all right okay ladies and gentlemen
welcome back from uh the morning coffee
break we'll move we'll move along now
with Mark Rivero Lopez so Mark I'll hand
over to you if there's time for
questions at the end we'll take a few
one or two if not Mark is here for the
rest of the day please feel free to
approach him at any time with any
questions or or points that you'd like
to make thank you Mark
thank you thank you very much
um welcome everybody thanks for joining
me uh first of all thank you very much
to activity to having me and also for
the
Alicia you had
um guys don't change your back before
you travel before because you can forget
that's me um an adapter so thank you
very much for the people that set up
everything
um so my name is Mark I'm working at
Kaspersky and the Global Research and
Analysis team also known as great and my
talk will be about how to apply or why
it's important to apply uh mitral attack
to analyze one of the major and like
funny topics nowadays that is Ram
somewhere because it affects everybody
so the idea is still go through the
presentation to see
an entire campaign analysis using Mitra
and then one cool report that we release
it for everybody Justin encouraged you
to read it because you will learn a lot
about how these sorry cyber criminal
groups are attacking everybody
so I don't know if you are a reader of
um the record uh is one of the my
sources to get like news in the about
news in the industry and there is an
interesting publication that they made
in February regarding how much uh money
um
um were paid to criminals in 2000 in
2021 and it's like a huge amount of
money to be honest and meaning that um
we always know about the payments that
were done meaning that when a big team
is affected and ransomware is acting as
ransomware as a service group the name
and the and the description and probably
the files in the beginning doesn't pay
it's uploading on those uh ransomware
block size and then everybody it's aware
about the attack that they suffered but
we are missing an important piece here
about all the attacks that companies are
suffering but all the contracts for
example are made through email or Java
or other platforms and are not published
everywhere so we are like missing part
of information uh but it's like some
statistics that are collected by some
peers in the industry regarding how much
money are get paid to those cyber
criminals so
um I wanted to ask a question to you to
all the audience um uh are there
ransomware attacks more complex than the
APT campaigns
um who thinks a ransomware attacks are
more complex than apt hands up
who thinks apt are more complex than
Samsung were attacks hands up that's
right guys so
where do we have the problem then I mean
if we are like uh or the industry is
like fighting with uh apt groups to in
order to not let them to attack us to
get our information to you to Big
fainted by them why why is that
ransomware like a topic that is all all
around the time around us and every
every week we are serving in our
Telemetry uh big teams uh that are
affected by by Ramson where and as well
as you of course if you are following
this topic and there is like uh like a
topic that we always uh describe in the
industry that is called
um the attack surface
um this is something more to be more
transparent it's something more like
what do we have publish it outside that
you are not protecting uh in a properly
Manner and and then someone find it and
exploit it and then you are infected you
have the passing zero lateral movement
actively compromised and then money for
the Transformer group in a short uh way
to explain it so we have to take care
about what is being published outside
there are many tools available you can
have your own vulnerabilities scanning
service to scan everything that you have
published outside you can use uh alerts
in Showdown on other let's say under
industry Tools in order to know uh what
you have published outside but the
listen if you enforce MFA if you
scan properly your infrastructure if you
reduce your attack surface you will be
less uh let's say let's say less
selected to be one of the big teams for
those cyber criminal groups because they
have an entire higher IPS space to
select one of the big things and they
will go for the ones that are more easy
for them
we have to separate from this let's say
equation of course zero days another
step that is like nobody could know
about it so uh then everybody
where it's possible to be like a victim
but for exploits like known exploits and
vulnerabilities or password spraying
attacks or liquid credentials on the
Underground forums we we have already
let's say Solutions in the market to to
to get right of those problems and make
the job for those guys more difficult
that's it that's the thing so how this
ecosystem of attacks works so basically
uh from one side we have the ransomware
operators these are the guys that will
be installing and deploying the ram
somewhere at the final stage in the in
the victims so they are usually usually
uh technical people really really
technical people well
um if we take the example from from The
ransomware Operators from the county
