Cybercriminals' Enduring Ransomware Attacks
Infiltrating Systems: Precursor Malware Strategies Including File Downloaders, Droppers, and Decoy Programs
In recent articles, podcasts, and webinars, we have elucidated various forms of cyberattacks and their perpetrators. Among these, ransomware often dominates headlines due to the distress it inflicts when personal data is strategically disclosed for extortion purposes, and the widespread destruction it frequently leaves in its wake.
It is essential to note that ransomware attacks do not necessarily transpire as isolated incidents involving a single piece of malicious software, or malware, as often assumed.
Specifically, ransomware can swipe through systems via a single malicious attachment or download link received via email, leading to potentially devastating results. As far back as 2013, this was the modus operandi for the early waves of modern, file-scrambling ransomware attacks, carried out by a malware strain known as CryptoLocker, and its originators.
These groups, comprising names like Locky and Teslacrypt, raked in substantial profits through extortion, often targeting thousands or tens of thousands of individuals simultaneously in wave after wave of attacks. Their ransoms typically demanded between $300 and $1000 in bitcoins for each computer locked up.
For instance, if a company possessing 1000 laptops experienced 50 simultaneous lockdowns due to a successful phishing campaign, it would be forced to pay 50 × $300. Each encryption key was unique, as these early ransomware attackers were not initially focused on targeting businesses or networks.
The Spray-and-Pray Approach
In case you are wondering about the effectiveness of this old-fashioned 'hit-and-hope' ransomware tactic, also known as 'spray-and-pray,' the University of Kent in England published a survey in early 2014 that shed light on the financial gains of these early CryptoLocker purveyors.
Given the survey's academic rigor and lack of bias from a vendor with sales and marketing interests, the findings were widely accepted and painted a grim picture: one in 30 households admitted to falling victim, with 40% of those reporting they had paid up to recover their computers.
If we take 2013 statistics for the number of households in Britain and the percentage with computers, we arrive at approximately 22 million potential ransomware victims. With one in 30 households experiencing an attack and 40% of those paying the designated ransom, that equates to over $80 million in extortion payments in Britain alone.
Expanding the potential victim pool to include Western Europe and North America intensifies the numbers.
Evading Detection
The University of Kent survey revealed that only a quarter (approximately 28%) of respondents admitted to taking no security precautions, including the absence of any antivirus or threat-blocking software. This means that a significant majority of those who did take some form of precaution nevertheless suffered the infiltration of CryptoLocker malware onto their computers.
If the CryptoLocker gang had managed to infect hundreds of thousands of computers in Britain alone, where over two-thirds of households were guarded in some way against malware attacks, the question arises of how they managed to persistently evade detection.
Cybercriminals' Persistence
In order for any long-lived crimeware group, whether distributing ransomware, cryptominers, keyloggers, data stealers, or other types of malware, to remain actively threatening for months or years, they employ various techniques to stay under the radar:
- Regular rewriting of malware with significant changes on an irregular basis
- Regular, frequent reworking of malware samples
- Frequent rearrangement of malware resources
- Revealing the intended malware at the last possible moment
- Repackaging the intended malware with various shroud techniques
These methods not only obscure the detection of new malware but also frustrate researchers seeking to obtain new samples. A scam email could return entirely innocent content when researchers visit, but deliver malware to unsuspecting users. The malware could be selected based on specific factors, such as the operating system, country, or the time of day, known only to the criminals who control the server and unknown to researchers.
The Problem with Downloaders
The primary problem with downloaders involves their ease of creation, compact size, and effortless modification. Even if a downloader's malicious activity is detected before it communicates with its command-and-control server, there are still several questions that must be addressed, such as:
- How did it get there?
- Did it download anything else?
- What might have followed?
- Who was behind it?
- Does it represent a data breach?
- What advice can be given to users?
A simple example of a downloader consists of just a few lines of code, demonstrating the ease with which these tools can be created and deployed. A free, fully-functional Windows C compiler can be downloaded from the author's GitHub site, and the provided example downloader weighs in at just 1536 bytes.
Layers of Disguise
Admittedly, the simplicity of the code may be transparent to a seasoned programmer, but small changes can complicate identification. By making trivial modifications to the URL and executable filename, the code becomes more difficult to spot automatically. Furthermore, loading necessary functions at runtime can prevent explicit mentions within the code, making the downloader function less visible in memory.
While these techniques may not significantly mask the malicious intent of the code, they can serve to deter automated tools from identifying it.
From Known to Unknown Threats
The ease with which attackers can generate various malware samples and downloaders not only obfuscates detection but also foments the throng of unknown risks cybersecurity professionals constantly grapple with.
Cybercriminals can create new, dynamically generated downloaders and droppers for each visit to their websites, making it difficult for security solutions to distinguish between legitimate and malicious behaviors.
As we emphasized at the outset of the article, the infiltration seen initially is rarely the complete picture. Even seemingly innocuous downloaders can pave the way for more insidious threats to manifest on compromised systems.
To avoid falling prey to such attacks, it is crucial to rely on trusted sources for software downloads, carefully investigate any suspicious software, and enlist professional assistance when necessary. The human touch remains vital in the ever-evolving landscape of cybersecurity.
- To combat the persistent threat of ransomware attacks, it is advisable for organizations to establish a Security Operations Center (SOC) to monitor and respond to cybersecurity threats in real-time.
- In the Technology arena, advancements in cybersecurity solutions are essential to detect, prevent, and mitigate the malicious activities of cybercriminals, particularly in the face of evolving ransomware tactics.
