Increasing Ransomware Threats: Key Trends in Cybersecurity for Q2 2024

Cisco Talos Incident Response (Talos IR) has identified that a significant 60 percent of their engagements in the second quarter of 2024 were dominated by business email compromise (BEC) and ransomware threats. Despite a decline in BEC incidents from the previous quarter, it remains a prominent concern, while ransomware attacks are on the rise.

This quarter saw an uptick in ransomware engagements, with sightings of the Mallox and Underground Team ransomware families for the first time, alongside previously noted operations like Black Basta and BlackSuit.

Notably, the technique of gaining initial access through compromised credentials continues to be prevalent, accounting for 60 percent of engagements, which marks a 25 percent increase from the last quarter.

Within targeted sectors, technology companies have emerged as the most-hit vertical, representing 24 percent of all engagements. This reflects a 30 percent increase from the previous quarter, indicating the sector's pivotal role in the supply chain and its attractiveness to cyber adversaries.

Organizations in technology are typically rich in digital assets supporting critical infrastructure. Their essential services and high downtime costs may lead them to comply with ransomware demands.

Increasing Threats from Business Email Compromise

BEC attacks remain a formidable threat, where adversaries compromise legitimate business email accounts to deceive employees into revealing sensitive information or executing unauthorized financial requests. The tactical landscape of BEC has evolved; for instance, several incidents involved SMS phishing, or "smishing," where attackers trick users into providing personal data via fraudulent texts.

Adversaries effectively leverage employees' personal devices to initiate attacks, given that these devices often lack robust security. Organizations need to integrate SMS phishing awareness into their training regimes to mitigate such risks.

One noteworthy incident observed involved an employee's personal email being used as a vector to compromise their corporate login. The user inadvertently accepted an MFA push notification after entering their credentials on a spoofed login page, revealing security gaps and underscoring the challenges of passwordless authentication.

Another significant case involved the manipulation of Outlook mailbox rules. The adversary exploited compromised credentials to divert emails to a hidden folder, suggesting a sophisticated understanding of email systems for further phishing campaigns.

Ransomware Landscape Overview

Ransomware engagements surged, increasing by 22 percent this quarter, accounting for 30 percent of all incidents. Talos observed the emergence of the Mallox and Underground Team ransomware families. Black Basta and BlackSuit also remained active, with the latter being recognized as key players in the current ransomware ecosystem.

Alarmingly, 80 percent of ransomware incidents this quarter involved systems lacking adequate MFA, significantly facilitating adversaries' initial access. Command obfuscation techniques were evident in 40 percent of ransomware cases, showcasing a trend towards sophisticated attempts to evade detection.

Mallox Ransomware Insights

In a specific Mallox engagement, a single Microsoft SQL server was compromised and encrypted. Characteristically, no data exfiltration or lateral movement indicators were found. As a ransomware-as-a-service (RaaS) operation, Mallox employs double extortion tactics, leveraging brute-force attacks on unsecured SQL servers, although its recent activity uniquely lacked the involvement of Cobalt Strike beacons.

Underground Team Strategies

During a response to an Underground Team attack, adversaries employed Secure Shell (SSH) for lateral movement and reactivated over 100 previously disabled Active Directory accounts, an unusual strategy not widely reported in the literature. This tactic illustrates a potential new method for privilege escalation within their operations.

Using a reactivated compromised account, attackers deployed ransomware, encrypting critical systems and directly messaging victims' personal emails to coerce compliance with their demands.

BlackSuit Ransomware Developments

In an engagement involving BlackSuit, attackers entered via RDP using valid credentials without MFA safeguards. They established persistence with remote management tools, including AnyDesk and Cobalt Strike, demonstrating a preference for using common administrative tools for lateral movement. Some previously unknown utilities added complexity to their approach, altering the traditional signature of BlackSuit’s tactics.

The group's historical patterns show a clear connection to other ransomware families, potentially indicating a rebranding linked to Royal ransomware operations based on code similarities.

Black Basta Attack Vector

In the case of Black Basta, initial access was again gained through compromised credentials on an RDP account lacking MFA. The adversaries harvested sensitive information from the Windows Credential Manager, executed remote PowerShell commands, and deployed common data exfiltration tools like Rclone, which intriguingly left behind configuration files for potential retrieval by defenders.

Black Basta's targets span both Windows and Linux systems and reportedly leverage various entry tactics, from phishing to exploiting vulnerabilities and password spraying techniques, highlighting their indiscriminate targeting approach.

Network Device Targeting and Vulnerabilities

This quarter showed a slight uptick in attacks targeting network devices, comprising 24 percent of engagements, with activities involving password spraying, vulnerability scanning, and exploitation. Regular updates and monitoring are essential for network devices, as they serve as critical access points for adversaries.

For instance, one noted engagement involved exploiting a denial-of-service (DoS) vulnerability in a Cisco Adaptive Security Appliance (ASA), which could trigger unauthorized device reloads, evidencing the importance of employing up-to-date hardware to avoid security risks.

Another engagement illustrated password spraying against the ASA's clientless VPN functionality, emphasizing the necessity of stringent access control measures. The enforcement of certificate-based authentication in this case effectively thwarted the attack.

Initial Access Mechanisms

The prevalent means of gaining initial access remains compromised credentials, marking a 60 percent incidence in engagements this quarter. Such an increase underscores questions about the robustness of identity and access management practices across organizations.

In one engagement, cybercriminals compromised a trusted partner's network via a one-way trust relationship used frequently for controlled access. Unfortunately, attackers can exploit these relationships to circumvent organizational defenses, revealing vulnerabilities that need addressing as collaborations with external parties expand.

Identifying Security Weaknesses

The lack of proper MFA and vulnerable or misconfigured systems dominated security weaknesses, marking a staggering 46 percent increase in reported incidents for both categories. Outdated systems, particularly those devoid of manufacturer support, expose organizations to threats that could have been mitigated with timely updates.

A specific instance involved the compromise of an antiquated network switch, showcasing the risks associated with relying on unsupported hardware. Similarly, an engagement highlighted the possibility of adversaries dumping credentials through the Security Account Manager (SAM), facilitating lateral movement due to inadequate MFA practices.

Organizations are urged to prioritize MFA implementation on critical access points and ensure regular audits of identity access management systems to detect anomalies such as impossible travel scenarios, where a user seemingly authenticates from two locations within an improbably short span of time.

MITRE ATT&CK Techniques Observed

The utilization of the MITRE ATT&CK framework provides insight into the tactics and techniques used by adversaries. Key findings this quarter include:

• PowerShell’s exploitation accounted for 41 percent of engagements, showcasing a significant rise.
• The creation of new accounts emerged as the most common persistence technique, noted in 18 percent of cases.
• Remote service exploitation, including RDP, SSH, and SMB, was present in 53 percent of incidents.
• Abuse of living-off-the-land binaries like rundll32 accounted for 18 percent of observed defense evasion tactics.
• A notable surge, especially in the usage of remote access software such as AnyDesk, was attributed to a 40 percent increase in its deployment this quarter, reaching almost 30 percent of engagements.

Organizations must remain vigilant against the dynamic and evolving tactics employed by cybercriminals. Maintaining an adaptive security posture that encompasses rigorous updates, employee training, and robust monitoring is key to countering these threats effectively.