Ryuk is coming

Detecting the ransomware

The most obvious sign that you have been affected by ransomware can be seen in a sudden inability to read any of your files. You may notice files that previously held the extension .docx, for example, suddenly change to .RYK. Another sign will be the helpful ‘RyukReadMe.txt’, which politely informs you that all your files are belong to them, along with the non-negotiable price to have them returned and a BTC wallet address. The worst thing about the file is it will often be littered with spelling and grammar issues.

Flippancy aside, if you’re doing some stringent monitoring, you will be able to spot some initial activity that suggests Emotet (or other dropper) activity, which can be acted upon before any real damage is done. Network traffic, IoCs and certain rules might indicate the presence of a dropper.

Ryuk and Bulletproof

Bulletproof conducted a forensics investigation on behalf of a customer who had been hit by a ransomware attack. After analysing their log files, we put together a timeline that showed a clear string of interlinked events, a chain of causation if you will, that told us the story of how they had been compromised.

Our forensics timeline showed that a dropper landed on the customer’s environment a full two days before it was executed. The catalyst for this disaster seemed to be a curious user accessing the dropped file. Minutes later, the machine had been totally encrypted with military-grade encryption.

Ryuk and Managed SIEM

From the customer’s point of view, they’re now clear on where they went wrong. But this wasn’t enough for us. Our research division, Bulletproof SpecialOps®, is constantly looking for new ways to make sure our managed threat protection can safeguard against all attacks. They saw it as an opportunity to test managed SIEM (our 24/7 threat protection tool).

So, in the interest of science, we fired up a test environment that was configured to be almost identical to the customer’s original environment and re-created the attack timeline. This time, we had managed SIEM running. We slipped in the dropper via a phishing email, as per the original attack, and straight away saw alerts for a suspicious email. This told us that we could’ve stopped the attack dead in its tracks at stage one, before it had even got going. However, we ignored this and let things run their course in this test environment.

Next, we saw the dropper land, which also triggered alerts in our research team’s dashboards. Finally, we executed Ryuk, which promptly began eating through the filesystem. Again, this triggered more alerts. The conclusion? managed SIEM would have allowed us to isolate and block this ransomware infection at every stage of the kill chain.

Mapping defences against the cyber kill chain

If I had a pound for every time I mentioned the cyber kill chain, I’d have roughly £98.50 (I was once interrupted halfway through saying it). The cyber kill chain is important, and basically outlines the approach hackers take when compromising a business. It consists of seven stages: Reconnaissance, weaponisation, payload, exploitation, installation, command and control, and finally, action.

In the context of Ryuk, GRIM SPIDER would start by conducting some recon. They’d research their target, probe their environment for weaknesses, find out what they can about staff and suppliers (for phishing purposes) etc. Then they’d move onto weaponisation and put together their malware packages. The payload is where they drop the malware, whereas exploitation will be where they take advantage of some weakness found during reconnaissance. The rest is fairly self-explanatory.