EP45 VirusTotal Insights on Ransomware Business and Technology

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the product manager for threat detection here at Google Cloud, and Anton Chuvakin, a reformed, tamed, civilized analyst and a member of the cloud security team here at Google. You can find and subscribe to this podcast wherever you get your podcasts. As well as at our website. We did finally launch it, cloud.withgoogle.com/cloudsecurity/podcast. If you like our content and want it delivered to you piping hot every Monday afternoon Pacific time, please do hit that subscribe button. I will note that we are taking a little bit of time off in December. So if you don't get your deliveries in December, that's why. Fear not, we will return in January of 2022. You can follow the show and argue with us on Twitter as well, twitter.com/cloudsecuritypodcast. Thanks for listening. Anton, we've got VirusTotal representatives as well as somebody from the Threat Analysis Group today, which is super fun. And we are talking about ransomware.

Yes. Today's episode, as you would know in a few minutes, had a couple of moments when I kind of exclaimed, this is surreal.

Yes.

So there would be a few moments when my mind of a person being in the security industry for a good number of years was kind of blown by some things we've been learning. So this is Fascinating.

This is an episode where I really felt like my political science degree was not a waste of time because so much of what we were talking about today comes down to the economy and in some ways the sort of psychological economy of ransomware operators and people who are paying ransoms. It's really fascinating stuff out there.

Yes, I guess I'll give one brief preview about trust. It emerges that it's better to be hacked, to be compromised, by a trusted brand in ransomware because if you're hacked by somebody who's a trusted, well-known brand in ransomware, and if you pay them, you get your data back. But of course, it's obscure and kind of weird to even think about, like, which criminals are trusted and which are not. How do you go to their website and check their Yelp ratings? Like, how do you even go about that? We don't have answers.

Is there a Yelp for ransomware operators? It's really an interesting sort of thing where the criminals will make more money in the long run by being trustworthy. But have at various junctures, and we get into this in the episode as well, listeners, opportunities to make a quick buck and then run away. So there's really just fascinating trust incentives all over the place. And with that, let's turn it over to today's guests. I am delighted to introduce today's guests. We are joined today by Vlad Soliyarov, a security engineer at Google's Threat Analysis Group. So you actually get to hear from the famous, infamous Threat Analysis Group today. And 3-time now returning podcast guest, Vicente Diaz, a threat intel evangelist today at VirusTotal. Folks, we want to talk about ransomware, which is a perennial, or at least this year, an annual topic of interest for everyone. We wanted to start off talking about your report that's coming out. Can you tell us about some of the insights about GandCrab? GandCrab? How do we pronounce this group? It was the most popular family last year, and does it continue to be big? Tell us about that.

It would be GandCrab, I guess.

GandCrab, okay.

GandCrab is one of those ransomware-as-a-service groups, and it's been really popular last year. It'd be fair to say that it was really popular until about May 2019 when it shut down, and then they re-emerged under another name. You might have heard of them being called REvil, or sometimes they're also referred to as Sodinokibi.

I have heard of that. Can you tell our listeners what ransomware as a service is and how you sign up for that?

Basically, it's a business partnership between people that write the ransomware and people that are able to distribute it. Both groups kind of reap the benefits of this business exchange. As an operator, basically the owner of the ransomware, you begin to advertise your program on some underground forums, Saying that, hey, we have this new ransomware strain and we're looking for distributors. And in this case, distributors would just be affiliates. And the way this works is that affiliates are getting a fee from each paying customer that ended up paying the ransom. And the split is usually about 60% to the affiliate and 40% to the operator of the ransomware.

Does it mean that they're losing money on the table, or does it mean they're just becoming more efficient in how they organize? I'm just curious about the setup. I've heard of it before, but I never really spoke with anybody who knows why they do it. Why do you think they do it?

There are many benefits to just distributing your own ransomware. First of all, you might be good at distributing stuff. You have some channels like MalSpam or you have ExploitGate that you have access to, but you might not necessarily be an expert in cryptography. Another big part of it is brand. GandCrab is a well-recognized name, and when you search for it, you see all those scary articles. And that kind of pushes the user to pay.

