Chapter 2
Evolution
The first rule of any technology used in a business is that automation applied to an efficient operation will magnify the efficiency.
— Bill Gates
Learning Objectives
Describe early examples of cyber extortion and how they relate to modern-day attacks
Understand how cyber extortion has evolved, including key technical developments that enable attackers
Recognize how the development of specialized ransomware-as-a-service software and franchise models have spurred the growth of the cyber extortion industry
Identify the tools and resources that criminal entities are using to scale up their attacks
Everything old is new again, and cyber extortion is no exception. Although the mass media often treat it as a new threat, cyber extortion has actually existed for decades (and plain old regular extortion has been around since ancient times).
In this chapter, we discuss the origins and growth of cyber extortion, as well as key technologies that enabled its spread. Finally, we discuss the “Industrial Revolution” that has occurred in recent years and enabled cyber extortion to grow into the booming criminal enterprise it is today.
2.1 Origin Story
The first known example of a cyber extortion attack1,2 was perpetrated in 1989 by a Harvard-trained evolutionary biologist named Dr. Joseph Popp, who researched the AIDS virus and was involved with the World Health Organization (WHO).3,4 In December 1989, Popp created a 5.25-inch floppy disk labeled “AIDS Information Diskette,” which he mailed to thousands of researchers using the WHO’s database of names and addresses.
1. Alina Simone, “The Strange History of Ransomware,” Medium, March 26, 2015, https://medium.com/@alinasimone/the-bizarre-pre-internet-history-of-ransomware-bb480a652b4b.
2. Kaveh Waddell, “The Computer Virus That Haunted Early AIDS Researchers,” The Atlantic, May 10, 2016, www.theatlantic.com/technology/archive/2016/05/the-computer-virus-that-haunted-early-aids-researchers/481965/.
3. Edward Wilding, ed., Virus Bulletin, March 1990, www.virusbulletin.com/uploads/pdf/magazine/1990/199003.pdf.
4. Edward Wilding, ed., Virus Bulletin, January 1990, www.virusbulletin.com/uploads/pdf/magazine/1990/199001.pdf.
Unbeknownst to the recipients, the disk installed malware on the victim’s computer and modified the startup file to count system reboots. When the computer had been rebooted approximately 90 times, the malware hid all folders and files, so they were invisible to the users, and also encrypted all filenames.
Affected computers displayed a “license agreement” as a file or a popup, with the following message (there were other variants as well):5
5. Joseph L. Popp, AIDS Information Trojan author, https://sophosnews.files.wordpress.com/2012/09/aids-info-demand-500.png?w=488&h=232; “File:AIDS DOS Trojan.png,” Wikimedia Commons, https://commons.wikimedia.org/w/index.php?curid=45320703.
Dear Customer:
It is time to pay for your software lease from the PC Cyborg Corporation. Complete the INVOICE and attach payment for the lease option of your choice. If you don’t use the printed INVOICE, then be sure to refer to the important reference numbers below in all correspondence. In return you’ll receive:
a renewal software package with easy-to-follow, complete instructions;
an automatic, self-installing diskette that anyone can apply in minutes.
Important reference numbers: A5599796-2695577-
The price of 365 user applications is US$189. The price of a lease for the lifetime of your hard disk is US$378. You must enclose a banker’s draft, cashier’s check, or international money order payable to the PC CYBORG CORPORATION for the full amount of $189 or $378 with your order. Include your name, company, address, city, state, country, zip or postal code. Mail your order to PC Cyborg Corporation, P.O. Box 87-17-44, Panama 7, Panama.
Victims’ computers were effectively rendered useless. Although the files were technically recoverable, many affected users did not realize this, and accidentally deleted their own data while attempting to reinstall and recover the files.6
6. Simone, “The Strange History of Ransomware.”
The AIDS Trojan was a far cry from modern ransomware, and researchers were quickly able to develop tools that reversed the effects. This was possible because of a few key design flaws:
The ransomware used symmetric key encryption, meaning the same key was used to encrypt and decrypt the data. The key was also distributed with the malware, so once researchers uncovered it, they were able to write tools that decrypted the filenames.
The same key was used for all victim computers, so once it was recovered for one computer, all other victims could decrypt their data, too.
The ransomware simply hid files and did not actually encrypt the contents (just the filenames). A savvy user could find and reopen their files using a different operating system, although the filenames would be scrambled.
The malware was quickly traced back to Popp, who was living in the United Kingdom at the time. He was subsequently extradited to the United States, where he stood trial. Popp claimed that the ruse was an attempt to raise money for AIDS research and was ultimately declared mentally unfit to stand trial.
A researcher named Jim Bates published a detailed technical analysis of the malware in Virus Bulletin and distributed two free programs to clean the malware and restore victims’ files: AIDSOUT and AIDSCLEAR. Despite the AIDS Trojan’s inherent flaws, the idea of ransomware was born.
2.2 Cryptoviral Extortion
In 1996, Adam Young of Columbia University and Moti Yung, who at that time worked for the IBM T. J. Watson Research Center, unveiled the concept of “cryptovirology,” which they defined as the “study of the applications of cryptography to computer viruses.” In their paper, these researchers presented a description of what we now see as modern ransomware: “extortion-based attacks that cause loss of access to information, loss of confidentiality, and information leakage.”7
7. Adam Young and Moti Yung, “Cryptovirology: Extortion-Based Security Threats and Countermeasures,” www.ieee-security.org/TC/SP2020/tot-papers/young-1996.pdf.
At the time, malware was commonly deployed for information theft purposes (i.e., stealing payment card numbers), to gain persistent remote access, or simply as a nuisance. Cyber extortion attempts at the time were rare, and when they occurred, they were not very successful (as in the case of the AIDS Trojan). Young and Yung specifically pointed out that existing attempts by malware authors to engage in extortion were inherently flawed, because they leveraged either no encryption or symmetric key encryption. In the latter case, the keys could simply be extracted from the malware.
As an alternative, Young and Yung introduced the idea of using asymmetric key encryption for purposes of extortion. In so doing, they foresaw a critical advancement that would later pave the way for the global ransomware epidemic. “We believe that it is better to investigate this aspect rather than to wait for such attacks to occur,” they wrote.8
8. Young and Yung, “Cryptovirology,” p. 1.
The researchers described a proof-of-concept virus that was designed to accomplish two things:
Infect a computer system with a Trojan that would be difficult to detect, and likely to survive on its infected host.
Utilize public key encryption to lock files on the computer.
Using these parameters, Young and Yung demonstrated their attack on a Macintosh SE/30 computer, utilizing RSA and TEA encryption to render the victim’s data unusable. The malware generated a unique symmetric key for each infected host, which was used to encrypt the victim’s files. The symmetric key was then encrypted using the malware authors’ public key, and deleted from memory.
In this manner, the researchers addressed the key weaknesses of the AIDS Trojan and similar early ransomware prototypes—namely, the victim could not recover the decryption key from the malware or local system, and a unique key was used for each infected computer. This proof-of-concept virus foreshadowed modern ransomware.
2.3 Early Extortion Malware
Apparently, criminals don’t always read IEEE research papers, because it was a decade before adversaries actually implemented the powerful concepts introduced by Young and Yung. In the meantime, cyber extortion evolved in fits and starts.
“In December 2004 we received the first samples of a number of files which were encrypted by an unknown encryption program,” wrote Alexander Gostev, Senior Virus Analyst at Kaspersky. “There was no hint that in six [months’] time, such files would become so common that we would be receiving several dozen a day.”9
9. Denis Nazarov and Olga Emelyanova, “Blackmailer: The Story of Gpcode,” Secure List, June 26, 2006, https://securelist.com/blackmailer-the-story-of-gpcode/36089/.
This was the earliest known example of Gpcode, a malware strain likely of Russian origin that was designed to encrypt the victim’s files. At first, Gpcode used a weak encryption algorithm apparently designed by the malware’s authors, which was easy for researchers to crack. However, the authors quickly improved their malware and released stronger variants. In 2006 (a decade after Young and Yung’s paper), a new variant of Gpcode emerged that incorporated strong RSA asymmetric key encryption. The future was here.
Not all cyber extortion malware incorporated this novel technique, however. “Locker” malware, also known as lockerware, evolved and proliferated during the same time frame, peaking around 2011–2012.10 Typically, lockerware denied victims access to system resources by locking the screen or disabling the mouse and keyboard. The victim was presented with a ransom note that demanded a payment to regain access to the system. The underlying files were not always encrypted, and victims were typically able to restore access to their system with help from an IT professional. Reveton, also known as the “Police Trojan,” was one example of lockerware that spread throughout the world. Reveton disabled user access to system resources, and made it appear that law enforcement had locked up the victim’s computer. Some variants of Reveton encrypted files as well, but many versions did not.11
10. Kevin Savage, Peter Coogan, and Hon Lau, The Evolution of Ransomware (Symantec, August 6, 2015), p. 10, https://docs.broadcom.com/doc/the-evolution-of-ransomware-15-en.
11. Mariese Lessing, “Case Study: Reveton Ransomware,” SDX Central, June 17, 2020, www.sdxcentral.com/security/definitions/case-study-reveton-ransomware/.
Despite the flurry of extortion malware development, the process of communicating with victims and receiving payments remained clunky. Typically, criminals left notes with email addresses or phone numbers on their victim’s systems. Since these could be traced, the adversaries changed their contact information frequently, effectively abandoning some victims and leaving money on the table.
Payment methods were also risky and slow. Typically, adversaries instructed their victims to pay using alternative payment systems such as Ukash or Paysafe, wire transfers, or payment voucher systems such as MoneyPak. The earliest Gpcode strains instructed victims to send money using Yandex (a Russian electronic payment service similar to PayPal). All of these payment systems were brokered by third parties, and could potentially be monitored by law enforcement, enabling them to intercept payments and bust crime rings. It wasn’t until the emergence of key technological advancements in communication and payment systems that ransomware as we know it finally took off.
