Bert Zéfat

Security Enthusiast

HackTheBox user

Ethical Hacker

Linux lover

Bert Zéfat

Security Enthusiast

HackTheBox user

Ethical Hacker

Linux lover

Menu
Information
Ransomware:
Ransomware:
Links:
 
Ransomware Response Advice

Unplug the infected computer(s) from network, and turn off any wireless functionality: Wi-Fi, Bluetooth, NFC.

Note: Do NOT turn systems OFF!

You will destroy logs and other useful information.

Check the Following for Signs of Encryption:

    • Mapped or shared drives
    • Mapped or shared folders from other computers
    • Network storage devices of any kind
    • External Hard Drives
    • USB storage devices of any kind 
    • Cloud-based storage like DropBox, OneDrive, etc.
Check logs and DLP software for any and all signs of data leaks.
    • Look for unexpected large archival files (e.g., zip, arc, etc.) containing confidential data that could have been used as staging files.
    • Look for malware, tools, and scripts which could have been used to look for and copy data.
One of the most accurate signs of ransomware data theft is a notice from the involved ransomware gang announcing that your data and/or credentials have been stolen.
What strain/type of ransomware? For example:
    • Ryuk
    • Dharma
    • SamSam
    • REvil-Sodinokibi
    • etc.
Now that you know the scope of the damage as well as the strain of ransomware you are dealing with, you can make a more informed decision as to what your next action will be. There are many response types, here is a summary of potential responses: Response 1 : If Data or Credentials are Stolen
    1. Determine if ransom should be paid to prevent data or credentials from being released by hackers.
    2. If ransom is to be paid, you can skip steps #1 and #3 of Response 2 from recovery.
Response 2 : If Ransom Is Not Paid and You Need to Restore Your Files From Backup
    1. Locate your backups
      1. Ensure all files you need are there.
      2. Verify integrity of backups (i.e. media not reading or corrupted files).
      3. Check for Shadow Copies if possible (may not be an option on newer ransomware).
      4. Check for any previous versions of files that may be stored on cloud storage e.g. DropBox, Google Drive, OneDrive.
    1. Remove the ransomware from your infected system.
    2. Restore your files from backups.
    3. Determine infection vector & handle.
Response 3 : Try to Decrypt
    1. Determine strain and version of the ransomware if possible
    2. Locate a decryptor, there may not be one for newer strains. If successful, continue steps…
    3. Attach any storage media that contains encrypted files (hard drives, USB sticks etc.)
    4. Decrypt files
    5. Determine the infection vector & handle.
Response 4 : Do Nothing (Lose Files)
    1. Remove the ransomware
    2. Backup your encrypted files for possible future decryption (optional).
Response 5 : Negotiate and/or Pay the Ransom
    1. If possible, you may attempt to negotiate a lower ransom and/or longer payment period.
    2. Determine acceptable payment methods for the strain of ransomware: Bitcoin, Cash Card etc.
    3. Obtain payment, likely Bitcoin:
      1. Locate an exchange you wish to purchase a Bitcoin through (time is of the essence).
      2. Set up account/wallet and purchase the Bitcoin.
      3. Re-connect your encrypted computer to the internet.
      4. Install the TOR browser (optional).
      5. Determine the Bitcoin payment address. This is either located in the ransomware screen or on a TOR site that has been set up for this specific ransom case.
      6. Pay the ransom: Transfer the Bitcoin to the ransom wallet.
      7. Ensure all devices that have encrypted files are connected to your computer
      8. File decryption should begin within 24 hours, but often within just a few hours.
      9. Determine infection vector and handle.

Develop and implement a Ransomware prevention checklist, specific to your organization, to prevent future attacks.

Ransomware Tools
!!! Use Tools at your own risk !!!
Relevant Sites
Prevent Hackers Tips

By implementing a good Firewall you can make sure unwanted traffic gets into your organisation. Most new Firewall’s have IPS (Intrusion Prevention) and the ability to run AV on all the traffic. Depending on how deep you can see into the traffic (Deep Inspection) to more viruses you will keep out of your company.

The smaller your network parts are, the more difficult it is for a hacker to get useful information to get “elevated” to a certain user. Also, make sure clients, servers, printers, network switches (the management part), WiFi, door security, Viop and all the other things are in a separate vlan (network part). With a Firewall (Internal Segmentation Firewall) in place, you can make sure that only wanted and expected traffic flows from one vlan to an other vlan. Also implement IPS between these vlans, as attacks do not always come from outside you network. Enable AV where possible. Use a Zero Trust policy on all the rules.

Make sure all you equipment is logging towards a logging server. When things go wrong and you have to disconnect (DO NOT TURN OFF) your systems, there is still a place where all the logging was collected. Here you can start investigating from where the attack is coming.
This will help you speedup the process, so you can remediate and restart you servers / business.

There are many ways to detect if something is going wrong in you network. There are many companies that sell Honeypot solutions.
The differ in strength and cost. I am running a Raspberry Pi (about 50$) and run OpenCanary on it (Free). Whit some scripting it does
tell me on many different media (eg. Slack) that something was interested in it. And I can investigate why system X, was contacting my Canary.

There are many vendors that have the ability to help you with detecting if on a system actions are taking place, that you’d like to know. Eg. If a hacker is an a system, he will most likely run the command “whoami” to see if he is a user, administrator or SYSTEM.
There are AV vendors (Eg. SentinelOne) that have “Deep Visibility”. All agents log to a cloud server what is happening on a system,
which processes are running, commands called, IP’s connected, files changed, Registry Key’s altered. You can filter on that and get notified. The earlier you know someone is in your network, the smaller the attack can be.

Never use a password twice. Preferable difficult passwords.

Only give users the rights the need. In case of Service Accounts it is the same. The less it may do, the smaller the chance a hacker can
use this account to elevate himself. ICT Admins should make a stepping stone environment to get to all servers. There they only should user their admin account.