[Music]
so welcome again to this uh to this room
uh i'm still live still a liaison at
first
and i'll be introducing
vishal thakur from ankura from australia
who will be presenting
something about ransomware and the new
norm
in those days so vishal and even though
there's two names in the presentations
like
he will explain you why he's
[Applause]
alone g'day i'm
really glad to be here in dublin today
um
all the way from australia
just trying to escape the australian
winter
only to find out that dublin summer is
not that not that warm
but yeah really really glad to be here
and thanks for coming and
well i guess there's worse things that
could happen like booking your flights
with the australian national carrier
qantas
which my colleague and my quote speaker
john did and uh
he's not here today right so i got
cancelled last minute
so
it's gonna be just me
all right let's get into it
a quick intro as you can see uh
john couldn't make it
his flight golf cancel last minute
my name is vishal tucker i'm the senior
director for dfir
at the ankura dfir practice in australia
uh quick look through the agenda
we'll have a look at current ransomware
threat landscape the ransomware groups
that are active right now and what
motivates them
how to manage attacks real world cases
we'll dig into that couple of cases
we've got and
detection forensics best practices
insurance policy is very important
communication strategies again one of
the most important aspects of managing
ransomware attacks and
some resources for you
before i start just quickly
the title of the slide
as you can see sounds familiar um
ransomware has been around for for quite
quite a while now but uh i remember way
back in 2012 2013 um
we had a big incident and we were
brainstorming the whole team was there
and one of the senior
consultant just goes uh come on guys
just ran somewhere it's just a fair
it'll go away
as we all know it didn't go away it's
just evolved into something
much much bigger today and
it's just something that i don't see as
going away we'll just have to live with
it uh just like covid
uh we'll have to manage it and make sure
we can get through all these attacks as
best as we can
quick look at the current ransomware
landscape there's a as you as you must
know there's a lot of ransomware groups
operating at the moment
a lot of the targets of these as again
we all know uh our businesses and they
don't discriminate they just target
everyone but from a real world
scenario what we see a lot of it is um
they target individuals small businesses
a lot of energy like pretty much
everyone really
uh in the recent years we've seen a lot
of attacks on healthcare i
most of you in ireland would know that
last year you had a pretty big
incident with your healthcare
we've seen quite a few as well in
australia
supply chain attacks government
education
they're targeting basically everyone
there's just too many of them but
obviously the main players are riville
conti
fabric dark side
with ransomware payments
unfortunately we see them going up
they're literally just
breaking records every every year i
pulled this uh off the internet
just a couple of days back and as you
can see it's uh it's really i don't see
i don't think if you i don't i don't
know if you can read the numbers there
but that it's literally running into
millions of dollars now
what's the motivation and the the how do
they operate let's have a quick look at
it um obviously money is the biggest
motivation for these guys um
they're literally after money as much as
they can
some we see um doing it just to disrupt
things cause a lot of disruptions
as you can see there her headline there
it was not designed to make money
they
literally want to bring companies down
at some some sometimes and they also
target government
installations and the like
not much but we also see
some of them testing their their arsenal
experimenting
some pretty big
incidents have happened in the past
where
literally they were not after anything
it was just testing or
you know experimentation
the the way they operate mostly that we
see is a big trend going towards um
ransomware as a service
which is um
makes it really easy for anyone to jump
on the ransomware
bandwagon and start you know
extorting money out of
victims
some bigger gangs
threat actors have also
traditionally built their own in-house
products uh and a lot of them actually
end up selling the product to whoever is
willing to pay for it
we'll touch on some real world scenarios
a bit later in the slides but we've also
seen a trend where
recently
where a lot of these actors are going
after
encryption but also pivoting on to
extortion as in like you know encryption
is there but if you if you if you
got a really good backup system or
you don't want to pay for whatever
reason
they'll they'll threaten you with
extortion or basically threatening to
expose your data your
whatever they've stolen making it public
and making you look really bad um and
we'll see that and one of the real world
examples as well
this slide is uh got a lot of content um
so i'll just pick a couple of important
things from it um uh we got a kind that
blitzed through the whole thing we only
got a half an hour but just just so you
know i'll be around feel free to
approach me and ask anything if you want
when talking about ransomware attacks a
lot of
it actually goes on
before the actual attack there's a lot
of preparation
that
companies and organizations should