ransomware groups they had like hacking
guides in order to compromise people so
maybe they are not technical at all but
for other groups uh they we know that
they are really technical people that
they know what are they doing they know
how to how to do lateral movement and do
hacking inside the companies but from
one side we have those operators that
will be we will do like um the coin and
search task to to figure out what's the
company is running in terms of over or
how many employees a company have this
this part of enumeration is uh what
everybody does in a in um let's say
legit uh ethical hacking exercise for
for a company then they want to select
like a target of course they want to
select a Target that has money to to pay
the data because it it doesn't make any
sense that they attack a company that
doesn't have enough resources to to pay
the money in a change when they are
compromised and when the victim is
selected and the victim is let's say
compromised
um they ask for a high pay in order to
to get the data back if we take back uh
if we look at the past we could see the
evolution of how this business is
working right now at the beginning they
only encrypted the data and then
requested money in a change when they
figured out that the company is
increases the resilience in terms of
backups and stuff like that so when
company when a company was attacked they
were like meh I can restore the data I
don't care uh then they decided to
exfoliate the data before and and then
uh encrypt it in order to get the money
the money back and right now they are
like uh we are calling this right now uh
third uh extortion
um business whatever they are um sending
an email directly to the CFO in order to
say hey we know that you have money so
pay pay the bill you don't want to to
have your your data publish it so this
is this is the problem that we have
right now
talking about how they work internally
um from one side we have the developers
so they are they are like the the gurus
the the guys that are creating those uh
drum somewhere
um families and they are usually
creating something custom but sometimes
they are like grabbing code from other
families to take advantage of those
functionalities so every time we see a
ransomware family that is going down we
can see other families too like
parasites to take in this code and
implementing uh the the this has stolen
Coating in in in their own uh pieces so
meaning that they are also competing uh
between them because at the end it's
like uh yeah you have a like a big cake
of victims but if if I'm the major
ransomware group means that they will
get more Affiliates to work with me and
more money to to to split with my with
my people in order to I don't know to
increase my infrastructure to high mode
developers
etc etc and from the other side we have
the Affiliates these are the people that
will be in charge of um this also they
are called affiliate slash drum
somewhere operators um this will be the
people that will be in charge to deploy
and infect the companies we with the ram
somewhere they are splitting the payment
usually uh 30 percent to the to the
ransomware developers and the rest to
the uh to the Affiliates so meaning that
they are they can get a big part of the
of the money if they are succeed in the
operation of course inside of those
rules
um if we have an affiliate that is like
I don't know um if you remember for
example the attack that the colonial
pipeline suffered of course this
affiliate I'm sure they got another
person touching a change because they he
managed to get like a big beat him so we
could see also a special treatment for
Affiliates that are getting a lot of a
lot of victims and inside this picture
is not represented but we also have what
is called the initial access Brokers and
these are cyber criminal groups that are
compromising compromising companies
getting the access to to them and then
selling selling these access to other
cyber criminal groups that they don't
want to spend the time in hacking these
companies and they are also taking one
part of the person Touch of this money
that the victim will pay after the the
they are hit by by a ram somewhere
attack
and then on the other side of course we
have the the pure victims
so
we can we can use Mitra to analyze
Matrix like a framework that everybody
uh use nowadays it could be like super
cool for for companies that maybe they
don't they don't have like um like um
security uh Team inside and they want to
let's say invest part of their time to
increase the security uh maturity inside
the company so they can use Mitra in
order to
um let's say I want to fill a special
gaps and I don't know from where to
start you can use migrative to get rid
of it or maybe you are a security
researcher and you and you want you to
be able to attribute a family to to any
traductor or or or or or campaign you
can use also miter to compare the ttps
uh between families and and campaigns
and actors so this is um um like uh the
overview of the attack that they will be
explaining from one side we have the
criminal on the external perimeter from
the other side we have the different