2.4 Key Technological Advancements
As technology evolved, so did cyber extortion attacks. Two advancements, in particular, contributed to the modernization of this criminal activity: cryptocurrency and onion routing. These technologies enabled adversaries to engage in fast, anonymous communications and payments, thereby reducing risk and increasing reward. Underlying both technologies is asymmetric key encryption, which we will discuss first.
2.4.1 Asymmetric Cryptography
Asymmetric cryptography, also known as public key cryptography, is perhaps the most crucial technology underlying the epidemic of modern cyber extortion attacks. It is a critical component of the following:
Modern file-encrypting ransomware
Cryptocurrency
Onion routing, which supports anonymous criminal communications channels, dark e-commerce sites, and data leak portals
While a full treatment of asymmetric cryptography is beyond the scope of this book, we will provide a general overview here to help you understand how ransomware evolved into such a destructive force. The same technologies have facilitated the expansion of all other forms of cyber extortion as well.
Definition: Cryptography Terms
Cryptography: The process of transforming information based on an algorithm so that it is only meaningful for authorized parties.
Algorithm: A series of steps used to accomplish a task.
Encryption: The process of scrambling information so it cannot be accessed by anyone except authorized parties. This is accomplished using an algorithm and a key that is held by one or more parties.
Key: A long sequence of numbers used as input to the algorithm. Keys are frequently stored in files on a computer or external hard drive.
Private key: A key that is kept secret, and is held only by the owner.
Public key: A key that can be distributed to the world.
Digital signature: A block of data used to identify and authenticate the sender of a message, verify its integrity, and facilitate nonrepudiation.
One-way hash function (message digest algorithm): A mathematical procedure used to transform any arbitrary message into a short, fixed-length sequence of numbers. Ideally, the resulting “hash” is unique for each message.
Given modern encryption algorithms and key lengths, attempts to guess a key today can mathematically take millions upon millions of years to achieve, even using the most powerful computers that have ever been created. This problem, referred to as “computational intractability,” generally means that once a ransomware strain encrypts files, the only realistic way to recover the data is to obtain a decryption key—either by paying the adversary or through another means.
2.4.1.1 Ransomware and Symmetric Encryption
We previously discussed how early ransomware strains used symmetric encryption to deny victims access to their data. Symmetric cryptography relies on a single key to perform and reverse a function. For example, when encrypting data, the same key is used to encrypt as well as decrypt. This is very convenient for hard drive encryption, as a master key can be built into a hardware chip on a computer (such as on the Trusted Platform Module, or TPM chip). Symmetric key encryption can also be used to lock up files before they are stored in a data repository, such as a backup tape or cloud file share.
The benefit of symmetric key cryptography is that it is very fast. However, the reliance on a single key introduces a major drawback—namely, that all parties need to be in possession of the key to use it.
In early ransomware strains that relied on symmetric keys, the secret key was distributed with the ransomware itself. The ransomware used it to encrypt all the files on the victim’s system. This created an obvious weakness: Because the symmetric key was present in the malware, and on the victim’s system, it was often possible for defenders to recover the key and decrypt the victim’s files without paying the adversary.
2.4.1.2 Ransomware and Asymmetric Encryption
Enter asymmetric (“public key”) cryptography, which relies on a pair of keys. These keys are generated at the same time and perform complementary functions. For example, what one key encrypts, the other can decrypt.
The concept of asymmetric encryption is deceptively simple—and powerful. No longer did adversaries have to worry about victims unlocking their own files using a key that was distributed in the malware. In the simplest model, adversaries generated a pair of keys:
The public key was distributed with the ransomware and used to encrypt the victim’s data.
The private key was held by the adversary, and only released to the victim after payment was received.
The downside of asymmetric encryption is that it is not as fast as symmetric key encryption. Speed was very important for cyber extortionists, who needed to encrypt large data sets as quickly as possible, before they were discovered.
2.4.1.3 A Hybrid Model Emerges
Today’s ransomware strains leverage the best of both worlds, by combining both symmetric and asymmetric key encryption. Here is a typical model:
Ransomware is distributed with the adversary’s public key (or even multiple public keys, in the case of modern affiliate models; see Section 2.9.4.1).
When a victim’s computer is infected, the ransomware automatically generates a unique symmetric key, which is used to encrypt data quickly. Some ransomware strains generate a unique key for each computer, or for individual file shares, or based on any segmenting model of the adversary’s choice.
The symmetric key is then encrypted using the adversary’s public key (or keys) and stored locally in a file known as a “keybag.”
After payment is made, the criminal releases a decryption utility (known as a “decryptor”) that contains the appropriate private key. The decryptor is designed to use the private key to unlock the keybag and decrypt the victim’s files.
In this manner, today’s adversaries leverage the speed of symmetric encryption, along with the security of asymmetric encryption. There are many variations on this model, but the general concept of a hybrid encryption model for file-encrypting ransomware has become widespread.
2.4.1.4 Digital Signing and Verification
Encryption alone couldn’t enable adversaries to launch extortion attacks on the massive, global scale that we see today. Fast and anonymous payment methods and communications systems were also critically important. It turned out that both of these could be achieved using asymmetric cryptography, too.
Recall that asymmetric cryptography relies on a pair of keys that perform complementary functions. For example, what one key signs, the other key can verify. How does this work?12
12. “Security Tip (ST04-018): Understanding Digital Signatures,” Cybersecurity & Infrastructure Security Agency, revised August 24, 2020, https://us-cert.cisa.gov/ncas/tips/ST04-018.
The sender uses a hash function to convert a message to a short, fixed-length chunk of data (“hash”).
The sender uses their private key to encrypt the hash, using a digital signing algorithm.
The encrypted hash is appended to the message (which is now “digitally signed”) and the whole package is sent to the recipient.
To verify the digital signature, the recipient (or anyone with access to the message) uses the sender’s public key, along with the digital verification algorithm, to decrypt the encrypted hash.
The recipient also generates their own hash of the message and compares it to the decrypted hash. If the values match, then it confirms that the public key is correct and the message has not been modified since it was signed.
This process is fundamental to cryptocurrency and the dark web, as we will see in the following sections.
2.4.2 Cryptocurrency
Cryptocurrency is deeply intertwined with the rise of cyber extortion. In real-life kidnapping cases, criminals want payment in cash—not check or credit card—because cash payments are:
Instantaneous
Difficult to trace
Nonreversible
The same is true when it comes to cyber extortion. In the early days, would-be cyber extortionists were hampered by slow and risky payment methods. Wire transfers, electronic payment systems, voucher methods, and other creative solutions could all be tracked by law enforcement and intercepted. More advanced criminals employed sophisticated money laundering schemes in order to hide their identities and remain safe—but that introduced delays and expenses.
2.4.2.1 The Birth of Bitcoin
Cryptocurrency changed all that. On October 31, 2008, a cryptographer who went by the pseudonym “Satoshi Nakamoto” posted a groundbreaking new paper to a popular cryptography mailing list. “I’ve been working on a new electronic cash system that’s fully peer-to-peer, with no trusted third party,” they wrote. With that, Bitcoin—the world’s first cryptocurrency—was born.13
13. Satoshi Nakamoto, email to [email protected], October 31, 2008, retrieved from the inbox of Sherri Davidoff on October 11, 2021.
A Bitcoin is not a coin at all; it is a chain of digital signatures. Each person holds one or more public/private key pairs, which can be used to spend and receive Bitcoin. Transactions are tracked in a blockchain, a distributed ledger that anyone can download.
To send money, the current owner creates a new message indicating an amount of cryptocurrency and the new owner’s public key, and then signs this message using their private key. This message is broadcast to the Bitcoin network and attached to the blockchain.
To create new Bitcoin, miners (specialized software programs) work to solve a difficult mathematical puzzle. When a miner finds the correct answer, it submits it to the Bitcoin network for validation. If the answer is correct and has not previously been validated, the Bitcoin network creates a new block (a data entry on the blockchain) and the miner is rewarded with ownership of the newly minted Bitcoin, along with any transaction fees. Miners can also make money by validating transactions submitted by others, in which case they gain associated transaction fees.
2.4.2.2 Usage in Cyber Extortion
Once Bitcoin emerged, adversaries suddenly had the ability to receive fast, anonymous, nonreversible payments from victims. While there are many legitimate reasons to use cryptocurrency (privacy protections, political donations, etc.), it was undoubtedly the case that criminals were more willing than mainstream vendors to take risks on a new payment model.
Bitcoin is not backed by a commodity like gold or silver, but rather is a digital currency that is recognized as legal tender. No central authority manages digital currency; instead, the value is set by the market. As a result, the value of Bitcoin and other cryptocurrencies can swing wildly, which can create unexpected challenges for both victims and extortionists during the negotiation phase (see Section 8.5.3 for details).
Although Bitcoin has remained consistently popular among cyber extortionists, many adversaries accept and even prefer other cryptocurrencies. In particular, Monero has gained traction because it more difficult for law enforcement to trace, reducing risk for cybercriminals. See Section 8.2 for more details.
Definition: Cryptocurrency Terms
Blockchain: A distributed digital transaction ledger that stores a record of all transactions.
Cryptocurrency: A digital asset in which cryptography is used to regulate creation of new units and transfer of funds.
Digital coin: A chain of digital signatures.
Mining: The process of solving and validating complex mathematical equations so as to gain cryptocurrency.
Wallet: Software that stores your public and private keys.
2.4.3 Onion Routing
Cyber extortionists needed fast and anonymous communication methods to facilitate negotiations, create leverage over their victims, and coordinate internally. Onion routing provided these capabilities, and many more, ultimately enabling adversaries to buy and sell tools to support their crimes, anonymously leak sensitive data, and scale their cybercriminal enterprises.
2.4.3.1 What Is Onion Routing and How Does It Work?
Onion routing is the technology that underlies darknets and the “dark web,” which are used by criminals, journalists, intelligence agencies, whistleblowers, and others to facilitate anonymous communications. The concept is simple: To maintain anonymity, network traffic is passed through a series of computers so that the ultimate source and destination addresses are unknown to any one system.