usually get into
as you can see in the slides i i reckon
one of the main ones that i want to
stress on is tabletop exercises
if you haven't done one it's highly
recommended you
do one
most probably
maybe get a third party
third party company to get it done for
you
the main
benefit of doing tabletops is it exposes
some stuff while you're doing it that
you could have could have never really
thought of
and
once it's there you can fix it it's
really really helpful
and also another aspect of it that's
really good is the communication
strategies you can get a lot out of
these top tabletop exercises that you
can then use to
build really good communication
strategies going forward
during the attack while it's going uh
it's quite stressful but
i think a couple of points
like coordination between different
teams different people helps a lot if
you can
do it in a calm and collected way that
that'll really really help you manage
the tag while it's going on
communication is also really really
important
as long as the people who need to know
certain things do
know it it really helps you
get through the whole incident as
painlessly as possible
and obviously there's a phase after
the actual incident has occurred and
you've contained it
basically it really helps a lot if you
can
do a quick
root cause analysis
lots of learnings come out of it and
help you
you know manage these attacks in the
future
and obviously there's a lot of stuff in
there as you can see the last point is
uh all the points and before so
basically you have to go back to uh
getting ready for
whatever the next attack would be like
uh let's touch on a couple of real world
examples um uh we we deal with a lot of
um
unfortunately a lot of ransomware
attacks on a day-to-day basis there's a
lot of people are affected by it
we uh worked with a freight company um
not so long ago um it was really
interesting um
uh
responding to that incident because we
found so much stuff that really opened
our eyes to
how complicated these attacks can be
basically what we found was these
tradactors had exploited their network
back in 2020
they had been in there for quite a long
time
before the actual ransomware attack
occurred which makes us believe it
probably wasn't even the same guys they
probably just sold it off to
some ransomware threat actors
it was
left exposed for a long time and they
came in they were literally coming in
and going out as they wished
they
ended up at some point installing mega
sync which is a utility to backup
files and they actually used it to
exfiltrate a lot of data from the from
the customer
and they
did
threaten to
expose that basically at the end of the
and we're not exactly sure if it was the
same threat actors or some that they
sold access to other people but once
everything was taken out of their
networks they literally just
encrypted everything and uh at that
point it was
yeah that's when we came in and we saw
all of this stuff
interesting um look at this so it's
definitely not one of those um
you know
grab and uh sorry crash and grab style
ransomware attacks we see normally uh
this looks like it was going on for a
long time
uh another one that i want to talk about
quickly is evolve from that we helped
them
they used proxy log on which is
something that came out
not that long ago
vulnerability in exchange servers and
they basically use that vulnerability to
get in they
dropped friends somewhere on the network
they executed it and we also found a lot
of prone jobs that were scheduled
that were staggered
in a way where
it just kept going on um bit by bit by
bit and kept uh spreading through
through through the entire network um
through chrome jobs
and
the interesting thing about this was
they kept lowering the ransomware demand
basically and they were like okay you
can't give us that much how about this
much come on give us something at least
that was quite interesting to see them
go down their path and we'll just tell
you you know everything's up for
negotiations there
detection is probably one of the most
important
steps in in preparing yourself for
ransomware
it is not the easiest but if you can
get it done somehow
it would really really help you
contain the spread and
will basically prepare yourself that
much better
you can have in-house detection teams if
you can if you're you know a company
they can afford to have in-house if not
then you can
subscribe to threat intel feeds that's
probably easier where you know you just
get all these feeds from companies that
actually do all the research and once
you have these few
feeds you can use these feeds to create
detections inside of your own network
and
we'll basically tell if something's not
right or you know
at least contain the damage
there's a lot of research publications a
lot of people publish
articles publish their research they do
one ransomware and as you can see a
couple of images up there you can use
these um
commands that are run by the ransomware
and
their behavioral
techniques to create detections and
implement them throughout your network
that will really help you once you know
these things start getting executed on
your network you can catch them
early on
and
just a quick side note there's a lot of
edr
solutions nowadays that you can use
these detections on as well basically
you know they keep monitoring your
endpoints and if they see something like
that happen
they will take actions that you can then
you can set up basically to stop the