ways where a criminal can compromise a
company he can do flower compromising
website or a Spam campaign or doing
bullet exploitation on the other side we
have the first Marvel that will be
deployed on the big team using Color
strike or maybe Empire to do a lateral
movement and then the Steeler and the
ramsen were execution
so this is um I will explain like a real
case that we had in Spain
um uh some time ago that we can now
disclose details about it and this is
the the page that uh the the guy from
the company uh got uh through an email
and he decided to open the link and then
he find out that this screen like you
have to update
um this your Google Chrome someone in
the public can spot any difference
between this page and the real one
don't tell me about the the JavaScript
below
the URL right the your the URL is like
um like one of the difference but I was
like doing a public joke because there
is no difference besides the URL and of
course the message below on the other
that don't execute this file because it
was already for the demo it was already
flagged by Chrome at that time but when
when this campaign uh was started uh
this Javascript file was uh undetected
by
mostly all the Security Solutions in the
market is practically then we have to
talk about
detecting this file dynamically in
execution in memory whatever but at that
time statically was food was fully
detected by by any security solution in
the market so the user decided to
of course agree with the with the page
and then click on update Google Chrome
hit a Noida file and this file
um was downloaded that was highly
obfuscated and the downloaded made or
did several things in the system uh
first it was checking if the assistant
was uh was a virtual machine because
they want to avoid to be part of a
Sandbox pipeline execution where we can
later flag the file and then add the
detection in our basis so the the money
that they invest to create this for
undetected file it will be lost so they
try to detect if the big team is worth
or not to be executed and also he the
downloaded executive the situ server was
active because imagine that you want to
download the second payload the second
stage and the city server is like
unavailable uh they activated whatever
so we don't need to do this callback if
there is a common control server is is
down so basically the the downloader was
doing several attacks in the system
before continuing the execution
uh this was the code uh
um if you open it with uh notepad plus
plus or whatever
and if you execute the the JavaScript
file this is the Callback that made to
the to the server it's interesting to
note this post request to a gif file and
then this content type application
formula coded so and also this a equal
this ID so they were able to identify
how many big teams or or the big team
that was behind this uh execution
because they want to track
if I'm a criminal I want to know I want
to have my own Google analytics right I
want to know how many buildings I I was
able to to compromise so this was the
Callback
um I I made a search on that time
um
okay so you can see it well uh so I made
I made a search at that time for a file
called Chrome uh underscore and then
positive plus five and txt file type and
I don't know if you can see it well but
there is like a few detections only for
some files it's not like uh the Bible
but uh it's like a thermometer that you
can use in order to measure how how a
campaign is like going on in terms of
detections for for everybody because
everyone is like uploading files to to
bios total so I usually use it to to to
measure the detections uh when the file
was uploaded in the platform so at that
time
um there are there were a lot of um a
lot of files that were like purely
detected
um digital loader um at that time uh
could download different type of malware
depending on the region and depending on
the time the that the loader was
executed it was controlled by the
command and control server and at that
time it was downloaded caller strike
readers and also a model that is called
CH tonic that is small is more known on
the banking Financial threats side and
it's curious because these guys were
using
um red teaming tools like cover strike
but also Financial malware like redex in
also to to to to let's say control
controller or or take control of the
remote computer in the in the company
and this is because of the capabilities
at reduction and CH tonic or Coalition
has that you can dump passwords uh get
the information from the memory control
the remote compute and execute command
and so this type of capabilities are
really interested for for those guys and
that's why they decided to use this kind
of tools
for one of the big teams we could see of
course uh the really famous mimikats
that is used to dump the credentials on
the Windows ecosystem and they are using
mimicals in order to get like pallet
credentials to continue doing lateral
movement and other operations uh inside
the inside the company and again I I
made a search at that time for all the
AV industry that had mimicals on their
detection name and also with less than