Upon launching onion routing software, a user’s computer establishes a circuit, which is simply the path that the user’s traffic will take through the Internet and back. The route that the data takes through the network is encrypted in layers using the public key of each computer in the circuit.14
14. Tor Project, https://2019.www.torproject.org/about/overview.html.en.
As data travels through the circuit, each computer uses its private key to decrypt the outer layer, which reveals the address of the next computer. The data is then passed along to that computer. The next computer in the circuit does the same thing, and so on, until the data reaches its destination. No computer in the circuit has the address of both the source and destination systems, thereby preserving anonymity.
Heads Up! Weaknesses of Onion Routing
There are many ways to potentially break the anonymity provided by onion routing. For example, in timing attacks, a third party with access to multiple systems in the network monitors the traffic carefully and connects a source and destination based on timing and other traffic characteristics. Information disclosure issues can also lead to identification, such as in cases where a user shares their social media information or discloses other identifying characteristics. Despite these risks, adversaries who take precautions can successfully remain anonymous for years.
2.4.3.2 The Dark Web
Onion routing is the technology that underlies the dark web, which in turn has led to a proliferation of dark e-commerce sites, criminal chat forums, data leak portals, and more.15 The “dark web” refers to a collection of web services accessible only using onion routing software.
15. Tor Project.
The dark web was popularized by The Onion Routing project, or TOR for short, which was developed during the early 2000s by scientists Paul Syverson, Roger Dingledine, and Nick Mathewson.16 TOR enables uses to offer “hidden services” such as websites, email, and chat rooms, by registering in the TOR network and obtaining a “hidden service descriptor”—that is, a 16- or 56-character domain name.17
16. Tor Project.
17. “Hidden Service Names,” https://gitlab.torproject.org/legacy/trac/-/wikis/doc/HiddenServiceNames.
Since its inception, the dark web has become a haven for the cybercriminal underworld. Prominent cyber extortion cartels like Conti, REvil, and many others rely on the dark web to collaborate, purchase access to victim networks, post stolen client data, negotiate ransom payments, and much more.
2.5 Ransomware Goes Mainstream
By 2013, the major features needed for truly modern cyber extortion were in place. Asymmetric encryption was well developed and commonly used, cryptocurrency had been launched, and the dark web was widely used. This combination allowed for a new era of cybercrime.
CryptoLocker, first identified in the fall of 2013,18 was the first widespread malware to complete the evolution into what is considered “modern” ransomware. It incorporated the following elements:
18. “Original Cryptolocker Ransomware Support and Help Topic,” Bleeping Computer, September 6, 2013, www.bleepingcomputer.com/forums/t/506924/original-cryptolocker-ransomware-support-and-help-topic/.
Hybrid encryption model: Local files were first encrypted with AES-256 symmetric keys, and then the symmetric keys were encrypted with a unique RSA-2048 public key downloaded from the adversary’s server. The corresponding private key was held only by the adversary.19
19. “CryptoLocker Ransomware Information Guide and FAQ,” Bleeping Computer, October 14, 2013, www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information#cryptolocker.
Cryptocurrency payment option: Victims could pay the ransom demand by sending funds to the specified Bitcoin wallet address or by using MoneyPak vouchers.20
20. “CryptoLocker Ransomware Information Guide and FAQ.”
Using these technologies, the criminals behind CryptoLocker were able to extort millions of dollars from their victims, while obscuring their identities for an extended period of time.
Ultimately, the CryptoLocker distribution system was disrupted by Operation Tovar, an international collaboration between law enforcement, tech companies, and security researchers.21 The new model for cyber extortion lived on, however, and was quickly expanded upon in 2014 with the release of the appropriately named Onion ransomware.
21. Darlene Storm, “Wham Bam: Global Operation Tovar Whacks CryptoLocker Ransomware & GameOver Zeus Botnet,” Computerworld, June 2, 2014, www.computerworld.com/article/2476366/wham-bam--global-operation-tovar-whacks-cryptolocker-ransomware---gameover-zeus-b.html.
Unlike other ransomware strains that used clear-web servers for their command-and-control (C2) servers, the Onion ransomware leveraged the TOR network for C2 communications. This made its identification and takedown much more difficult for law enforcement and security teams.22
22. Ransomware: Past, Present, Future (Trend Micro, 2017), https://documents.trendmicro.com/assets/wp/wp-ransomware-past-present-and-future.pdf.
Ransomware attracted significant mainstream media attention in 2016 when a cybercriminal group took over the Hollywood Presbyterian Medical Center and demanded $17,000 to unlock critical computers used by the hospital.23 Ransomware gangs were expanding rapidly, attacking larger targets, and demanding more money—cementing ransomware’s place as one of the most costly and devastating types of cyberattacks. At its peak, the ransomware strain Locky infected an estimated 90,000 computers per day.24
23. Richard Winton, “Hollywood Hospital Pays $17,000 in Bitcoin to Hackers; FBI Investigating,” Los Angeles Times, February 18, 2016, www.latimes.com/business/technology/la-me-ln-hollywood-hospital-bitcoin-20160217-story.html.
24. Thomas Brewster, “As Ransomware Crisis Explodes, Hollywood Hospital Coughs up $17,000 in Bitcoin,” Forbes, February 18, 2016, www.forbes.com/sites/thomasbrewster/2016/02/18/ransomware-hollywood-payment-locky-menace/.
The public reactions to ransomware and cyber extortion changed significantly during this period as well. New guidance from the U.S. Office for Civil Rights made it clear that victims had to presume that ransomware infections were reportable breaches under HIPAA unless they could demonstrate otherwise.25 In consequence, victims could no longer simply pay a ransom and sweep their malware infections under the rug. This led to an increase of insurance claims and reportable breaches linked to ransomware, particularly in the healthcare sector.
25. “Fact Sheet: Ransomware and HIPAA,” U.S. Department of Health and Human Services, Office for Civil Rights, July 11, 2016, www.hhs.gov/sites/default/files/RansomwareFactSheet.pdf.
2.6 Ransomware-as-a-Service
In 2018, a prominent and strangely vocal cybercriminal gang known as “GandCrab” emerged.26 GandCrab popularized a new ransomware-as-a-service (RaaS) model in which they maintained and licensed centralized ransomware software and gave access to other criminals in exchange for a cut of the profits.
26. “Pinchy Spider,” CrowdStrike, https://adversary.crowdstrike.com/en-US/adversary/pinchy-spider/.
Essentially, RaaS was a franchise model, which divided responsibilities into two primary roles:
Operators: The individuals responsible for developing, maintaining, and upgrading the software used to infect and encrypt victims. The operators are also mainly responsible for handling the cryptocurrency payment process, infrastructure development, and other essential behind-the-scenes tasks. Often, operators delegate tasks to specialists such as malware developers.
Affiliates: The individuals responsible for acquiring targets, compromising networks, and distributing the malicious software. The affiliate receives 60% to 70% of the ransom paid as a commission.
The model was a success, to say the least. Reportedly, GandCrab infected roughly 50,000 computers in its first month of existence. Each individual victim was extorted for anywhere between $400 and $700,000, with ransoms paid using a cryptocurrency called DASH.27
27. “Ransomware Knowledgebase: GandCrab Ransomware,” KnowBe4, https://www.knowbe4.com/gandcrab-ransomware.
Because of this success, the GandCrab operators were able to invest significant amounts of capital into further developing their RaaS platform. Before long, new features, versions, and specific customizations began to appear that greatly improved the overall effectiveness and ease of use for affiliates. For example, the upgrades included the ability to quickly spread through a network by automatically scanning computers for common vulnerabilities and exploiting them to maximize their footprint.
On May 31, 2019, a group claiming to be the GandCrab operators proudly announced to the world that they intended to retire after successfully extorting victims for a combined total of more than $2 billion.28 Their model had proved to be incredibly effective and profitable, ultimately lowering the technical barriers to entry and making cyber extortion accessible to less technical criminals.
28. “REvil: The GandCrab Connection,” Secureworks, September 24, 2019, www.secureworks.com/blog/revil-the-gandcrab-connection.
The franchise model quickly became standard for other cyber extortion groups. Almost immediately after GandCrab’s retirement, a ransomware variant known as “REvil” appeared that utilized an almost identical business model and some of the same code that GandCrab had incorporated.
2.7 Exposure Extortion
At the same time that ransomware was taking off, a different cyber extortion trend was gaining traction: exposure. An adversary calling themselves “The Dark Overlord” (TDO) went on a cybercrime spree in 2016, hacking into healthcare clinics, professional services firms, and more. TDO stole each victim’s sensitive data and threatened to publish it if they didn’t pay the ransom.
In the case of Athens Orthopedic Clinic, as with many others, TDO emailed the victim and demanded payment in exchange for not publishing patient data. When the clinic did not immediately pay the ransom, TDO increased the cost and began posting batches of stolen patient data on Pastebin, along with personal notes directing the CEO to “pay up.”29
29. “Athens Orthopedic Clinic Patient Data Still Exposed on Leak Site,” DataBreaches.net, August 17, 2016, www.databreaches.net/athens-orthopedic-clinic-patient-data-still-exposed-on-leak-site/.
The cyber extortionists used Twitter to taunt and threaten their victims and made a point of reaching out to journalists and releasing statements for the press. “Next time an adversary comes to you and offers you an opportunity to cover this up and make it go away for a small fee to prevent the leak,” TDO wrote in one public statement, “take the offer.”30
30. Darlene Storm, “Hacker Selling 655,000 Patient Records from 3 Hacked Healthcare Organizations,” Computerworld, June 27, 2016, www.computerworld.com/article/3088907/hacker-selling-655-000-patient-records-from-3-hacked-healthcare-organizations.html.
TDO also directly contacted the victims’ patients, customers, and community members to apply even more pressure. In the case of Midwest Orthopedic Pain and Spine, they texted the daughter of one of the clinic’s owners, “hi … you look peaceful … by the way did your daddy tell you he refused to pay us when we stole his company files in 4 days we will be releasing for sale thousands of patient info. Including yours.”31
31. United States of America v. Nathan Wyatt, November 8, 2017, p. 6, www.justice.gov/opa/press-release/file/1227441/download.