So this is marketing, basically, like scary articles about ransomware is marketing for the teams that do it. That's kind of painfully obvious, but also kind of fascinating, right?

Yeah, it evolved over time. And I don't think that initially it looked like that. But here we are, 2021. And this is how things work.

This is one of the things I love about our industry is we act like security is this big technical thing. And it comes down to, you know, what crypto algorithm you use, But it's also a marketplace, and it's a marketplace not just on the vendor side, but also on the adversary side. These people are doing it this way because they make more money this way. It's Adam Smith's pin factory. We have people doing the thing that they're good at and cooperating to deliver an outcome that is financially good for them. Maybe not for the rest of us, but good for them.

And kind of a spoiler alert, the group that emerged after GandCrab, they kind of lost the marketing game. But I guess we'll get to that and discuss that later on.

Well, tell us how they lost the marketing game.

Some things happened with them, and basically no one wanted to work with them anymore because they did some things that the affiliates weren't really happy with. There were some debates about some affiliates getting cut out of payment and some speculations as to whether the REvil ransomware had access, like a backdoor, to hijack negotiations so that they could get like the full 100% instead of just 40% cuts.

The criminals scammed the criminals? No way.

But it's like shooting in your own foot, right?

Well, there's that, but maybe you can make some money before they find out. I don't know. That's fascinating, because there's a lot of money changing hands around this. Like, I don't want to mention the numbers, because this is your report, but ultimately, these are large numbers. And how do you think they spend the money? I know it's been kind of a painful question to me. Like, do they invest in research? To do better ransomware.

They're not donating to the local PTA, right?

Yes. But how do you think they spend the money? We're talking about like 9-digit amounts, if not 10-digit amounts, right?

There are some stories from the past I remember because basically the same model was working for botnets and everything like 15 years ago. Right. And in some cases, I remember some of these big bosses of ransomware becoming politicians, basically buying their way out of prison thanks to having immunity.

Also, they invest money into not being put in jail.

Exactly.

Well, that's one of the best uses of money there is if you're a criminal.

I don't think that always works.

Fascinating.

To go further into this, when you're looking at the report, you mentioned double extortion schemes. And of course, we all know that it's about unlocking the data and also stealing the data to sell it back. How else do they profit from stolen data? It sounds like The double scheme is sort of a natural evolution from just ransom and stuff, but what else can they do to profit off the data or off the compromised system access?

I guess there are a bunch of ways, but they all revolve around the same idea of getting access to some really sensitive, important data that people don't want to have leaked. One of the schemes that REvil, which is the group that is kind of the follower to GandCrab, was engaged in was even called triple extortion scheme. They compromised a quantum computer, which is an Apple contractor, and then they threatened to release schematics for unreleased Apple products. But what's interesting about this and the triple scheme of this was that the threat was addressed not to quantum computers, but to the client Apple, saying that, hey, you might want to push them to pay the ransom fee if you don't want to get your data released.

So it's basically getting you, unlocking the data, returning the stolen data, and not releasing it to the public, right? Like this kind of a triple scheme would be that. Yeah, I'm afraid next year we are talking that there would be a 4x scheme or 5x scheme because there may be other ways to profit off the data. While some organizations are still figuring out the value of the data, ransomware reminds us about how to do it.

How would you trust that having paid they won't release your data? Like, I don't understand why you would trust the bad guy not to release it anyway or not to ask for more money in the future? How does trust work in this economy here?

I guess it's the same as the branding aspect that we mentioned before. If you do it once, maybe you get away with it, but next time people are going to be more hesitant towards paying the ransom.

That makes sense.

So maybe if it's a really big fish, yeah, you could do it.

So does it mean you'd prefer to be ransomwared by a trusted brand in ransomware? This sounds kind of idiotic, and the whole conversation has a surreal feel. Tim, would you say that instead of being ransomwared by somebody who is like sloppy and greedy, you want to be ransomwared by somebody who's a trusted brand in ransomware? Is this crazy?

It kind of makes sense to me. Our whole industry, every time we talk about the industry aspect, we get into these interesting trust conversations like market for silver bullets, market for lemons. There's actually some value that these brands have. You might call it goodwill. in a public accounting statement, but these ransomware gangs are able to profit on their reputation of being an honest criminal.