five positive and I also watch I I also
was able to find files that were
uploaded to to your wireless photo at
that time that had only a few detections
meaning that the the criminals are
trying to protect also those red teaming
Tools in order to be let's say a stealth
of the at the at the victim side and so
be careful with with those things things
and there are yellow rows that can of
course uh scan and detect mimikats in
the memory so use them are not only like
a static analysis to detectify if a file
is a threat or not
if we want to like um for our knowledge
we want to know uh how which families or
which groups are using mimikats and data
tags you can use the mitral knowledge
base to get right of those to get those
information it could be also interesting
to to cross check the groups and our
sector if I'm like if I'm in the
healthcare sector I will have like only
certain groups that are attacking me or
maybe some ransomware groups are
specialized on the healthcare sector and
they are attacking them theoretically
they have their own rows to not do it
but Lockheed for example is like you can
do whatever you want so it's important
also to know this information
um they got in the groups you can also
check miter to to get this information
um regarding the the lateral movement
tools that are used this is uh this
Kings of Empire uh that is like uh post
Transportation tool that is used to to
automate certain things uh for I say
um sloppy uh ethical hackers
um that was still I'm kidding but um
um you have a lot of automations to to
to to to compromise other machines in
the in the network at least a framework
that this
super use in process partition campaigns
because uh it's giving a lot of
functionalities for for those Affiliates
that are trying to arrive to the to the
Valhalla to the active directory
um server to to compromise the entire
company so it's important to to be aware
about the usage of of these tools in
your internal Network
[Music]
we also um detected like custom uh
Powershell uh I mean not like a general
framework but scripts that are used to
to to execute uh lateral movement inside
the company so there is also common to
to find Alternatives that are uh coded
by an affiliate for example or an
initial access broker that is maybe I
don't know um they forgot the Powershell
file on the system or maybe in an
initial response case we are able to to
get this file also so it's important
also to to be able to detect these kind
of files in a later attack also Custom
Custom executions
regarding uh how they are getting
credentials upon they have it with
mimikats they will start the lateral
moment uh propagation they will also try
to fingerprint your entire network we we
also detected the usage of Bloodhound or
other like tools to to compromise uh the
entire the Dial Network and they will
try to actually trade data from the
system we are not talking about the
right now the files that are exfiltrated
prior uh the rational encryption but
other interesting file that maybe I
don't know an encrypted file that they
want to crack or data about a storage
passwords in a txt file that they want
to use later or important files that can
be used later to thread the company the
targeted company Below in the image you
can see an um a Powershell execution to
download an additional Powershell
template file in the in the system and
also to configure
um proxy inside inside the system
because sometimes they want to access to
special places inside the network and
they have to practice those connections
in order to jump over the network to to
other places imagine a network that is
air gap they don't have internet
connection but they want to at least
start the data but you can access from a
from a jump server and and you have
access there the entire network doesn't
have internet access but you can
um let's say um tunnel tunnel the data
through your proxy in order to to get
the data outside this is also possible
nowadays and the other image below is uh
on Windows management instruction
execution where they are getting
information if the machine contains
exchange or SQL processor running inside
the system to see okay this is could be
this uh an interesting machine to attack
um and finally what are they doing is to
arrive to the active directory and this
is like a question that I always get
from journalists or other people in the
in the industry how they are able to
compromise the entire company at once
and this is not another explanation that
they are like creating a skilled task in
the as a GPO task in the inductive
directory and they are putting the
binary in accessible folder and then
when all the systems are reviewed the
the binary is executed and the entire
company is encrypted is as easy as is
they are they know how to administrate
systems as well
for the bad side
so this is like the general thing that
everybody sees around somewhere now that
we'll tell the user okay your data was
encrypted your company was hacked you
can contact us using protonmail or
tutanata or other
Anonymous email provider or you can find
your company listed on this uh blog page
or whatever in the torn Network
this college work in um nowadays