In 2017, TDO hacked the Johnston Community School District in Iowa and texted threatening messages to parents.32 “The life of a precious young child is so precious,” read one message.33 Another was more blatant: “I’m going to kill some kids at your son’s high school.”34 The district closed its schools for a day and delayed school the second day as law enforcement investigated the credibility of the threat. The gang threatened to publish student information from the Iowa district and made good on their threat when the district did not readily agree to pay.35,36
32. Charly Haley, “Police: Cyber Threats to Johnston Students Not Credible,” Des Moines Register, October 3, 2017, www.desmoinesregister.com/story/news/crime-and-courts/2017/10/03/police-cyber-threats-johnston-students-not-credible/727547001/.
33. Haley, “Police: Cyber Threats to Johnston Students Not Credible.”
34. Ms. Smith, “Dark Overlord Hacks Schools Across U.S., Texts Threats Against Kids to Parents,” CSO, October 9, 2017, www.csoonline.com/article/3230975/dark-overlord-hacks-schools-across-us-texts-threats-against-kids-to-parents.html.
35. Linh Ta and Jason Clayworth, “‘Dark Overlord’ Hackers Posted Stolen Student Info, Johnston Officials Say,” Des Moines Register, October 5, 2017, www.desmoinesregister.com/story/news/crime-and-courts/2017/10/05/dark-overlord-hacker-johnston-schools-threats/735950001/.
36. Ta and Clayworth, “‘Dark Overlord’ Hackers Posted Stolen Student Info.”
Eventually, TDO was banned from Twitter, Reddit, and other social media platforms, disrupting the gang’s public relations processes.37 A member of the group, Nathan Wyatt, was extradited from the United Kingdom, charged in U.S. district court, and sentenced to five years in federal prison for his role.38
37. “Banned from Twitter & Reddit, Dark Overlord Disappears from Steemit,” E-Crypto News, https://e-cryptonews.com/banned-from-twitter-reddit-dark-overlord-disappears-from-steemit/.
38. “UK National Sentenced to Prison for Role in ‘The Dark Overlord’ Hacking Group,” U.S. Department of Justice, September 21, 2020, www.justice.gov/opa/pr/uk-national-sentenced-prison-role-dark-overlord-hacking-group.
The TDO gang popularized exposure extortion and introduced tactics such as deliberate public relations efforts, which were later adopted by other cybercriminal gangs. However, their hacking and extortion efforts were largely a manual process, which limited their growth.
As we will see in the next sections, during the coming years cyber extortionists introduced scalable hacking and data exposure practices that took exposure extortion to the next level.
Case Study: Early Cyber Extortion
Cybercriminals launched exposure extortion attacks long before ransomware became rampant. For example, in 1999, a Kazakhstani hacker named Oleg Zezev broke into Bloomberg’s systems and gained access to CEO Michael Bloomberg’s personal account, as well as the accounts of other employees and customers. Zezev emailed Bloomberg with screenshots and threatened to notify customers, as well as the media, unless Bloomberg paid him $200,000.39
39. “U.S. Convicts Kazakhstan Hacker of Breaking into Bloomberg L.P.’s Computers and Attempting Extortion,” U.S. Department of Justice, February 26, 2003, www.justice.gov/archive/criminal/cybercrime/press-releases/2003/zezevConvict.htm.
Michael Bloomberg, in collaboration with the FBI, agreed to the hacker’s terms—on the condition that Zezev meet with him and his computer experts in London to explain how the attack was executed. Zezev agreed, and was promptly arrested by Scotland Yard detectives after the meeting.40,41 Later, he and a co-conspirator were extradited to the United States, where he was tried and sentenced to more than four years in prison. According to the U.S. Department of Justice, at the time, this sentence was “amongst the longest ever imposed for a computer intrusion charge.”42
40. “U.S. Convicts Kazakhstan Hacker of Breaking into Bloomberg.”
41. John Lehmann, “Jury Convicts Wacky Bloomberg Extortionist,” New York Post, February 27, 2003, https://nypost.com/2003/02/27/jury-convicts-wacky-bloomberg-extortionist/.
42. “Kazakhstan Hacker Sentenced to Four Years Prison for Breaking into Bloomberg Systems and Attempting Extortion,” U.S. Department of Justice, July 1, 2003, www.justice.gov/archive/criminal/cybercrime/press-releases/2003/zezevSent.htm.
2.8 Double Extortion
Why extort victims using one method when you can use two? By the end of 2019, ransomware was rampant—but many organizations had introduced effective backup practices and were able to restore their data without paying a ransom demand. This glaring weakness in the ransomware business model was a problem waiting for a solution, and in November 2019 that solution was unleashed with the emergence of the Maze ransomware cartel.43
43. Pieter Arntz, “Maze: The Ransomware That Introduced an Extra Twist,” Malwarebytes Labs (blog), updated July 16, 2021, https://blog.malwarebytes.com/threat-spotlight/2020/05/maze-the-ransomware-that-introduced-an-extra-twist/#:~:text=Maze%20ransomware%20was%20developed%20as,Segura%20in%20May%20of%202019.
The Maze gang took a two-pronged approach: They encrypted their victim’s files, and they also stole the data and threatened to publish it if the victim did not pay up. For example, in December 2020, Maze attacked Southwire, a leading cable and wiring manufacturer, encrypting 878 devices and disrupting the organization ’s operations. The criminals demanded 850 Bitcoin (roughly $6 million at the time of the attack). Southwire refused to pay the ransom, and within a day had already started restoring critical systems.44
44. Jessica Saunders, “Cybersecurity Incident at Metro Atlanta's 4th-Largest Private Company Disrupts Manufacturing, Shipping,” Atlanta Business Chronicle, December 11, 2019, www.bizjournals.com/atlanta/news/2019/12/11/cybersecurity-incident-at-metro-atlantas-4th.html.
The criminals were prepared for this, however. “We have also downloaded a lot of data from your network,” they wrote in the ransom note, “so in case of not paying this data will be released.”45
45. John E. Dunn, “‘Maze’ Ransomware Threatens Data Exposure Unless $6m Ransom Paid,” Naked Security by Sophos, January 7, 2020, https://nakedsecurity.sophos.com/2020/01/07/maze-ransomware-threatens-data-exposure-unless-6m-ransom-paid/.
Unlike other ransomware gangs, the Maze group launched a data leak website to support publication of their stolen goods. “Represented here companies don’t wish to cooperate with us, and trying to hide our successful attack on their resources,” read the headline on the Maze cartel’s website. They encouraged the public to check back for updates. “Watch for their databases and private papers here. Follow the news!”46 Much like TDO, Maze also regularly engaged with journalists, responding to questions, giving interviews, and releasing public statements.
46. From a screenshot taken by LMG Security, December 2019. Also available from https://web.archive.org/web/20191218035420/https://mazenews.top/.
When Southwire still did not pay, the Maze group published a subset of the data on their website. In an unusual twist, Southwire filed a lawsuit against the criminals and sought an injunction against their web hosting provider, which was based in Ireland.47 Southwire was successful in taking down the Maze website,48 but the victory was short-lived. Soon afterward, Maze was back with a vengeance, this time using a different hosting provider. The gang leaked more than 14 GB of Southwire’s stolen data, and threatened to publish another 10% each week until the ransom demand was paid.49
47. Lawrence Abrams, “Maze Ransomware Sued for Publishing Victim's Stolen Data,” Bleeping Computer, January 2, 2020, www.bleepingcomputer.com/news/security/maze-ransomware-sued-for-publishing-victims-stolen-data/.
48. Matthew J. Schwartz, “Maze Ransomware Victim Sues Anonymous Attackers,” Bank Info Security, January 3, 2020, www.bankinfosecurity.com/maze-ransomware-victim-sues-anonymous-attackers-a-13574.
49. “Data of Southwire Company Leaked by Maze Ransomware,” Secure Reading, January 15, 2020, https://securereading.com/data-of-southwire-company-leaked-by-maze-ransomware/.
Suddenly, organizations that had been well prepared for a ransomware attack found themselves at risk of a different kind of cyber extortion. And just as suddenly, effective backups couldn’t save the organization from an information disclosure threat.
It was the beginning of a new attack trend: exposure extortion, conducted using scalable techniques. Maze closed its operation in November 2020, but that did not mean that the individuals behind the extortion were truly gone.
Heads Up! Triple Extortion?
In 2021, news headlines began to blast the term “triple extortion.” Some vendors and journalists used this term to refer to the situation in which an adversary directly threatens customers, patients, or other third parties as part of their extortion attempt.50 This threat was not novel, as the media would have had readers believe: Adversaries such as TDO had been contacting third parties as a pressure tactic for years.
50. Becky Bracken, “Ransomware’s New Swindle: Triple Extortion,” Threat Post, May 14, 2021, https://threatpost.com/ransomwares-swindle-triple-extortion/166149/.
Confusingly, other journalists simply used the term to refer to the introduction of a third threat—such as a denial-of-service attack, in addition to ransomware and data exposure.51 A new wave of articles combined the two concepts, as in an Insurance Journal article that defined “triple extortion” as incidents that “combine distributed denial-of-service (DDoS) attacks, file encryption and data theft—and don’t just target one company, but potentially also its customers and business partners.”52
51. Jie Ji, “The New Trend of Ransomware: Triple Extortion,” NSFocus, August 16, 2021, https://nsfocusglobal.com/the-new-trend-of-ransomware-triple-extortion/.
52. L. S. Howard, “Biz Interruption, Recovery Costs Drive Financial Losses from Cyber Attacks: Report,” Insurance Journal, October 14, 2021, www.insurancejournal.com/news/international/2021/10/14/637049.htm.
In this book, we will refrain from using the term “triple extortion” due to the lack of consensus on definition. Undoubtedly, the use of this term will continue to evolve along with adversary threat models.
