How Ransomware Works

1. Delivery: Cybercriminals often employ deceptive tactics to deliver ransomware to victims. This can take the form of phishing emails or messages, where the attacker poses as a trusted entity. These messages may contain malicious attachments or links that, when clicked or opened, initiate the ransomware infection process.
2. Infection: Once the victim interacts with the malicious attachment or link, the ransomware is unleashed. It swiftly infiltrates the victim’s computer system, targeting files and data. Ransomware encrypts these files, rendering them inaccessible to the victim.
3. Ransom Demand: Following successful encryption, the cybercriminal sends a ransom demand to the victim. This demand typically insists on payment in cryptocurrency, which provides a degree of anonymity for the attacker. The demand often includes a specific sum of money and a deadline by which payment must be made.
4. Decryption Key: In exchange for the ransom payment, the attacker provides a decryption key to the victim. This key is essential for unlocking and restoring the encrypted files. Without it, the victim has no means of recovering their data.
5. Data Threat: If the victim refuses to pay the ransom or fails to meet the deadline, there is a significant risk that the cybercriminal will follow through on their threat. This may involve permanent data destruction or the public release of sensitive information, potentially causing severe consequences for the victim, whether they are an individual or an organization.

What Makes It Pertinent

Notable Ransomware Variants

Notable Ransomware Incidents Worldwide

1. BlackCat’s Target: Naivas in Kenya – Successfully Resolved: BlackCat ransomware set its sights on Naivas, a prominent retail chain in Kenya. However, the incident was swiftly and effectively resolved, with Naivas managing to thwart the attack.
2. LockBit Strikes Jubilee Insurance in Kenya – Investigation Underway: LockBit ransomware made an incursion into Jubilee Insurance in Kenya, resulting in an ongoing investigation to assess the extent of the impact and potential data breaches.
3. Medusa’s Assault on Kenya Airports Authority (KAA) – Impact Being Investigated: Medusa ransomware launched an attack on the Kenya Airports Authority (KAA), prompting an investigation into the incident to determine the scope of the impact and assess potential vulnerabilities.
4. LockBit Targets Royal Mail – Rejects $80 Million Ransom Demand: LockBit ransomware targeted the Royal Mail, a prominent postal service in the UK. Notably, the Royal Mail chose to reject an $80 million ransom demand, taking a stance against extortion.
5. Development Bank of Southern Africa Acknowledges Akira Gang’s Ransomware Attack – Data Encryption Occurred Last Month: The Development Bank of Southern Africa confirmed a ransomware attack orchestrated by the Akira gang, which led to data encryption in the previous month. This incident underscores the ongoing threat posed by ransomware to financial institutions and businesses.

Acquiring Ransomware: Dark Web and Tactics

Protecting Against Ransomware

1. Frequent Offsite Data Backups: Implement a robust data backup strategy that regularly copies critical data to an offsite location. This ensures that even if ransomware strikes, you can recover your data without succumbing to extortion.
2. Install and Maintain Security/Antivirus Software: Deploy and consistently update reputable security and antivirus software. These tools can detect and block ransomware threats before they can infiltrate your systems.
3. Employee Education on Phishing Threats: Conduct thorough cybersecurity training for your employees, emphasizing the risks associated with phishing. Equip them with the knowledge to recognize and avoid suspicious emails or links that could introduce ransomware.
4. Utilize Email Filtering and Web Protection: Implement email filtering solutions to block malicious attachments and links. Additionally, consider web protection services that can identify and prevent users from accessing malicious websites that may host ransomware.
5. Maintain Windows Firewall: Ensure that the Windows Firewall or any equivalent firewall software is active at all times. Firewalls act as barriers against unauthorized access, potentially thwarting ransomware and other cyber threats.

1. Timestamps

• Modification Time (M-time): Indicates when a file’s content was last modified.
• Access Time (A-time): Records the last time a file was accessed or opened.
• Creation Time (C-time): Marks the moment a file was originally created.
• MFT Registry Modification Time (MACE or MACB): Reflects the time when changes were made to the file’s Master File Table entry.

• TimeStomp:
  • TimeStomp is an anti-forensic tool that focuses on modifying timestamp information inside the $STANDARD_INFORMATION attribute of a file.
  • It should be noted that TimeStomp does not alter the timestamp information within the $FILE_NAME attribute, which can be used to identify suspicious activity.
• USN Journal Analysis:
  • The USN Journal (Update Sequence Number Journal) is a feature within NTFS that maintains a record of changes made to the file system.
  • Anti-forensic practitioners can examine the USN Journal to identify modifications made to files and folders.