so how are doing data as filtration so
we could see different uh tools
available in the market
um these are General tools that are used
by System administrators we can see
transmit for Mac users
filezilla for Windows and Linux users
and other clone that is used for Windows
user that is there are tools use it for
for other purposes like I want to change
files with an FTP server if I want to
send files to this another remote server
whatever but the the there are also
criminals using those tools because I
mean they they have only they have only
update the data uploaded data and and
that's it
but they are also using a custom tooling
so they are developers at the end so
they instead of use one of those tools
um they they prefer it to develop their
own tool to do Darkness filtration and
they can control the entire workflow
about how the data Refrigeration is
performed so I will show you two groups
two example where groups that are doing
this
and like two tools that are used to to
do data filtration
from one side we have Rebel and wizards
uh driver is one of was one of the major
uh groups also known as Selena kiwi also
for maybe someone in the audience saying
no no it but my other name this was one
of the major groups that was impacting
and attacking our companies and they and
we discovered uh at that time a till
called research we debrief our customers
about it and it was like a data
filtration tool that was used to as
filtrate data based on extensions and
that are that were that were present in
the in the system
um on the image at the top you can see
another screenshot about how is getting
the logical uh diverse things in the in
the system and Below part of the code
about the extension that the research
was seeking at that time I have to say
that research is like a really fast tool
to be honest to do um data filtration
and it was used by all the all the
Affiliates to to to go to West filtrate
data on a victim so all the Affiliates
they have like a panel uh where they can
download the the ransomware that they
will use to compromise the companies and
at that time they had another option to
download also visit so it's not like
mandatory to use it
I mean they are cyber equivalent they
can do whatever they want but uh the the
group tried to to give tooling to the
Affiliates in order to help them to get
more victims so it's like the company
helping the workers so so at that time
they they provided research to the
people to to use it at the beginning
they are only uh giving this tool a
little VIP Affiliates to test it and
when they test it done they are
activating this option for everybody
foreign
[Music]
the workflow that uh research was doing
in the machine when it was in execution
and we can see
um a function that will
um
uh let's say explore the entire disk of
the system to get all the possible file
candidates in order to be infiltrated
it was quite interesting for us about
how the data was exfiltrated at that
time because research business was
splitting the data in chunks in order to
to get to be able to exfiltrate also big
files and and not be able to be detected
and this was the the post that was uh
made by by by research the destination
files is a PHP file on a remote server
and this is a file encoded that is being
sent to the to the server
um research was identifying the victim
so every time I mean there's still the
data was in a in a folder for a victim
so they are organizing things on their
side in a little later uh publish this
data if the victim doesn't pay the the
rescue
and the other the other group is uh log
bit
is uh the other the other group that is
uh nowadays Super Active I mean they are
um attacking still a lot of companies
they are investing a lot of money in in
marketing this is a page about uh one
publication they decided to to make in
the adding girl forums the garden how is
their expectation tool compared to the
others in the market
as you can see they are the winners
right they are the winners about uh
compared to other tools in the market as
you can see they compared like the most
used
tools uh by Affiliates so they decided
to to check hey um this tool is used not
um should we compare it or not and they
were discussing internally about how
which tool they should compare and they
they marketing team was creating this
table description to to Showcase all the
Affiliates this application for the
Affiliates like listen guys if you want
to get a lot of money you have to work
with me at the end they they they that
it's like
there is no like infinite number of
Affiliates in the market so if they if
they get all of them means other groups
they they will um get less victims less
money and they will get more money and
more victims so they have to also uh
excite uh other Affiliates to to work
with them when we analyze uh the
campaign at at that time uh we figured
out that the the the the the tool
created by by
um by luck with developers contained a
lot of code ported from from lockbit um
this is our
um ktae our threat contribution engine
that we use uh we and our customer use
to compare or less track attribution
basis on the static code analysis and as
