IR Trends: Ransomware on the rise, while technology becomes most targeted sector

Business email compromise (BEC) and ransomware were the top threats observed by Cisco Talos Incident Response (Talos IR) in the second quarter of 2024, together accounting for 60 percent of engagements.  

Although there was a decrease in BEC engagements from last quarter, it was still a major threat for the second quarter in a row. There was a slight increase in ransomware where Talos IR responded to Mallox and Underground Team ransomware for the first time this quarter, as well as the previously seen Black Basta and BlackSuit ransomware operations.  

For the third quarter in a row, the most observed means of gaining initial access was the use of compromised credentials on valid accounts, which accounted for 60 percent of engagements this quarter, a 25 percent increase from the previous quarter.  

Technology was the most targeted vertical this quarter, accounting for 24 percent of engagements, closely followed by healthcare, pharmaceuticals and retail. There was a 30 percent increase in engagements affecting the technology sector from the previous quarter. Organizations in the technology sector may be seen as gateways into other industries and organizations given their significant role in supplying and servicing a wide range of sectors, making them attractive targets for adversaries.  

Technology organizations often have extensive digital assets supporting critical infrastructure, which means they have minimal tolerance for downtime and may, therefore, be more likely to pay extortion demands. 

Talos IR also observed a slight increase in network device targeting this quarter, accounting for 24 percent of engagements. This activity included password-spraying, vulnerability scanning and exploitation.  

Watch discussion on the report's biggest trends

Surge in BEC continues  

Within BEC attacks, adversaries will compromise legitimate business email accounts and use them to send phishing emails to obtain sensitive information, such as account credentials. Adversaries can also use compromised accounts to send emails with fraudulent financial requests, such as changing bank account information related to payroll or vendor invoices. 

In a few of the observed BEC incidents that involved a method of phishing as an infection vector, adversaries leveraged SMS phishing, or “smishing,” to compromise accounts. This involves adversaries sending fraudulent text messages to trick recipients into sharing personal information or clicking on malicious links.  

Targeting employees’ personal mobile devices can be an effective method for initial access because they may not have the same security controls as their corporate devices. Organizations should ensure SMS phishing scams are included in security awareness training for employees.   

In one engagement, adversaries compromised a user’s account by sending a phishing email to the employee’s personal email address that redirected the user to a fake login page. The user had passwordless authentication through an authenticator application but received a multi-factor authentication (MFA) push notification and accepted it, granting the adversary access.  

In another cluster of activity, adversaries used compromised credentials obtained through unknown means to access a valid email account. The adversary then created Microsoft Outlook mailbox rules to send emails to a folder named “deleted” before using the compromised account to send out over a thousand phishing emails to internal and external recipients. The phishing emails contained a link that led to a fake login page intended to harvest credentials. 

Ransomware trends 

Ransomware accounted for 30 percent of engagements this quarter, a 22 percent increase from the previous quarter. Talos IR observed Mallox and Underground Team ransomware families for the first time this quarter. Talos IR also responded to the previously seen Black Basta and BlackSuit ransomware this quarter, which we recently assessed are two of the top players within the current ransomware landscape. 

Notably, 80 percent of ransomware engagements this quarter lacked proper MFA implementation on critical systems, such as virtual private networks (VPNs), playing a role in allowing adversaries to gain initial access. In addition, command obfuscation, such as Base64 encoding, was observed within 40 percent of ransomware engagements this quarter, likely to evade detection by disguising the true intent of the commands. 

Mallox 

In a Mallox ransomware engagement, adversaries compromised and encrypted a single Microsoft SQL server, consistent with public reporting on Mallox ransomware attacks. There were no signs of data staging, exfiltration or lateral movement. Talos IR could not determine the initial access vector due to a lack of customer telemetry.   

First discovered in 2021, Mallox (also known as TargetCompany and Fargo) is a ransomware-as-a-service (RaaS) operation that leverages double extortion techniques. Mallox has Linux and Windows variants of the encryptor and appends the file extension “.malox” to files after encryption. The operation is known to use brute force techniques to target unsecured Microsoft SQL servers and has been observed using Cobalt Strike beacons during attacks, although Talos IR did not observe Cobalt Strike in this incident. Cobalt Strike is a legitimate penetration testing tool that is commonly leveraged by adversaries for malicious activity. 

Underground Team 

Talos IR responded to an Underground Team ransomware attack in an engagement where the adversary leveraged Secure Shell (SSH) to move laterally in the environment. The adversary also strategically reactivated certain Active Directory user accounts that had been previously disabled, potentially a newly observed technique for Underground Team ransomware operators, based on a lack of public reporting. 

