Over the course of a year, Team Cymru worked with a Digital Forensics and Incident Response (DFIR) partner across more than 20 active ransomware investigations, taking indicators uncovered through host-level forensics and tracing them into global NetFlow and Internet telemetry. With that information they issued a reported entitled, “From the Disk to the Flows: Ransomware Infrastructure Analysis.”
The research followed infrastructure tied to Akira, DragonForce, Clop, Qilin, INC Ransom, Lynx, MedusaLocker and LockBit-related activity, revealing several patterns defenders can use to identify attacks earlier.
Before encrypting the systems of a victim, most ransomware gangs will steal the data beforehand to extort the victim into paying the ransom for not only the decryption keys but also to prevent the release of the stolen data publicly via their Tor data leak sites.
Techniques Used
Through forensic analysis, Team Cymru’s partner tracked and identified multiple techniques utilized by the ransomware gangs they encountered across various engagements.
Among the findings in the research show ransomware operators repeatedly rely on legitimate, dual-use tools such as Rclone, FileZilla and AnyDesk rather than custom malware for lateral movement or command and control.
Additionally, Akira showed the greatest variety in exfiltration techniques, but its methods overlapped with other ransomware groups, suggesting defenders hunting Akira-like behavior may catch a much broader set of threats.
Moreover, RDP, SSH, commercial VPNs, Tor, VPS infrastructure and legitimate cloud services repeatedly ended up used to gain access, move data and obscure attacker activity.
In 10 IPs used for data exfiltration across four ransomware gangs, Team Cymru had already classified every one as potentially concerning based on infrastructure characteristics.
The sheer number of hosting providers and autonomous systems involved shows why static IP and ASN blocking alone is increasingly ineffective against ransomware operations.
Click here for view “From the Disk to the Flows: Ransomware Infrastructure Analysis.”