you can see at that time uh the 32
percent of uh log bit was present in the
industrial with uh code and this is like
quite funny because they are like a
developer team right they are taking
advantage of the code that they already
did
and estelvic was uh
they had like a pool of ips that they
used to
um send their data uh to the remote
server this is an example about using
fake dnes on remux on the
my left side and and also still with
running in the back mode you have to
select a special option to activate to
activate it to see because they they
sometimes are releasing uh debug samples
in order to test those those samples in
real environments so they want to know
if the what they created is working on a
real system so sometimes we can see
um the back compilations but in in this
case I still bit that is still use it
nowadays the sample contains like a pull
of a piece that the sample will try to
contact and when he find like an
unavailable AP
outside I have to say after analyze them
that they are probably they have
probably the the first The Faceless tool
in in the market I mean it's faster than
the than the research and it's faster
than other tools that we find other
custom tools that we find in the market
that is being used by my Ram somewhere
cyber criminals groups so
for the question what we can do
um
uh part of part of the team
um was part of the uh part of the let's
say the the workforce to create one uh
report that we released publicly for
everybody so you can download it you can
explode it you can ask ask questions if
you want and and we release this for
free for everybody and this is an
analysis of multiple drum somewhere
groups that are available outside and
this is a drill down about all the ttps
this is quite important or or because of
what is printed before you can use ttps
to take advantage about which defense I
have to apply in my in my company or or
in which ttps I should focus if I'm a
researcher to continue discovering more
activity from from these guys or if I
find raw data and I want to extract
attribution based on the ttps I can use
miter to to do it so uh on on my left
side you can see groups it's just
counting right it's a pizza
it's high flock bit uh Ragnar Locker
black bite black cat these are like the
major groups that that we had at that
time and it's like the drill down of
drum somewhere uh ttps that we that we
extracted so
um the the report is called common ttps
ransomware Casper in Google uh you will
find it
um and it's like um I think it's 40
pages report about the ttps described
for all of those groups and
the latest slide
who knows its pyramid of pain
who know it
is like the um we are talking about this
science years and this is like about
what we should focus in order to defend
our company so we want to take a look
about harsh values we can we can change
this highest value in five seconds
adding zeros adding zeros or oily number
at the end and then the hash will change
if you want to focus on IP IP address
the guy will just change to another IPS
page address space or or he will use
compromises websites is something to
take care of but um it can be changed
easily uh when we talk about domain
names
um this is like something more important
because if you want to you have
hard-coded a domain name in a sample
you have to release another sample
because if we deactivate this domain
name it means you you cannot use it
anymore so it's something like it's more
important to to flag it and block it if
we go to network artifact it's something
that is more complicated also to to your
block if we go to tooling at the end
behind this campaign we are they are
humans and
I'm comfortable working with mac and
comfortable not bringing my adapter to a
conference so it means that it will be
hard for me to change to another
operating system to another tool to
another tooling so it will be something
hard for them to change so it's
something that if we identify it it
means that we will be able to track them
mostly all the times and also ttps about
how they are acting every time that they
are compromised in a big team they are
getting uh I don't know the credentials
they are spawning different processes
they are contacting by email they are
doing whatever they are doing if we can
um let's say make sure that we
understand the ttps of the campaign we
will be able to identify the group
behind it we will be able to track them
down I will be able to protect our our
assets that's really about using miter
uh so I encourage to everybody to to
take care of you you never did it and
you also uh try to let's say get more
knowledge about how the industry works
and get more knowledge about which kind
of attacks are these groups doing
and that's it we have one minute and 35
seconds for questions
does anybody have any uh question at
this time uh for Mark related to his
topic
as mentioned Mark will be around for the
next the rest of the day and tomorrow uh
so you you can
just go along tomorrow at any time
we have I have two colleagues here that
will be able to reply any question so no
worries
okay nothing at this time so mark thank
you very much thank you very much guys