2.9 An Industrial Revolution
Cyber extortionists had hit on an effective business model. Total ransom payments ballooned 344% between 2019 and 2020, with criminals raking in more than $406 million in 2020 alone, according to Chainalysis.53 (Criminals almost certainly raked in more funds than that, since many cyber extortion wallet addresses remain unknown to this day.) In late February 2022, the massively successful Conti gang suffered a data leak that revealed they had made more than 65 million Bitcoin (equivalent to more than $2.7 billion at the time of the leak) in less than 5 years of operation.
53. Chainalysis, Ransomware 2021: Critical Mid-Year Update, May 2021, p. 6.
This dramatic increase in revenue was driven by advancements in cybercriminal technologies, combined with maturing business processes. The Maze group’s massive success paved the way for other cyber extortion gangs such as REvil, Conti, and others, which then launched their own data leak platforms and expanded their leverage using exposure extortion.
What did the adversaries do with their riches? They reinvested some of their profits into improving cyber extortion technology and operations, enabling them to conduct cyber extortion operations far more efficiently and on a massive scale. Here are specific areas in which cyber extortionists improved and expanded:
Specialized roles
Paid staff
Automated extortion portals
Franchising
Public relations programs
Standardized playbooks and tools
We will discuss each of these advancements in the following sections.
2.9.1 Specialized Roles
Extortion is hard work. In the early days, the process of extorting a victim was largely a manual task. The network had to be compromised, data stolen, ransomware deployed and detonated. Communications had to be established with the victim. Then, a ransom had to be negotiated, decryptors needed to be generated, and the transaction had to be finished. On top of that, there were language barriers and time zone differences, and adversaries were operating in a hostile environment in which responders were constantly trying to lock them out. It was, undoubtedly, exhausting.
Practically speaking, accomplishing these tasks required a wide variety of skill sets and tools. For example, here are just a few of the tasks that adversaries must usually complete to execute a cyber extortion attack, and the skills needed to do so:
Initial entry: Exploit development, deployment (typically through phishing or use of remote access credentials), hacking skills
Data exfiltration: Basic IT skills, understanding of the victim’s business (enough to identify which data to exfiltrate and how to blend with normal traffic)
Communications with the victim: Language/translation capabilities, strong written and verbal communications skills, familiarity with incident response processes and key players such as insurance
Negotiation: Understanding of the victim’s business model and applicable regulations (often, adversaries refer to HIPAA/GDPR and other notification statutes), strong communication skills (as just mentioned), comfort with psychological scare tactics, ability to build/maintain trust with victim throughout the negotiation
Decryption: Development and deployment of a decryption utility, technical support capabilities in the event that the victim experiences issues
Payment receipt: Familiarity with cryptocurrency, ability to launder funds and convert them to cash if desired
Any business manager reviewing this list would quickly conclude that it’s rare to find all of these skill sets in a single person. Even if you could, it wouldn’t be an efficient use of human resources. Over time, cyber extortion gangs began defining separate roles to handle specific parts of the cyber extortion process. This led to efficiency gains and increased return on investment.
For example, “initial access brokers” emerged on dark web marketplaces and forums offering already-established access to victim networks for a fee, meaning ransomware operators didn’t have to actively search out and compromise a victim on their own.54
54. Charlie Osbourne, “Ransomware Operators Love Them: Key Trends in the Initial Access Broker Space,” ZDNet, August 2, 2021, www.zdnet.com/article/ransomware-operators-love-them-key-trends-in-the-initial-access-broker-space/.
Ransomware operators focused on developing and deploying software to launch attacks, such as new and improved ransomware strains, victim portals (as described in the next section), decryptor tools, and more. Other adversaries used this software to facilitate their cyber extortion attacks, often in exchange for a percentage of the revenue.
Money laundering services like “mixing” or “tumblr” services became popular methods of obscuring blockchain transactions. These services operate by transferring cryptocurrencies between multiple anonymous wallets, splitting the payments into smaller transactions, and redistributing the funds. In April 2021, the administrator of Bitcoin Fog, which provided this exact service, was arrested after processing more than $360 million in Bitcoin over a decade of operations.55
55. Samuel Haig, “Alleged $366M Bitcoin Mixer Busted After Analysis of 10 Years of Blockchain Data,” Coin Telegraph, April 29, 2021, https://cointelegraph.com/news/alleged-366m-bitcoin-mixer-busted-after-analysis-of-10-years-of-blockchain-data.
A myriad of new criminal enterprise support services have emerged, such as the “Antianalysis” dark web service, which enables cyber extortionists to evaluate the risk that their cryptocurrency wallets may be flagged as suspicious by law enforcement agencies and investigators. Each lookup costs approximately $3, although the service offers bulk plans.56
56. Brian Krebs, “New Anti Anti-Money Laundering Services for Crooks,” Krebs on Security, August 13, 2018, https://krebsonsecurity.com/2021/08/new-anti-anti-money-laundering-services-for-crooks/.
Heads Up! The Insider Threat
Why hack into a victim’s network when you can convince an insider to install malware for you? Modern cyber extortion cartels actively court legitimate employees of high-value organizations, offering lucrative rewards to employees willing to assist with their attacks. In 2021, the Lockbit cartel posted the following advertisement on their blog:
Would you like to earn millions of dollars?
Our company acquires access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company. You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.57
57. Lawrence Abrams, “LockBit Ransomware Recruiting Insiders to Breach Corporate Networks,” Bleeping Computer, August 4, 2021, www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/.
In a ransomware attack, evidence of the point of entry is often destroyed—meaning the victim organization might never know that a trusted employee turned against it.
2.9.2 Paid Staff
As cyber extortion operations became increasingly sophisticated, adversaries began hiring employees and contractors to handle day-to-day tasks. Large cyber extortion groups regularly need IT support, system administrators, programmers, web developers, “penetration testers” (also known as “pen testers,” and a euphemism for hackers), administrative support staff, public relations teams, human resources, customer support teams, and more.
“We can see the discipline they have, we can see that they are active during office hours, they take the weekends off, they work regular hours, they take holidays,” said Caleb Barlow, head of IBM’s Threat Intelligence team, describing how cybercriminal groups mirror legitimate enterprises during a 2019 interview with CNBC.58
58. Kate Fazzini, “Cybercrime Organizations Work Just Like Any Other Business: Here’s What They Do Each Day,” CNBC, May 5, 2019, www.cnbc.com/2019/05/05/heres-what-cybercriminals-do-during-the-workday.html.
Even small cybercriminal shops now employ staff. In an interview conducted by the authors’ research team, one small cyber extortion group shared, “Yes we have employees … a full-time web developer and 2 pen testers.”59
59. Derek Rowe, interview with Kajit/Orange from Groove Ransomware (RAMP forum), LMG Security, September 2021.
Why would skilled technical workers work for cybercriminal enterprises? One threat actor who called themselves a “contractor” explained in an interview with Flashpoint:
On the one hand, you are afraid all the time. You wake up in fear, you go to bed in fear, you hide behind a mask and a hood in a store, you even hide from your wife or girlfriend. I’m younger than you, but I’ve already earned for the rest of my life. Not millions, but enough to live in peace and never work. Here is also a second factor: how to quit a job that brings such earnings in a country where you are not much sought after? 60
60. “Russian Hacker Q&A: An Interview with REvil-Affiliated Ransomware Contractor,” Flashpoint (blog), September 29, 2021, www.flashpoint-intel.com/blog/interview-with-revil-affiliated-ransomware-contractor/.
Not all cyber extortion staff are fully aware that they work for a criminal enterprise—or at least, they maintain plausible deniability. In October 2021, news broke that the Fin7 cybercriminal gang had created a front company that it leveraged for recruitment purposes. Fin7, which has historically been linked to payment card theft and fraud (such as the Saks Fifth Avenue and Lord & Taylor hacks revealed in 2018), has reportedly been moving into ransomware.61
61. Gemini Advisory, “FIN7 Recruits Talent for Push into Ransomware,” Recorded Future (blog), October 21, 2021, www.recordedfuture.com/fin7-recruits-talent-push-ransomware/.
Instead of exclusively searching for new team members on dark web forums, which can be infiltrated by law enforcement, Fin7 created a company named Bastion Secure Ltd. and began advertising for salaried “IT” positions on the clear web and mainstream job sites in Russia and Ukraine.62 The job descriptions sounded legitimate and included titles such as the following:
62. Robert McMillan, “Ransomware Gang Masquerades as Real Company to Recruit Tech Talent,” The Wall Street Journal, October 21, 2021, www.wsj.com/articles/ransomware-gang-masquerades-as-real-company-to-recruit-tech-talent-11634819400.
Windows network administrator
Python programmer
System administrator
C++ programmer
PHO programmer
Reverse engineer
Work hours were advertised as Monday to Friday, nine-hour days (lunch break provided).
According to the fraud intelligence firm Gemini Advisory, an investigator posed as a job applicant and went through Bastion Secure’s interview and hiring process. The first stage “proceeded similarly to a legitimate job hiring process and gave no indication that Bastion Secure was a fake company for a cybercriminal group.” After “hiring,” however, the recruit’s first assignment involved accessing a “client” organization’s network and gathering sensitive information, with several red flags indicating that the activity was a precursor to a ransomware attack.63
63. Gemini Advisory, “FIN7 Recruits Talent for Push unto Ransomware,” October 21, 2021, https://geminiadvisory.io/fin7-ransomware-bastion-secure.
2.9.3 Automated Extortion Portals
Successful cyber extortion cartels quickly found that they had large numbers of victims to manage. Manual processes that worked sufficiently at a small scale quickly became unmanageable at larger volumes. Enter the automated extortion portal. This website is created for each victim and provides services such as the following:
Basic information about the extortion attempt, such as the ransom demand and amount of time left to pay
Proof-of-life decryption service, which enables victims to upload small sample files and demonstrate that they can be decrypted
Standardized resources such as links to purchase cryptocurrency
Decryptor delivery service
Encrypted chat portal, which enables victims to communicate directly with the adversary (no need to track multiple email threads or accounts)
Typically, the victim portal is created by ransomware automatically during execution. GandCrab pioneered the technology during its run in 2018, but groups like REvil, Lockbit, and Darkside/Blackmatter really took it to another level during 2020.