Talos IR’s review of the available Active Directory logs indicated that the adversary reactivated over 100 previously disabled accounts, likely an attempt to escalate privileges. Talos IR reviewed a specific compromised account leveraged by the adversary to establish persistence and move laterally. Using this account, the adversary also deployed the ransomware payload and encrypted multiple critical systems, including domain controllers, virtual machines, backups and server management systems. 

During the engagement, the threat actor also sent harassing messages to employees' personal emails. This technique was likely intended to coerce the victim to respond to the actor’s demands.  

Underground Team is a relatively new ransomware group that emerged in 2023. While not as prominent as other established ransomware actors, they have garnered attention for their tactics, techniques and procedures (TTPs) and how the group claims to offer cybersecurity help within their extortion demands, a common social engineering technique.  

BlackSuit 

Talos IR responded to a BlackSuit ransomware attack where adversaries gained access with valid credentials through a VPN that was not protected by MFA. Persistence was established by deploying the remote management tool AnyDesk in the environment, as well as Cobalt Strike. There is no easy way to effectively block all unauthorized remote management tools, but security can be greatly improved through a combination of policy and technical controls. 

Talos IR also observed the adversaries deploying several utilities not previously observed being leveraged by BlackSuit. The group used Microsoft PowerToys for lateral movement, SuperGrate, a Windows User Profile backup and migration utility, and Mimikatz DCSync, an old technique commonly leveraged by other ransomware operations to compromise credentials. 

The adversaries also leveraged living-off-the-land binaries (LoLBins) like PsExec and the Windows Management Instrumentation command-line (WMIC) to move laterally across the network. Several legitimate tools were installed to assist with staging and exfiltrating data, such as WinRAR and WinSCP, commonly used by ransomware operations. The files delivering the ransom notes could also not be easily analyzed due to sandbox evasion techniques, a technique not typically observed within BlackSuit attacks.  

BlackSuit is a RaaS group that has been active since at least May 2023, gaining notoriety after the group’s threat to entities in the healthcare sector in November 2023. BlackSuit’s ransomware encryptors, supporting Linux and Windows variants, have been observed to have many similarities with the Royal ransomware group, leading researchers to believe BlackSuit is a rebrand of Royal ransomware operations. Talos and other researchers have compared the Royal and BlackSuit encryptors and confirmed the code was extremely similar.  

Black Basta 

Talos IR responded to a Black Basta engagement this quarter where adversaries gained initial access using compromised credentials on a valid RDP account that was not protected with MFA. Once inside the network, adversaries began acquiring credentials from the Windows Credential Manager through the New Technology LAN Manager (NTLM). Talos IR observed the adversaries using remote PowerShell execution, which is a common technique that uses WinRM to start a shell on remote systems.  

The adversaries leveraged the open-source command line tool Rclone to facilitate data exfiltration, a technique commonly used by ransomware actors. The Rclone configuration file was deleted before the adversary finished their attack. Sometimes, adversaries will forget to delete the configuration file, providing defenders with access tokens for the adversary-controlled server where the data was exfiltrated.  

This can allow defenders to download the stolen files and then delete them from the servers. Remote services, including RDP and SMB, were leveraged for lateral movement. Before the execution of ransomware, the adversaries disabled several tools, such as Windows Defender, to ensure the encryption process would not be interrupted.   

First discovered in April 2022, Black Basta is a RaaS operation that is a likely rebrand of the former Conti ransomware group that was shut down in Spring 2022. Black Basta ransomware is written in C++ and targets Windows and Linux systems. Black Basta affiliates have been observed using a wide range of initial access techniques, such as phishing, drive-by compromise, password spraying and exploiting known vulnerabilities. The targeting appears to be opportunistic and/or indiscriminate in nature. 

Network device targeting 

Talos IR observed a slight increase in network device targeting this quarter, accounting for 24 percent of engagements. This activity included password spraying, vulnerability scanning and exploitation. Network devices should be regularly patched and actively monitored because they provide a critical path for data entering and leaving the network. If compromised, an adversary could immediately pivot into an organization, divert or change network traffic, and monitor network communications.  

In one engagement, adversaries exploited a denial-of-service (DoS) vulnerability, tracked as CVE-2018-0296, affecting a Cisco Adaptive Security Appliance (ASA). The vulnerability in the web interface could allow an unauthenticated, remote attacker to cause a targeted device to reload unexpectedly, resulting in denial–of service.  

Adversaries also exploited a separate vulnerability within the Cisco ASA, tracked as CVE-2020-3259, that allowed them to remotely retrieve memory contents on the ASA, resulting in the unauthorized disclosure of sensitive information. Both the hardware and software used by the organization were past end-of-life (EOL) support. Talos IR recommends using supported hardware and software to prevent unwanted downtime and cyberattacks. 

