransomware. • Still a threat in the region: Asia Pacific encounter rate was 40% more than the global average

Ransomware Threat Information Briefing - NIST · PDF file · 2016-12-01– Malvertisement • Targeted ... Ransomware Threat Information Briefing Author: William Wright, Symantec

MOBILE THREAT LANDSCAPE REPORTEvolving Threat Classes Remote Access Tools Banking Trojans Access Facilitation Ransomware Cryptomining Geographic Variations in the Threat Landscape

Is Your MSP Offering Able to Protect Against the Latest ... · Real Threats –Current Threat Landscape Source: Webroot Threat Research 2018 Malware & PUAs Ransomware RDP Incursions

Ransomware and Digital Extortion - EXPLORE 2020 · •Overview of Ransomware/Digital Extortion and the Threat to Healthcare Industry •Case Studies of Healthcare Ransomware Attacks

Global Internet Security Threat Landscape 2018...2018/08/28  · Global Internet Security Threat Landscape 2018 ITU Workshop on Advanced Cyber Security Attacks and Ransomware Thomas

Evolving Threat Landscape

THE RISE OF RANSOMWARE AND ITS THREAT TO THE LEGAL … · 2017. 10. 9. · THE RISE OF RANSOMWARE AND ITS THREAT TO THE LEGAL PROFESSION @ICSGetsIT. RANSOMWARE AND SECURITY BREACHES:

Ransomware Threat Report : WannaCry fileRansomware Threat Report : WannaCry IN-DEPTH COVERAGE AND INSIGHTS OF THE WANNACRY RANSOMWARE FROM ARMOR’S SECURITY EXPERTS

2021 Ransomware Threat Report

Protecting Your Network from Malware - Akamai...Protecting Your Network from Malware The threat landscape is becoming increasingly hostile. Malware and ransomware campaigns, phishing

Minimizing the threat of Ransomware with enterprise file services

Ransomware: 2016's Greatest Malware Threat

Healthcare Data Under Siege: Ransomware and the Cyber ... › sites › default › files › threatstop... · Healthcare Data Under Siege: Ransomware and the Cyber Threat Landscape

Ransomware Cyber Threat Acronis Infographicdownload.acronis.com/...Ransomware_Threat_Acronis... · RANSOMWARE THE NEW CYBER THREAT AND HOW TO STOP IT RANSOMWARE: hackers hold your

ENISA Threat Landscape - Prisa Digitalboletines.prisadigital.com/ENISA Threat Landscape Published.pdf · 4 ENISA Threat Landscape Responding to the Evolving Threat Environment 2 Introduction

MAPPING THE RANSOMWARE LANDSCAPE - Bitpipedocs.media.bitpipe.com/io_13x/io_136805/item_1514155/WP...MAPPING THE RANSOMWARE LANDSCAPE Understanding the Scope and Sophistication of the

Ransomware Threat Report

SamSam Ransomware Campaigns - … Ransomware Campaigns Secureworks® Counter Threat Unit™ Threat Intelligence Release date: THURSDAY, FEBRUARY 15, 2018 Summary In ®late 2015, Secureworks

Ransomware Threat Report : WannaCry · Ransomware Threat Report : WannaCry IN-DEPTH COVERAGE AND INSIGHTS OF THE WANNACRY RANSOMWARE FROM ARMOR’S SECURITY EXPERTS

ENISA Threat Landscape

The Ransomware Threat is Evolving - cdn.buttercms.com

Threat Landscape vs Threat Management › library › Files › HRA18 › TrendMicro... · Targeted Attacks Mobile Attacks 2015 Destructive Attacks/ Ransomware 2016 Business Email

RANSOMWARE THREAT LANDSCAPE OVERVIEW - FireEye · 2016-05-10 · RANSOMWARE THREAT LANDSCAPE OVERVIEW KEY POINTS • Since mid 2015, ... distribution of their payload—to “one-stop

A New Era of Cyber Threats: The Shift to Self-Learning ...€¦ · Insider Threat Data Exfiltration Ransomware Zero-Day Data Manipulation Sophisticated Threat Landscape. ... Seek

HC3 Intelligence Briefing Update Ransomware Threat to

Ransomware - The Growing Threat

The New Threat on Campus: Ransomware Locks Down Education

CTERA Minimizing the threat of Ransomware with enterprise file services

No Stone Unturned - Kaspersky Internet Security · Leaving no stone unturned – protection against ransomware with Kaspersky The threat landscape is constantly developing, and Kaspersky

Malware Year in Review - Cofense€¦ · the early months of 2016, only diminishing as the ransomware trend in 2016 brought numerous other ransomware utilities onto the threat landscape

BOARDISH INSIGHTS & ANALYTICS REPORT · 2020-04-11 · BOARDISH INSIGHTS & ANALYTICS REPORT March 2020. Contents 3 Introduction 4 The Threat Landscape ... was Ransomware which has