The recent Kaseya ransomware incident combined the worst possibilities the infosec community has had to contend with in recent months:
This is by no means an isolated incident. All vulnerabilities reported on widely used software products, especially those that do not require authentication to exploit, will likely become a target to spread ransomware.
Attacking the supply chain is simply a cost-effective way to scale ransomware operations.
In this blog post, we’ll use the Kaseya incident as a blueprint to recommend a short playbook for what you can do while you await a patch for any software vulnerability you know nothing about.
View our recent webinar for more information on the best defenses against Kaseya supply-chain and similar attacks.
Zero days are a tough nut to crack. The average organization uses hundreds of different types of software and tools. It’s almost impossible to have an accurate software inventory, let alone account for issues like supply-chain attacks and zero days.
While the research community plugs away trying to proactively find and hunt bugs to remediate costly zero days in widely used software before adversaries do, Active Defense allows security teams to take a step back and evaluate the problem of zero days as a whole.
Active Defense shifts the focus of security teams away from individual software and esoteric, difficult-to-parse exploitation techniques to proactive defensive strategies while they wait for a patch to be installed.
By hypothesizing the objectives that adversaries achieve when exploiting Zero Days, we can plan our Active Defenses in a manner that can:
The following table demonstrates where zero days are likely to be used in the kill-chain:
Possible Zero-Day Targets
Initial Infection and foothold
Internet-facing software applications and services
Obtain access to a high-value environment
Operating system components and locally installed software
Obtain a higher level of privilege to aid the rest of the kill-chain
Distribution software and internally exposed services
Expand attack footprint in locked-down environments
Action on objectives
Zero days against specialized software
Exploit weaknesses to steal data
Zero days are a means to the end goal. Whether in the initial stages of the operation or the critical last step.
From a defensive perspective, this gives us a valuable advantage: If we cannot stop the zero day itself, we have opportunities to trap the adversary either before or after they use it. And you can do just that with Active Defense.
The scenario here is that you know about a zero-day target that does not yet have a patch. Let us also assume that the zero day is being used for initial infection and foothold to distribute ransomware within the environment.
The following table shows strategies for actively defending against techniques observed in the Kaseya REvil Ransomware incident.
Active Defense Tactic
Hints, Tips, Tricks
Exploit an internet-facing application
Create public-facing decoys to capture intelligence
Use the application vulnerable to the zero day as a template for the decoy
Use of PowerShell
Monitor for commands and scripts that involve stopping or disabling services
Kill processes and services
Deploy decoy processes and services commonly killed by ransomware
The most commonly attacked processes are those that lock files that are a target for encryption; therefore, “outlook.exe”, MS Office processes, and database processes are usually targeted
Delete volume shadow copies
Monitor for the deletion of volume shadow
Typically, volume shadow copies are deleted using vssadmin.exe or WMI
Deploy decoy files on endpoints to monitor for file modification events
Placing files in common encryption start locations (such as C:\ or %appdata% or Document folders) is a smart way to minimize the impact of encryption
In the case of Kaseya, specifically, there was no worm-like behavior observed as the encryptor was pushed to machines via an update.
One of the classic strategies these days, as seen in the Kaseya incident, is to compromise software and update distribution points to deploy ransomware at scale.
It is not a stretch to say that any software that installs updatable services on endpoints can be a target of similar attacks and the table in the previous section is the best form of defense for that.
We wish to draw attention to two pervasively present distribution points for ransomware in most organizations:
With recent disclosures around serious vulnerabilities—the Print Nightmare Vulnerability, for example—organizations are at risk of both Active Directory and SCCM as targets for any ransomware that leverages such a vulnerability to spread.
Here are four suggestions to actively defend against techniques in such a scenario.
Active Defense Tactic
Internal recon (Active Directory)
Query Active Directory for privileged users with rights to create a group policy
Plant decoy users in privileged groups and OUs
Query Active Directory for SCCM servers
Plant decoy systems with attributes consistent with SCCM servers
Lateral movement via zero days like Print Nightmare
Use the Print Nightmare vulnerability to obtain RCE on Active Directory and SCCM
Creation of new group policy or SCCM policy to distribute encryptor
Monitor and log the creation of new policies
Organizations should expect that any major vulnerability disclosed is likely to become a target for spreading ransomware.
Due to the unpredictability of TTPs that may be used in individual incidents, we advise organizations to adopt a wider array of Active Defense techniques to build resilience against a variety of ransomware operator strategies.
We also encourage organizations to adopt Active Defense and deception strategies in the following parts of their IT environment:
Learn more about Kaseya Supply-Chain ransomware attack by viewing our webinar hosted by ThreatlabZ.