In another cluster of activity, adversaries carried out a series of password-spraying attacks against the clientless VPN functionality of the organization’s ASA firewalls. The clientless functionality allows users to have a secure, remote access VPN tunnel to an ASA using a web browser without requiring a software or hardware client.  

The attack was ultimately unsuccessful because the organization enforced certificate-based authentication, which uses digital certificates stored in the user’s browser. If a user attempted to authenticate without a certificate, they would not be granted access. 

Initial vectors 

When known, the most observed means of gaining initial access was the use of compromised credentials on valid accounts, which accounted for 60 percent of engagements There was a 25 percent increase from the previous quarter where valid accounts were also a top attack vector. 

In one engagement this quarter, adversaries compromised an organization’s trusted partner and abused the one-way trust network relationship to gain access. Organizations regularly set up one-way trust network relationships with partners or customers to facilitate controlled access to resources or services, which allows organizations to grant specific permissions or access controls to external entities without reciprocating access.  

Although it is intended to enhance security by limiting the potential exposure of critical assets, adversaries commonly abuse this relationship to gain access. As more organizations seek to expand their networks to include more partners and external services, adversaries will likely continue to exploit vulnerabilities within these relationships. Strengthening security controls and continuously monitoring access points will be crucial to mitigating these threats and safeguarding against potential breaches.    

Security weaknesses 

Vulnerable or misconfigured systems and a lack of proper MFA implementation were tied for the top observed security weaknesses this quarter, accounting for nearly all of the engagements. Talos IR observed a 46 percent increase in each of these security weaknesses from the previous quarter. 

Systems that are not up to date with the latest patches are potentially susceptible to vulnerabilities. Misconfigured systems are not configured with industry best practices for security in mind leaving the organization exposed, such as a public-facing server that is only supposed to be accessed internally. 

In one cluster of activity, a network switch was compromised that was past the device’s EOL support. Using a network switch that is past its EOL support is risky because it no longer receives security updates, bug fixes, or technical support from the manufacturer. Relying on outdated hardware increases the likelihood of unexpected failures and cyberattacks, which can disrupt business operations and result in costly downtime.  

In another engagement, the adversaries dumped credentials from the Security Account Manager (SAM) database through the Windows Registry, which enabled the adversary to move laterally throughout the environment because MFA was not properly implemented. There was not enough visibility in the engagement to identify the initial access vector, but organizations must understand MFA can prevent both initial access and lateral movement should an adversary compromise an account or system. 

Talos IR recommends implementing MFA on all critical services including all remote access and identity access management (IAM) services. MFA will be the most effective method for the prevention of remote-based compromises. MFA can also help prevent lateral movement by requiring all administrative users to provide a second form of authentication. Organizations can set up alerting for single-factor authentication to quickly identify potential gaps.  

This quarter, Talos IR continued to observe users accepting MFA push notifications within engagements, but there was a notable decrease from the large surge in activity seen last quarter. In one cluster of BEC activity, several employees received phishing emails from a trusted partner’s email that had been compromised by the adversary.  

The emails contained links to fake login pages meant to harvest credentials. At least one employee provided credentials, which resulted in an MFA push notification being sent to the employee’s phone which they accepted granting the adversary access. Talos IR recommends organizations educate their employees about the specific channels and points of contact for reporting these incidents. Additionally, the employee’s account did not have alerting in place to prevent impossible travel scenarios. Impossible travel refers to the scenario in which a user authenticates from two locations within an unrealistically brief period to have traveled between the locations.  

Talos IR recommends reviewing the configurations on identity access management (IAM) platforms for identifying risky login attempts, such as impossible travel to prevent unauthorized access. In addition, organizations should set up monitoring for device registrations and the generation of bypass codes. 

Top observed MITRE ATT&CK techniques 

The table below represents the MITRE ATT&CK techniques observed in this quarter’s IR engagements and includes relevant examples. Given that some techniques can fall under multiple tactics, we grouped them under the most relevant tactic based on the way they were leveraged. Please note, this is not an exhaustive list.  

Key findings from the MITRE ATT&CK framework include: 

• PowerShell was the top execution technique observed this quarter, accounting for 41 percent of engagements this quarter, a 33 percent increase from the previous quarter. 
• Adversaries created new accounts more than any other persistence technique this quarter, accounting for 18 percent of engagements, more than double what was observed the previous quarter.  
• The abuse of remote services, such as RDP, SSH, SMB and WinRM, were observed within 53 percent of engagements this quarter, a slight decrease from the previous quarter. 
• The abuse of the LoLBin rundll32 was one of the top defense evasion techniques, accounting for 18 percent of engagements this quarter.  
• Talos IR observed a 40 percent increase in remote access software usage this quarter, with AnyDesk being the most observed software, accounting for almost 30 percent of engagements.