Which is true. That reminds me something that we discussed in a previous episode when we were talking about cyber insurances, that probably they will have a clear motivation for you to pay the ransom instead of trying anything else, just because for them it's easier and it's case solved. In this case, it is not the same. It's not like cyber insurance has a motivation here in case of exfiltrating data. It has to do with what are the different motivations for the different parts. Sometimes everything is tied to one group. Like they are asking, if you don't pay the ransom, then we will go exfiltrate the data. So maybe you want to pay the ransom first of all, so the other aspect is not taken into consideration. Having said that, of course they can and they will sell the data. So next day will be someone else knocking at your door. asking you for the money. Unless you pay, they will release the data that they stole from the previous actor.

But doesn't it mean that if you don't pay, you suffer, but if you do pay, you also suffer because you get on the list of people who pay? Wasn't there a bit of research published by one of our partners that 80% of victims who pay get ransomed again? To me, the number also struck me as kind of crazy, crazy high. Lately in the industry, people were like suggesting that maybe paying sometimes is a good idea, but this type of data indicates that paying is never a good idea because you're going to have to pay again, and the next criminal may not be as trusted as the first one. So maybe you pay first, get ransomed again, but by somebody who is more sloppy, and then you never see the data. Sounds like a bad decision all over, right?

Actually, there is another aspect here to consider. It's something that Vlad just mentioned, how the different actors are changing over time, how in some cases they are simply having affiliates And there is no coordination who is infecting who. Also, other than Gangcrab, which is like the one we started the discussion with, there are these other 130 groups also active in the market. So what is the guarantee that if you pay to one of them, the rest will leave you alone? Basically, it's zero.

Speaking of cyber insurance, I think Gangcrab was one of those ransomware-as-a-service groups that were providing guarantees that if you get reinfected, you can just contact our customer support and we will send you the decryption key for free.

Wow.

If you paid the first time.

That's quite a guarantee.

Yeah, you just need to hope that it's going to be the same malware strain that you've paid to.

Yeah, that part is another really surreal bit. So this episode seems to be like chock-full of things that probably would blow people's minds a little bit. Like for us, it's sort of normal, but I can see how some people's minds would be kind of blown when they hear it. So I want to switch gears a little bit and go talk about the good news. Takedowns, right? There were some notable takedowns by law enforcement, coordinated infrastructure takeovers, other stuff. Is this good news or is there more scary stuff coming down? Can I position it as good news? And if yes, why? If not, why not?

It is good news, of course. Having said that, the impact overall probably will be difficult to see. At the end of the day, you know, we have so many groups, so many actors. And yes, maybe you can get some of the people who is behind some attack. It doesn't necessarily mean you get all of them. It doesn't necessarily mean that this is operation. In some cases, maybe the malware will become open source or some other part of the group will start a new affiliate program, rebrand. It's kind of sad. I don't want to be— to sound depressive. Again, it's good news, obviously. And at the end of the day, this is the only way. Like, they see that actually this is not for free and they can end up in prison. But yeah, there are like so many actors, groups, and— It's so lucrative that it's not making a big difference, unfortunately.

I want to shift gears a little bit away from that note of not making a big difference and talk about ransomware outside of a Windows context, because it seems so often that the ransomware story ends at owning the AD and then owning the org. What about macOS? Are we seeing much macOS ransomware these days?

No.

No.

There were some attempts last year, but you could hardly call them ransomware. The Bitcoin wallet that they asked to receive payments to got zero transactions. So no one paid. I'm talking about malware called ThiefQuest, or sometimes it's also referred to EvilQuest. It's a fascinating piece of malware for people that are interested, and it's really worth a case study. But as a business model, it wasn't profitable at all.

That's fascinating. Do you want to speculate on why it's not profitable?

I could speculate, I guess, that the malware had so many different things baked into it. It was a stealer, it was a virus, so it could infect all the other applications that you had on your Mac, which was, you know, interesting. It had like a keylogger functionality, but where it did lack was in the basic OPSEC and infrastructure aspects. For example, they didn't really have a good C2 infrastructure or backup mechanism. So when the first one was taken down, you had all those machines that were infected, but the C2 wasn't responding. So you can really profit out of that.