• $LogFile Inspection:
  • All metadata changes within an NTFS file system are logged in a file named $LogFile.
  • Tools can be used to parse this log and identify alterations to timestamps, including:
    • CTIME (File’s creation time)
    • ATIME (File’s modification time)
    • MTIME (File’s MFT registry modification time)
    • RTIME (File’s access time)

• $STANDARD_INFORMATION and $FILE_NAME Comparison:
  • One method for uncovering suspiciously modified files involves comparing timestamps between the $STANDARD_INFORMATION and $FILE_NAME attributes, looking for inconsistencies.
• Nanoseconds Precision:
  • NTFS timestamps possess a remarkable precision of 100 nanoseconds. Any files with timestamps like ‘2010-10-10 10:10:00.000:0000’ raise suspicions due to this precision.
• SetMace:
  • SetMace is an anti-forensic tool capable of modifying both the $STANDARD_INFORMATION and $FILE_NAME attributes. However, on Windows Vista and later versions, a live OS is typically required to perform such modifications.
• Data Hiding in Slack Space:
  • NTFS allocates data in clusters, potentially leaving unused slack space within a file.
  • Tools like ‘slacker’ enable data to be hidden in this otherwise unutilized space.
  • Recovery tools like FTK Imager can be employed to retrieve the hidden data, which may be obfuscated or encrypted.

2. Data Hiding

Understanding Data Hiding

• NTFS (New Technology File System) allocates data in clusters, leaving unused slack space within a file. When a file occupies less than a whole cluster, the remaining space remains unutilized until the file is deleted. Cybercriminals can exploit this unused space to hide data effectively.
• Tools like ‘slacker’ provide the means to hide data in this ‘hidden’ space, making it challenging for investigators to discover.
• It’s important to note that while data can be hidden in slack space, an analysis of system logs such as the $logfile and $usnjrnl can reveal the addition of data, raising suspicions.

• Encryption serves as a powerful method for data hiding. The Lazarus group, for instance, utilized encryption in their operations.
• They divided their malware into three parts: the loader, encrypted PE files, and encrypted configuration files.
• The loader decrypts encrypted PE files and loads them into memory. These encrypted PE files run in memory, decrypting configuration files to communicate with a Command and Control (C2) address.
• Encrypted configuration files contain vital C2 information.
• To evade detection, the Lazarus group transmitted both the configuration file and the PE file in encrypted forms. These files operate after decryption in memory by the loader, enabling them to receive additional files from the C2 and carry out malicious actions.

Additional Forms of Data Hiding

• Cybercriminals often use system folders as a hiding place for their malware. Default system folders, which are hidden by default, become prime locations for concealing malicious code.
• The Lazarus group created folders with names similar to default folders or disguised their malware as normal files within hidden system folders.
• Key system folders used for concealment include:
  • C:\ProgramData\
  • C:\ProgramData\Microsoft\
  • C:\Windows\System32\
• The C:\ProgramData folder, for instance, is a default system folder hidden by default. Cybercriminals would either create a similar folder within this directory or disguise malware as a normal file inside a default hidden folder.

Unveiling the Hidden Truth

3. Unmasking USBKill

4. Living on the Edge: Live Linux Distributions

5. The Art of Secure Deletion

6. Windows Configuration: Fortifying the Bastion

1. Disable Timestamps – UserAssist: This registry key maintains a log of dates and hours when each executable was run. Disabling UserAssist involves a two-step process. Registry keys HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackProgs and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_TrackEnabled must both be set to zero, signaling the intent to disable UserAssist. Additionally, clearing registry subtrees under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\<hash> is essential to complete the process.
2. Disable Timestamps – Prefetch: While Prefetch aims to enhance system performance by saving information about executed applications, it can also be leveraged in forensics. To disable it, launch the Registry Editor (regedit.exe), navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager\Memory Management\PrefetchParameters, and right-click to modify EnablePrefetcher and EnableSuperfetch values from 1 (or 3) to 0. A system restart will finalize the configuration.
3. Disable Timestamps – Last Access Time: On heavily utilized NTFS volumes, the last access time stamp can impact performance. This can be addressed by adding a DWORD value NtfsDisableLastAccessUpdate under `HKEY_LOCAL_MACHINE\SYSTEM\Current

The Challenge

An inefficient filing system at Beaumont hindered healthcare workers who needed to be able to access patient records quickly and easily. Staff reverted to keeping paper records that were stored off-site. If a doctor or nurse needed to see them for a returning patient or if they were needed for a legal claim, then the file had to be physically retrieved from the archive and collected by courier; a time consuming process.

The Solution

With Ergo’s Scan & Index Manager documents were digitised and indexed in Microsoft SharePoint for easy search and retrieval. Implementation was risk-free and well planned because Ergo built the system at its headquarters first, replicating the Beaumont environment off-site before deploying it into the hospital.

“Ultimately, we wanted to get rid of the paper trail and totally trust Ergo to help us do it. Everything we have scoped and asked them to do they have delivered.”

The implementation of Ergo’s Scan and Index Manager system has delivered tangible productivity gains and cost savings for Beaumont Hospital. Doctors, nurses and administrators have robust systems that enable them to retrieve files in around 10 seconds compared to 30 minutes with the old system.

Via: ErgoGroup.ie

With so much at stake, they turned to NanoSoft Solutions to handle their IT needs. NanoSoft not only created detailed plan to upgrade MCMS systems, but when an old modem died over a weekend, putting in jeopardy the MCMS e-mail capabilities, it was NanoSoft who came to the rescue. As Christopher Bell from MCMS says:

“I called CMIT when I was no longer good enough to be the IT guy for the company”

It’s that 24 hour/7 day a week support and commitment to service that keeps the MCMS from worrying anymore about their IT.

Via: cmitsolutions.com