Automated victim portals substantially reduced the amount of labor required for executing an extortion attack, and enabled criminals to stay organized while scaling up their volume.
2.9.4 Franchising
After GandCrab’s success with a distributed RaaS model, many other players in the cyber extortion market began to mimic its strategy for their own gains. Prior to GandCrab, ransomware operations were usually single groups with a focus on carrying out their own attacks. This “lone wolf” mentality came to an abrupt end when GandCrab “retired” and announced their $2 billion bounty—a figure high enough to inspire other would-be cyber extortionists to adopt the group’s franchise model.
The REvil cartel quickly emerged and picked up where GandCrab left off. It wasn’t long before additional groups like Maze, Conti, Darkside, Lockbit, and many others began adopting the franchise model, too. Terminology evolved: Victims were referred to as “clients,” and distributers were now referred to as “affiliates.”
2.9.4.1 Evolving Technology
Cyber extortionists adapted their technology to suit the needs of their new “affiliates,” or franchisees. The automated portals used by GandCrab to streamline its operations became common among cyber extortion groups as a means of lowering the barriers to entry and supporting higher volumes of victims.
RaaS operators routinely touted their platforms’ features in ads on the dark web. For example, the Lockbit cartel provided a full list of features in its affiliate marketing materials highlighting the benefits of its software. A few of the unique features included:64
64. Megan Roddie, “LockBit 2.0: Ransomware Attacks Surge After Successful Affiliate Recruitment,” Security Intelligence, September 9, 2021, https://securityintelligence.com/posts/lockbit-ransomware-attacks-surge-affiliate-recruitment/.
TOR-based administrative control panels
Anonymous chat rooms for victims, with push notifications alerting the operator when a new message arrived
Automatic exploit detection
Automatic log deletion
Automatic file exfiltration tools
The operators took their profits as a percentage of the revenue their affiliates generated. This gave them incentive to compete for skilled affiliates by investing time and capital into improving their technology products.
Case Study: The Kaseya Master Decryptor
The infamous Kaseya ransomware attacks illustrate how RaaS operators have adapted their technology to support franchise models. In July 2021, adversaries affiliated with the REvil ransomware cartel executed what was, at the time, the largest single ransomware deployment in cybersecurity history65 when they exploited multiple zero-day vulnerabilities in the Kaseya VSA remote monitoring and management system. Thousands of organizations were hit with ransomware in one fell swoop.
65. Associated Press, “Scale, Details of Massive Kaseya Ransomware Attack Emerge,” NPR, July 5, 2021, www.npr.org/2021/07/05/1013117515/scale-details-of-massive-kaseya-ransomware-attack-emerge.
Shortly thereafter, REvil’s infrastructure mysteriously went dark, on July 13, 2021.66 Its dark web site, command-and-control servers, social media presence, and more all went down. The situation became even more mysterious on July 21, when Kaseya released a decryptor capable of unlocking all systems encrypted in the attack.67 Kaseya did not disclose exactly how it acquired the decryptor—only that it was delivered by a “trusted third party.”68 Later, it was revealed that the Federal Bureau of Investigation (FBI) had infiltrated REvil’s servers and recovered the decryption key, but waited nearly three weeks to release the key to Kaseya—a decision that launched an outcry from victims later.69
66. Lisa Vaas, “Ransomware Giant REvil’s Sites Disappear,” Threat Post, July 13, 2021, https://threatpost.com/ransomware-revil-sites-disappears/167745/.
67. “Important Notice August 4th, 2021,” Kaseya, August 4, 2021, https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-August-4th-2021.
68. Lawrence Abrams, “Kaseya Obtains Universal Decryptor for REvil Ransomware Victims,” Bleeping Computer, July 22, 2021, www.bleepingcomputer.com/news/security/kaseya-obtains-universal-decryptor-for-revil-ransomware-victims/.
69. Ellen Nakashima and Rachel Lerman, “FBI Held Back Ransomware Decryption Key from Businesses to Run Operation Targeting Hackers,” The Washington Post, September 21, 2021, www.washingtonpost.com/national-security/ransomware-fbi-revil-decryption-key/2021/09/21/4a9417d0-f15f-11eb-a452-4da5fe48582d_story.html.
Unfortunately, the REvil cartel did not stay gone for long. Its dark web sites quietly came back online on September 7, 2021, and the group resumed operations, actively encrypting victims’ systems all over the world.
New hope emerged for victims on September 16, 2021, when the antivirus company Bitdefender released a universal decryptor.70 Just like Kaseya, Bitdefender disclosed only that the decryptor was provided by a “trusted source.”71 The decryptor was reportedly effective on all REvil victims attacked prior to the group’s sudden disappearance on July 13.
70. Lawrence Abrams, “Free REvil Ransomware Master Decrypter Released for Past Victims,” Bleeping Computer, September 16, 2021, www.bleepingcomputer.com/news/security/free-revil-ransomware-master-decrypter-released-for-past-victims/.
71. Martin Zugec, “Bitdefender Threat Debrief,” Bitdefender, August 25, 2021, https://businessinsights.bitdefender.com/bitdefender-threat-debrief-august-2021.
The existence of both the Kaseya master decryptor and a universal decryptor is telling, in and of itself. According to a REvil representative, the cartel’s systems were capable of generating individual ransomware decryption keys for each individual victim computer (between 20 and 500 decryption keys for each Kaseya victim), or a single master decryptor key for all devices encrypted in the attack.72 The fact that the REvil cartel operators were capable of universally unlocking all victim systems illustrates the extent to which they maintained centralized control and oversight, even while giving affiliates the power to use their software and turn a profit.
72. Lisa Vaas, “REvil’s Back; Coder Fat-Fingered Away Its Decryptor Key?,” Threat Post, September 13, 2021, https://threatpost.com/revil-back-coder-decryptor-key/169403/.
Not only do modern ransomware cartels leverage asymmetric encryption effectively, but they also use it to facilitate their sophisticated franchise-style business models, providing redundancy and supporting centralized oversight.
2.9.4.2 Affiliate Recruitment Methods
The pioneering GandCrab group recruited affiliates mainly through underground forums and tightly controlled messaging.73 By keeping their recruitment efforts confined to these exclusive audiences, the GandCrab group was at a much lower risk of accidentally interacting with law enforcement or unwanted media contacts. Their recruitment specified that they would not work with native English speakers, they would not attack Commonwealth of Independent States (CIS) countries, and applicants had to navigate an extensive interview process to join the organization.
73. Brian Krebs, “Who’s Behind the GandCrab Ransomware?,” Krebs on Security, July 8, 2019, https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/.
REvil, which is considered to be the successor to GandCrab, largely followed the same recruitment playbook, although the group took the extra step of depositing large amounts of Bitcoin in the forums they were advertising with as a sign that they could be trusted by potential affiliates.74
74. Lawrence Abrams, “REvil Ransomware Deposits $1 Million in Hacker Recruitment Drive,” Bleeping Computer, September 28, 2020, www.bleepingcomputer.com/news/security/revil-ransomware-deposits-1-million-in-hacker-recruitment-drive/.
Despite the success of this strategy, the need for more affiliates led to increasingly public methods of attracting the attention of potential candidates. Lockbit 2.0, for example, published its affiliate program directly on its dark web extortion portal for all to see, even announcing proudly at the top of the page that “Lockbit 2.0 is an affiliate program.” Key benefits of using the Lockbit platform were advertised prominently on the post, including encryption speed comparisons, key ransomware features, and the availability of a custom “StealBit” data theft utility designed to exfiltrate files and upload them directly to the Lockbit blog.75
75. “Ransomware Profile: LockBit,” Emsisoft, July 21, 2021, https://blog.emsisoft.com/en/38915/ransomware-profile-lockbit/.
2.9.4.3 Protections for Affiliates
Work as an affiliate is risky. To protect “affiliates,” many RaaS operations choose to deposit large amounts of cryptocurrency into third-party controlled accounts, ensuring that the affiliates will still get paid for their work even if something goes wrong with the primary operation. This level of security is designed to provide a sense of confidence in the ransomware group and boost its reputation among potential new affiliates.
In May 2021, this “shadow” court system ended up on full display when the Darkside ransomware group went dark without paying its affiliates.76 At that point in time, a sum of roughly 22 Bitcoin (roughly $1 million at the time) that had been deposited by the Darkside group was under the control of moderators for the infamous XSS.is hacker forum. Affiliates began to submit claims that they had not been paid for their work.
76. Becky Bracken, “DarkSide Getting Taken to ‘Hackers’ Court’ for Not Paying Affiliates,” Threat Post, May 21, 2021, https://threatpost.com/darkside-hackers-court-paying-affiliates/166393/.
What made this a truly unique event was the revelation that a “hacker court” existed on these underground forums for the purpose of resolving disputes exactly like this one. Affiliates would submit their claims of work, and an adjudicator from the forums moderator group would review the “evidence” and either award or deny the claim. In some cases, moderators even went as far as using the term “defendant” to describe the defunct Darkside group in their rulings.77
77. Dan Goodin, “Hear Ye, DarkSide! This Honorable Ransomware Court Is Now in Session,” ARS Technica, May 22, 2021, https://arstechnica.com/gadgets/2021/05/darkside-ransomware-makers-accused-of-skipping-town-without-paying-affiliates/.
An underappreciated part of the story, which seemed to be pushed aside by the “hacker court” proceedings, was the revelation that underground forums like XSS.is had quietly created a full infrastructure that RaaS groups could leverage to market, recruit, and secure operations for their ransomware activities.78
78. Kevin Lee and Austin Merritt, “Underground Markets: A Tour of the Dark Economy,” Threat Post (webinar), https://threatpost.com/webinars/underground-markets-a-tour-of-the-dark-economy/.
2.9.4.4 A Reputation to Uphold
In this franchising model, RaaS operators were at risk if an affiliate “went rogue”— attracting too much attention from law enforcement or simply giving out too much information to the press. The franchise model used by many large cyber extortion groups provided major benefits in regard to the overall scope of attacks, but also took a lot of the control over who was being attacked and how those attacks were being carried out away from the developers.