execution or take take different actions
basically
uh let's have a quick look at some
forensics best practices that
we
end up recommending to to all our
clients when we when we're dealing with
ransomware incidents
as we know most of the infrastructure
now is on virtual machines and it's
really helpful for people like us
like all of us when we go in to respond
to incidents
if
the victims have got some snapshots
ideally it's really good to have the
current snapshots which is not a big
problem but also before the infection a
lot of times
we see it unfortunately they don't have
the snapshots from before the
infection and that really doesn't helps
us when all you're looking at is uh
encrypted files not much you can do with
that at that point in time
so it's really good if you can have
something set up where you are
regularly taking
snapshots of your machines
and
having like storing them somewhere um
available logs um it's it's probably the
next best thing
logs can tell us a lot about
what happened what was in initial
infection vector how did they get in
the reason these things are needed is
because a lot of times you'd find when
you go making a claim
with your insurance company they would
usually ask for this
this information
we usually get
engaged at that point and
one of the number one things that the
insurance companies are after is how did
they get in what exactly happened so we
can you know make a determination on
whose fault it was or you know
what to do with the uh with the claim so
if you've got logs it's easier for the
responders to find out uh
how
the initial infection came about how did
they get in and what did they do while
they were there the other really
important thing that comes out of these
logs is to find out if there was any
ledger movement if they actually moved
across
your network to different systems and if
they're still there or you know
lots can be done once you have these
logs
we do get logs sometimes encrypted which
again are no help at all
so it's always good to have a
backup system for your logs as well if
possible
active monitoring is very important uh
if if you have some sort of an endpoint
detection response capability
that helps a lot um or where you know it
basically comes down to logs and uh what
happened and what was executed and when
that helps us build a picture together
that then can be presented
to
well anyone really whoever is after more
information about the
incident
and threat hunting capabilities if you
have some would go a long way as well
because
it's very important to find out if the
actors are still in there
after the actual incident
and
engage your incident response team as
soon as possible whoever that is
internal external um the earlier they
can get in the better they can guide you
through the whole process and also i
think the most important thing is they
can tell you what to protect for them to
be able to
conduct forensics and respond later on
cyber insurance policies
so quick note on that we've seen
a lot of the work we do involves
insurance most of our clients
do need insurance claims and
some help or whatever
in australia at least i can talk about
in what's happening in australia the the
cost of cyber insurance policies has
skyrocketed quite quite a bit
i'm pretty sure it's the same all around
the world
i was looking at some numbers and it was
i think in the u.s in 2018 alone they
were
around 400 million dollars worth of
claim um based on cyber insurance
policies so
it's very very important to make sure
you've got the right policy and the
right coverage for you know whatever
your needs are
insurance is often the first port of
call um
the reason for that being a lot of
insurance policies would actually cover
some sort of incident response for you
if you've picked
picked it that way
they do help with facilitation of
legal requirements and you know
incident response and all of that stuff
some legal sorry some insurance
companies also help you with ransomware
negotiations
unfortunate ids but sometimes it's
just you know not possible for people to
go okay we don't need anything
undecrypted so you
yeah you
end up negotiating with these guys
yeah it's just unfortunate but sometimes
you have to so yeah some some insurance
policies insurance companies do help you
with that as well they have specialists
who deal with these guys and who have a
lot of experience negotiating with
ransomware threat actors and gangs
and that's just something i mentioned
earlier on the cost is really going
crazy at the moment and i don't think
it's going to calm down anytime soon so
it's very important you
pick the right policies
communication strategies
i i would have to say this is probably
the most important aspect of incident
response
while dealing with ransomware attacks
just because of the scale of disruption
and
damage is just so great
it's
the biggest problem that people face the
organizations face when they go through
a ransomware attack is
the brand damage and
you know
it's really really important that
communication goes out at the right time
to the right people
coming from the right people
to contain all that damage all that
potential damage that could happen to
your brand
there's a lot of stakeholders obviously
in any
sort of incident but ransomware
definitely because
your customers
and internal customers external
customers everyone really
are affected by it they're not able to
access data and you know a lot of times
work just stops and people get pretty