It was inevitable that this type of freedom would eventually result in a ransomware affiliate going too far with an attack, drawing the eyes of mainstream media, international law enforcement, and even other ransomware groups concerned about one affiliate destroying their collective ability to continue operating. A prime example of this exact type of overreach is the attack on Colonial Pipeline carried out by an affiliate of the Darkside group in May 2021.79
79. Anthony M. Freed, “Inside the DarkSide Ransomware Attack on Colonial Pipeline,” Cybereason: Malicious Life, May 10, 2021, www.cybereason.com/blog/inside-the-darkside-ransomware-attack-on-colonial-pipeline.
Taking down a retail business or law firm is bad, but disrupting fuel supplies to the entire eastern seaboard of the United States is absolutely worse, and Darkside felt the heat pretty quickly. The unwanted attention to this organization for what some in the media called an “act of war”80 prompted a quick response from Darkside:
80. Fox Business Staff, “Varney: Colonial Pipeline Attack Could Be “Act of War,” Fox Business, May 10, 2021, www.foxbusiness.com/politics/varney-colonial-pipeline-attack-shutdown-economy.
We are apolitical, we do not participate in geopolitics, do not need to tie us with a defined government and look for other motives.. Our goal is to make money, not create problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.81
81. From screenshot of Darkside site, taken by Derek Rowe, LMG Security, 2021.
Even other ransomware groups spoke out against the attacks and their severity, leading many groups to publicly announce that they would no longer attack critical infrastructure, oil pipelines, hospitals, or other high-profile targets that could put a bull’s eye on their backs.82
82. Tonya Riley, “The Cybersecurity 202: Ransomware Groups Are Going Underground, Which Could Make Them Harder to Track,” The Washington Post, May 17, 2021, www.washingtonpost.com/politics/2021/05/17/cybersecurity-202-ransomware-groups-are-going-underground-which-could-make-them-harder-track/.
2.9.5 Public Relations Programs
Public shaming is a key weapon wielded by cyber extortionists. To effectively threaten the confidentiality of information, extortionists needed a way to dump it into public view. They also leveraged the potential embarrassment and shame associated with being hacked to further pressure their victims.
Today, extortion gangs often explicitly use regulations and laws as leverage, promising to keep quiet if the victims pay so that the victim can avoid triggering notification laws, regulatory investigations, and fines. For example, in 2019 the REvil ransomware gang hacked into the CyrusOne managed service provider, and subsequently attacked customer environments. After stealing the data, the gang laid out their rationale for payment in a public Russian forum:
In case of refusal of payment—the data will either be sold to competitors or laid out in open sources. GDPR. Do not want to pay us—pay ×10 times more to the government. No problems.83
83. Lawrence Abrams, “Another Ransomware Will Now Publish Victims’ Data If Not Paid,” Bleeping Computer, December 12, 2019, www.bleepingcomputer.com/news/security/another-ransomware-will-now-publish-victims-data-if-not-paid/.
As detailed in the book Data Breaches, data exposure perpetrators learned to weaponize data by leveraging social media, posting data on dedicated data leak websites, and cultivating relationships with mainstream media.84 Modern adversaries also have the option of leveraging third-party exposure extortion services, which handle all of the challenging public relations and extortion details for them.
84. Sherri Davidoff, Data Breaches: Crisis and Opportunity (Addison-Wesley Professional, 2019), pp. 307–310.
2.9.5.1 Social Media
Social media are often used by both adversaries and victims in their efforts to advance their public narrative. As an example, the City of Baltimore was the victim of a ransomware attack in 2019 when the “RobbinHood” ransomware group encrypted the city’s servers and effectively took the city offline.85 When ransom negotiations broke down, the individuals behind the attack moved to social media—Twitter specifically—to announce to the world that Baltimore had been hacked and was suffering because of it.86 The attackers took steps to ensure the conversation was noticed by tagging major news organizations and other media outlets in their post. The spat between Baltimore’s mayor and the attackers quickly became a national story.
85. Emily Sullivan, “Ransomware Cyberattacks Knock Baltimore's City Services Offline,” NPR, May 21, 2019, www.npr.org/2019/05/21/725118702/ransomware-cyberattacks-on-baltimore-put-city-services-offline.
86. “Baltimore Hackers Leak Data on Twitter After No Ransom Was Paid,” CISO Magazine, June 7, 2019, https://cisomag.com/baltimore-hackers-leak-data-on-twitter-after-no-ransom-was-paid/.
Twitter was also used as a point of communication by the victim, too. Baltimore’s mayor, Jack Young, used the platform to provide updates and distribute information about the attack as progress was made. Twitter also played a role when a New York Times article claimed that the infamous EternalBlue exploit, which was stolen from the National Security Agency (NSA) and leaked by The Shadow Brokers in 2017,87 was used in the attack.88 This was enough to prompt a rare public statement from U.S. government officials disputing the story.89
87. Lily Hay Newman, “The Leaked NSA Spy Tool That Hacked the World,” Wired, March 7, 2018, www.wired.com/story/eternalblue-leaked-nsa-spy-tool-hacked-world/.
88. Nicole Perlroth and Scott Shane, “In Baltimore and Beyond, a Stolen N.S.A. Tool Wreaks Havoc,” The New York Times, May 25, 2019, www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html.
89. Shannon Vavra, “Ruppersberger: NSA Has No Evidence EternalBlue Was in Baltimore Attack,” Cyberscoop, May 31, 2019, www.cyberscoop.com/dutch-ruppersberger-nsa-eternalblue-robbinhood-baltimore/.
Twitter and other social media platforms have since developed and enforced policies to reduce the power that threat actors can wield via social media. In 2018, Twitter introduced a policy that prohibited posting of hacked materials.90 The policy update caused a flurry of questions about how much control the platform would assert over the distribution of information on criminal activities. There was widespread concern over censorship and how legitimate media organizations might be impacted. Since then, Twitter and other social media platforms have continued to refine their policies, struggling to find a balance between protecting journalists and protecting privacy.
90. Catalin Cimpanu, “Twitter Bans Distribution of Hacked Materials Ahead of US Midterm Elections,” ZDNet, October 2, 2018, www.zdnet.com/article/twitter-bans-distribution-of-hacked-materials-ahead-of-us-midterm-elections/.
In the meantime, cyber extortionists adapted and found new avenues for developing relationships with the mainstream media.
2.9.5.2 Branded Data Leak Sites
Frequently banned from social media platforms, adversaries shifted to launching their own, branded web portals, which they used to “name and shame” victims. This tactic was popularized by the Maze group in late 2019 (as discussed in Section 2.8), and quickly copied by REvil, Conti, and other major ransomware players. Typically, these sites are hosted on the dark web, although in some cases (as with the Maze group) they are on the clear net.
The criminals’ public-facing websites evolved to include several common features:
Branded home page: In some cases, these included eye-catching illustrations, such as the Cuba group’s colorful portrait of Fidel Castro and the Karakut gang’s whimsical cartoon of monkeys smoking and having tea. Other groups were more simplistic, such as REvil’s “Happy Blog,” which simply featured a listing of the group’s latest victims.
Victim “name-and-shame” section: An area where victims are publicly listed and threatened.
Auctions: Criminals often auction victim data off to the highest bidder if the victim does not pay. Typically, there is a starting bid and a time limit. If the data is not purchased, the criminals release a link to the world.
News: Updates from the criminals (also referred to as “press releases”). This may include statements on major cases, such as the Darkside gang’s announcement in response to the Colonial Pipeline backlash.91
91. Viewed in screenshot of the Darkside site, taken by Derek Rowe, LMG Security, 2021.
“About” section: Information about the cyber extortionist gang (typically intended to be inspiring or flattering).
Contact method: A contact form or chat feature enabling visitors to reach out to the cyber extortion cartel.
The tactic was so effective that data leak sites proliferated. REvil, the top ransomware strain at the time, spun up the “Happy Blog” for publishing and even auctioning off stolen data.92 New ransomware strains emerged with their own blogs, such as the Cuba strain (“This site contains information about companies that did not want to cooperate with us. Part of the information is for sale, part is freely available.”).93 In early 2021, the NetWalker RaaS operators advertised that their software included “a fully automatic blog, into which the merged data of the victim goes, the data is published according to your settings.”94
92. “REvil Hackers Continue to Wrack up High-Profile Targets with Ransomware Attacks,” Dark Owl, updated June 2, 2020, www.darkowl.com/blog-content/revil-hackers-continue-to-wrack-up-high-profile-targets-with-ransomware-attacks.
93. LMG Security case, February 2021.
94. Nathan Coppinger, “Netwalker Ransomware Guide: Everything You Need to Know,” Varonis, November 17, 2020, www.varonis.com/blog/netwalker-ransomware/.
2.9.5.3 Press Programs
Attention from the mainstream media made cyber extortion cartels more powerful. The Maze group recognized the power of the press early on, encouraging their victims to Google past victims’ names so that they could see the nasty headlines for themselves. Since the early days of TDO, cyber extortion gangs have been giving interviews with the press, leveraging the mainstream media like a megaphone to increase pressure on their victims and spread their viewpoints.
Extortionists may reach out directly to known journalists. For example, in one case that the authors of this book handled, the Cuba ransomware gang stole data from a financial firm. The adversary deliberately emailed a reporter, sharing information about the ransom demand, the new current price (after the victim decided not to pay the ransom), and a full file list of all stolen items.95
95. LMG Security case, February 2021.
Today, journalists routinely follow data leak sites, dutifully posting articles when sensational leaks are announced.96 (The Maze gang, like other groups, published a “press release” when announcing their retirement, another indicator of their growing engagement with mainstream media.97)
96. Brian Krebs, “Ransomware Gangs Don’t Need PR Help,” Krebs on Security, July 1, 2020, https://krebsonsecurity.com/2020/07/ransomware-gangs-dont-need-pr-help/.
97. Pierluigi Paganini, “Maze Ransomware Gang Shuts down Operations, States Their Press Release,” Security Affairs, November 2, 2020, https://securityaffairs.co/wordpress/110318/cyber-crime/maze-ransomware-teminates-operations.html.