pretty
anxious and
unsettled so it's very very important
that all the stakeholders are recognized
and then communicated with
there's a lot of regulatory
notifications and inquiries all
countries have their different rules and
legal obligations
so that needs to be taken care of
media is very important because once
people start talking about it in social
media or media it gets start starts
getting reported it can go out of
control pretty fast so it's much much
better that
you guys can
control that narrative as much as
possible yourself rather than let it
let everyone just to jump in
customers obviously are really really
important to
to be kept in the loop what's happening
and
where you are with the incident and the
response
internal stuff is really important as
well because it's very important nothing
goes out from within the company within
the organization that's not approved
that's not correct definitely
um
highly advisable to have a single point
of contact um
that could be just
one person or that could be the team
that takes care of communications in the
organization
everything should be routed through them
outwards and inwards as well
just so that there's no confusion and
there's no
it's all you know streamlined
it helps a lot if
just looking at a couple of security
incidents in the past few months
without going into details
it helps a lot if the information coming
out is consistent and regular
customers and other people in the
industry are not just left to wonder
what's happening
with this incident
and there have been a couple of
incidents in the past few months where
it wasn't handled in the best possible
manner and it
caused a lot of problems for those
organizations
need to know basis game is very
important
just to keep it all contained and
controlled
obviously people who don't need to know
exactly what was
happening or how they got in or what
exactly they did or what exactly they
could potentially do moving forward
shouldn't
be engaged regarding that information
very very important to have everything
that goes out approved by illegal and
the pr team because
you don't want to get into you know
legal trouble
and that was it i've included some
further reading and resources
have a look at them and
see if you can get something out of that
i'll open up the question and answer if
there are any questions and answers
thank you
[Applause]
thank you vishal one question yeah hello
uh one question about run somewhere on
linux servers please
you show some you showed some examples
from windows
so what about linux
uh can you take your mask off for one
second yeah sorry i said what about
linux servers
what about linux servers is the question
for the one somewhere yes um so a couple
of examples in there actually were from
linux
well it would take too long to go back
there but
yes we have seen a lot of ransomware
gangs targeting linux servers now
the reason for that is pretty obvious i
think 70 to 80 percent of critical
infrastructure
for most bigger organization resides on
linux servers
i have seen at least all most of the
major
ransomware thread actors pivot into
linux now
there's
reveal which came out with the linux
version called revix
conti came out with the
their linux version pretty recently
and
if you have a look back and that's back
on that slide
there's at least i think a couple of
examples that are based on linux servers
and we've definitely seen them targeting
mostly
infrastructure that's residing on vmware
um esx servers because that way they can
get basically everything right so they
revix was targeting esx in a way where
they could go in
access the vms running on the esx
servers and then start encrypting the
data on that conti came out not too long
ago just a couple of just maybe a month
ago
or maybe a couple of months ago where
they
were targeting again the esx owers
getting the vm lists out of it and then
killing all the processes so that they
could start
like it was pretty foolproof once they
got there and they could basically just
encrypt everything
but those
commands that were on those slides are
specific to linux systems uh if you want
to build detections based on that you
can do that
but you write this i answered your
question or did i think sorry sorry
thank you thanks thank you
another question
uh yeah um do you have a sense of the
percentage of orgs that pay the ransom
i'm sorry i didn't get it do you have a
sense of the percentage of organizations
that pay the ransom
it's really hard it's really hard
there's a few reasons why it's really
hard but one of the main reasons is not
everyone wants to say hey i paid
that's where it gets really complicated
we do have a lot of stats floating
around the internet by companies that do
research and i believe they're pretty
pretty accurate based on
whatever they're seeing
but personally i just don't think it's
it's possible to answer that
because
the
look at it this way the number of
companies
that are not divulging that paid could
be eighty percent
or could be five percent
but
we just don't know it's impossible to
know unless you're on the other side and
you're actually just counting the money
coming in it's it's pretty but yeah from
what we know it's pretty high um it's
higher than
what you would like it to be not because
you don't want people to pay and get
their files back but just because you
can see that these guys are getting away
with it that slide what that i had was
uh