Once cyber extortion websites became popular, the cartels had a way to build a community and interact with the public. For example, the Darkside cartel had a “Press Center” where they encouraged journalists and recovery companies to register on their site, describing the following benefits:98
98. Website of the DarkSide ransomware criminal gang, available on the dark web via Tor (since removed). From a screenshot obtained by LMG Security, June 2021.
Why do I need to register?
You can ask questions and get information from the primary source.
Notifying you of data breaches before posting. The ability to receive non-public information.
Fast replies within 24 hours.
Recovery
Why do I need to register?
Automatic receiving of decryptors after payment.
Get an additional discount. The discount increases depending on the number of payments.
Communication with the support in a personal chat.
To register, journalists or recovery organization staff were required to provide an email address. If the email domain was a generic hosting provider such as gmail.com, they would be required to prove their affiliation before their registration was approved.
2.9.5.4 Third-Party Exposure Extortion Services
The abundance of data being exfiltrated created a market for third-party data exposure services like the infamous Marketo99 “leaked data marketplace,”100,101 which provided cyber extortion groups with an easy way to host, market, and distribute data that had been stolen from a victim’s network. The operators behind marketplaces like Marketo did not actively hack anyone or distribute any malicious software, but provided a service to advertise stolen data.
99. Note that the cybercriminal enterprise Marketo is in no way affiliated with the legitimate Adobe Marketo software suite.
100. Photon Research Team, “Marketo: A Return to Simple Extortion,” Digital Shadows (blog), July 8, 2021, www.digitalshadows.com/blog-and-research/marketo-a-return-to-simple-extortion/.
101. Lawrence Abrams, “Data Leak Marketplaces Aim to Take over the Extortion Economy,” Bleeping Computer, May 7, 2021, www.bleepingcomputer.com/news/security/data-leak-marketplaces-aim-to-take-over-the-extortion-economy/.
These services go far beyond common dark net e-commerce markets. Marketo actively engages with victims, competitors, and the larger community.102 In Marketo’s manifest, the group explains that stolen data is always first offered to the victim themselves.103 If the victim chooses not to pay, then Marketo threatens to notify “every company affiliate.” This includes competitors, who have received emails such as the following:
102. Dmitry Smilyanets, “‘Yes, We Are Breaking the Law:’ An Interview with the Operator of a Marketplace for Stolen Data,” The Record, September 17, 2021, https://therecord.media/yes-we-are-breaking-the-law-an-interview-with-the-operator-of-a-marketplace-for-stolen-data/.
103. Marketo.cloud, https://marketo.cloud/manifest.
Hello, we are Marketo and we know you have a competitor—[NAME REDACTED]. So we would like to inform you that we attacked them and downloaded quite a bit of data. We have confidential and personal data, info about their tax payments, clients and partners. That might be significantly lower than the NASDAQ price.104
104. Lawrence Abrams, “Data Leak Marketplace Pressures Victims by Emailing Competitors,” Bleeping Computer, June 21, 2021, www.bleepingcomputer.com/news/security/data-leak-marketplace-pressures-victims-by-emailing-competitors/.
Marketo also advertises a list of “partners” that receive a weekly report of victims, along with supporting documentation. These include regulatory agencies such as the Federal Deposit Insurance Corporation (FDIC), Consumer Financial Protection Bureau (CFPB), Office of the Comptroller of the Currency (OCC), the Financial Crimes Enforcement Network, and media entities such as Bleeping Computer and SC Media. It is not clear whether these entities are voluntarily receiving these reports, or whether they act upon them.105
105. Smilyanets, “‘Yes, We Are Breaking the Law’.”
By specializing in data leaks, centralized exposure extortion services such as Marketo can build strong relationships with the media, They can also invest in tools and templates, which can help their clients (the data thieves themselves) more effectively leverage their stolen goods.
2.9.6 Standardized Playbooks and Toolkits
Cyber extortion gangs didn’t just invest in technology—they also invested time and labor into developing standardized playbooks and tools for their employees and affiliates to use. This included the emergence of step-by-step instruction manuals, as well as distribution of hacking tools, exploits, and even common IT utilities useful for remote access and data exfiltration. These packages dramatically reduced the investment needed for affiliates to engage in cyber extortion and increased their chances of success.
As an example, in 2021, a disgruntled Conti affiliate leaked a full version of the playbook and tools that the Conti cartel used to execute their attack.106 At the time the playbook was leaked, the authors of this book were handling a Conti ransomware case and personally verified that the tactics, techniques, and procedures (TTPs) observed in the case matched those documented in the leaked playbook.
106. Caitlin Huey, David Liebenberg, Azim Khodjibaev, and Dmytro Korzhevin, “Translated: Talos’ Insights from the Recently Leaked Conti Ransomware Playbook,” Talos (blog), September 2, 2021, https://blog.talosintelligence.com/2021/09/Conti-leak-translation.html.
In addition to providing scripts for the affiliates to use, the playbook outlined many other procedural steps to a successful ransomware infection:107
107. Catalin Cimpanu, “Disgruntled Ransomware Affiliate Leaks the Conti Gang’s Technical Manuals,” The Record, August 5, 2021, https://therecord.media/disgruntled-ransomware-affiliate-leaks-the-conti-gangs-technical-manuals.
Attack playbook: A full written manual, as well as a collection of notes, files, and scripts useful for various components of the attack. The documentation includes step-by-step instructions for leveraging exploits, establishing persistence, expanding access, gaining access to data repositories, and exfiltrating data. It also includes links to third-party sites where the user can obtain the latest exploits and supplemental tools.
Common IT utilities: Helpful utilities such as the Atera remote access tool, netscan, rclone, routerscan, and more (along with instructions for their use). The tools are both useful for the adversary and commonly used in normal networks, meaning they are unlikely to trigger antivirus alerts by themselves. Adversaries using these tools can lurk inside of networks for weeks or even months without being detected, siphoning sensitive data the entire time.
Exfiltration guidance: Tips for users on how to search for high-value information, and what types of data to target. This includes practical guidance for finding data that may be useful for setting a ransom demand, expanding the compromise, or putting pressure on their victim. For example, in one section, the Conti playbook instructs:108
108. Leaked Conti playbook, September 2021, translated from Russian to English using Microsoft and author research. The list of search keywords was originally in English and was not translated.
need accounting reports. bank statements. for 20-21 years. all fresh. especially important, cyber insurance, security policy documents. Keywords for search: cyber policy insurance endorsement supplementary underwriting terms bank 2020 2021 Statement and anything that can be juicy.
Using this type of data, the ransomware operators would be able to maximize the ransom being demanded from the victim and increase the chances of extracting a payment. The manual subsequently instructs the user to immediately upload any valuable information to a third-party file sharing site.
The distribution of a standardized playbook enabled the Conti cartel to ensure consistent adoption of successful tools and techniques. In turn, it helped affiliates achieve their own goals:
Quickly leverage new vulnerabilities and exploits, since all the information they needed was distributed in the package
Evade detection, by using normal IT tools and evasion tactics detailed in the playbook
Expand farther, faster, and more effectively across victim networks
Exfiltrate high-value data that would be useful for negotiations and gaining leverage over victims
Ultimately, by developing and distributing centralized playbooks and toolkits, cartels can leverage economies of scale and generate higher margins, leading to greater profits.
2.10 Conclusion
The cyber extortion business has undergone its own “Industrial Revolution.” What started as a primarily manual attack gained efficiency and scale through automation, turning cyber extortion into the bustling criminal enterprise that it is today.
Tools like the dark web and cryptocurrency were fundamental to the growth of cyber extortion, facilitating anonymous communication and fast payments. Criminal cartels evolved into franchise models, in which centralized operators provided tools, templates, and support staff, lowering the barriers to entry for cyber extortion. Meanwhile, threat actors with specialized skill sets, such as malware development or public relations expertise, found that they could specialize and become RaaS programmers, operators, initial access brokers, data leak specialists, and more.
In the next chapter, we will step through the anatomy of a cyber extortion attack, dissecting the attack at each phase. Along the way, we will point out opportunities for detection, which can help facilitate an effective response.
2.11 Your Turn!
Every cyber extortion incident is unique. The response team’s options and priorities will vary depending on the victim organization’s industry, size, and location, as well as the details of the incident itself.
Based on what you learned in this chapter, let’s dissect the technology and business model underlying a cyber extortion attack.
Step 1: Build Your Victim
Choose one characteristic from each of the three columns to describe your victim’s organization:
Industry | Size | Location |
|---|---|---|
Hospital | Large | Global |
Financial institution | Midsized | United States |
Manufacturer | Small | European Union |
Law firm |
| Australia |
University |
| India |
Cloud service provider |
| Country/location of your choice |
Organization of your choice |
|
|
Step 2: Choose Your Incident Scenario
Select from one of the following incident scenarios:
A | Ransomware strikes! All of the victim’s files have been locked up, including central data repositories, servers, and workstations. |
B | A well-known cyber extortion gang claims to have stolen all of the victim’s most sensitive data and threatens to release it unless the victim pays a very large ransom demand. The gang posts the victim’s name on their dark web leaks site, along with samples of supposedly stolen data. |
C | Double extortion! Both A and B occur at the same time. |
D | The victim is hit with a denial-of-service attack on its Internet-facing infrastructure that slows its access and services to a crawl. The adversary threatens to continue and even escalate the attack unless a ransom is paid. |
Step 3: Discussion Time
Your victim is experiencing a cyber extortion incident. Given what you know about the victim and the scenario, answer the following questions:
The adversary left ransom notes behind on the infected systems directing the victim to visit a specific dark web site. What might your victim expect to see if they decide to visit the site?
What is the difference between an operator and an affiliate?
A journalist calls the victim organization, asking about the attack it is experiencing, but to the best of the victim’s knowledge no information has been shared beyond the Incident Response team. What are some possible ways the journalist may have obtained the information?
Explain why modern ransomware typically leverages both asymmetric and symmetric key cryptography. What are the benefits of each?
Name two ways that the adversary might create pressure for the victim to pay a ransom demand.