it's running into millions i think the
top um ransomware family in there had
around 12 million dollars a year
so it must be pretty high
but sorry i can't really answer that
question it's hard
cheers thanks
what i can add however is that in many
countries you may have some regulations
or lows that will prohibit from paying
the ransom
and that may have an impact on that
however i fully agree with you there's
no way to really know what is the
percentage because nobody will boast
i've been paying the ransom
and maybe by
tracking the
the bitcoins or monero
payments you can track that but it's
well
it's a bit like it's a bit like that
case a few years back completely
non-cyber security sorry the bernie
madoff case right people like that was
60 billion but there were just so many
people that were affected by it who
never reported it because it was a big
big brand damage thing for them so we'll
never find out how much that scam was
right it's just a bit similar if that
makes any sense
third question
hi thanks for your presentation one
question because i think this is maybe a
situation where
often in
when a company is breached
and is attacked many of its clients will
cut off any connections and will often
ask for guarantees from the incident
response before it can reopen those uh
those connections what is your typical
answer to that situation
that's a really really good question
thanks for that um and and the answer i
have is a bit bit ambiguous to that
because it really depends on the way the
organization is set up
there's no one answer fits all for this
unfortunately uh it also depends there's
just so many factors depends which so
which threat actor was it and how did
they operate for example we looked at
that
case that i talked about briefly the
threat actors had been there for more
than two years already so
it really doesn't matter what they what
you do at that point right they had been
coming in and out they had megasync
installed and had basically just
taken a whole bunch of data out of it
so it's really easy case by case but
that a few years back i remember the
whole thing was about hey do not pull
the plug right don't cut it off we need
to track these guys
depends if we're tracking a nation state
actor
yes maybe but if it's just a hit and run
grab all ransomware what are you going
to do leave it open to more attacks
yeah the right answer to that would be
go in have a look
discuss it with the client understand
how they're set up and based on what you
find you should be able to give them
some sort of an answer to that in some
cases yeah maybe you leave it on in some
most cases i think it doesn't really
help
because ransomware particularly by the
time incident response gets involved
there really isn't much left to do other
than find out the root cause and you
know find out how they got in
report it all back so that people can
use it for future
thanks
any other question from the audience
none
yeah
hello thank you i have a small question
related to a normal ransom project so do
you have any information
how successful is it how how
often is we can find some
decryption key instead of that and is
there any initiative to
more support that project which is very
very good for
for uh fighting with ransomware thank
you
how much time do we have
uh look um that project is uh anything
that's tackling ransomware is good
that's what i would say right no more
ransomware um they've done a lot of
stuff they've you know released so many
decryption keys uh
the problem
with
any of this as far as i can think is it
it's very uh typical
these
campaigns are running on such a short
notice now where they're changing
overnight
so i mean i don't know if how many of
those keys you've actually tried they
work for a batch but it's just so easy
for the threat actors to move on from
there and you know redo the campaign in
like minutes now right
it's really good for all the
around somewhere that it actually works
for i like i said anything is good
but it's really really hard as well and
i can discuss it with you off i don't
know how much time you've got it it also
it's not just the description key you
have to build the entire decrypter and
all these guys or most of these guys um
other than you know kaspersky and all
these guys there's a lot of guys who are
doing it in their own time as well so
it's really hard to keep up
with that uh and obviously you need to
build the entire decrypter which is not
just a description key but the entire
algorithm as well
which changes overnight basically so
it's it's really hard it's really good
but there's a lot of other i mean
abuse.ch is one of the
really good malware resource overall not
just ransomware
publish so many ioc that you can use
every day
there's a lot of other research
that but i would definitely look for
anything that you can build detections
on because that's probably more
helpful without being specific to just
one batch of that campaign
just
learning how these guys operate what
commands they use
using that information to build
detection
that's probably the best uh i can give
you some resources after that after this
talk thank you thank you very much no
problem thank you
guys feel free to hit me up i'll be
around for the entire uh conference and
i think we about time here so yeah just
let me know if you've got any questions
if i can help you or just connect with
me anyway i came a long way from
australia so it'll be really good to
connect with you guys thank you
thank you