Their SREs were probably punished for this, right? As long as they practice modern development and operation practices, that is.

True, true.

What about Linux? Any luck there or not? You guys mentioned some of it in your report, right?

Yeah, but I think it's a similar case of what Vlad was explaining. Proof of concepts are there, malware is there, but we don't see I guess that it still has to do with how the big corporations are using different operating systems. And I guess that most of the time it's Windows. So attackers go for something that is easy and well-known for them, where they have all the tools, basically jumping into Active Directory and then spreading the malware. Most of the base is Windows. There they are done.

Yeah.

This is what they keep repeating. So at some point, it could be that, you know, we see some case where this is a key piece of the attack, and they are using some kind of piece of ransomware for Linux. It exists, of course. There is nothing stopping that to happen. But in most of the cases, it's not what they are finding, the attackers. So that's why they go with, well, all good, known Windows ransomware.

So it's not a great business. While technically it's possible, it's just not good business.

I would say that we're seeing an increased amount of activity targeting Linux, especially if it's something like a Linux server that's running VMware ESXi or NAS servers. And the reason for that is because organizations are increasingly using these for running, you know, their Windows VMs. And so if you could compromise the machine on a different layer, that certainly helps, right? And then also there are machines that are used for backups, NAS backups, and there's really no point in encrypting files of the whole organizations but not touching backups. That's where I see a lot more expertise and efforts by the threat actors.

That makes sense, I guess, so that we may see more change from like the traditionals, namely the Windows coverage. So I wanted to start pivoting this conversation towards the— maybe more about their internal operations and some of the fun stuff about how they operate internally. But I want to first ask about the zero days. Of course, some people are really scared of being hit by a zero day. So what have we seen the ransomware groups use? Like, do we see increased zero-day usage, or is it still more on the esoteric side because there's simply no need?

It depends on what kind of zero day we're talking about. I think when we're talking about zero days in the traditional context, we're thinking state-sponsored drive-by download or watering hole. For ransomware, you wouldn't see those being used that way, pretty much. But there was recently a notable exception which happened in September where one of the ransomware groups did use a zero day in Microsoft Office to target employees of businesses in North America. That one was a first. But then there's a whole big sector of zero days in servers, zero days in VPN clients and servers. Exchange vulnerabilities are increasingly more common. And so it goes.

That makes sense to me too. It's like the stakes are somewhat lower, I guess, compared to the state-sponsored groups. Seems to fit my intuition about it.

Yeah. With the ransoms that we're seeing lately, We're talking millions. Typical price of a zero-day in, say, Office would probably be smaller than that. So business-wise, it does make sense to purchase a zero-day. But why would you need a zero-day if phishing attack is just as effective?

That's the classic answer, which remains to be true. Was true 5 years ago, was true 10 years ago. I fear it may be true in 10 years. Why do the research if you can phish?

Yeah.

Actually, to add something to this, also in some other closed circles, I also heard this increasing number of zero-days being used in different attacks. Even if there are not many details available to the general public yet, it looks like these groups are becoming so resourceful that they are starting to think about that and to put that into their toolboxes. So I guess we'll be hearing about more of those.

When we touched zero days, I also mentioned that you guys have some things in the report that cover like more about ransomware operations. Like, I think the fascinating point was about the one ransomware group setting up a fake company or something. So what's the story with that? What do we know about their day-to-day operations?

We really don't know much. I think the most amount of information we get would be from law enforcement indictments and documents that end up being public. Some of the details that have recently been found are really fascinating. For example, a group that's certainly known as FIN7 has been creating these front pen testing companies and then using them for job postings on the internet saying like, we're hiring reverse engineers, we're hiring C++ developers, system administrators. And so on. But that's about as far as it goes, to be honest.

Yeah, but that makes an air of normalcy of like them running infrastructure, them running IT, developing software. So this is kind of the story. So the final question I wanted to ask is our traditional question about any practical recommendations for the audience. Of course, I'm not going to ask how to fix ransomware, but do you have any favorite tips, maybe one tip, as far as how can others be more protected or reduce losses or reduce damage?

I want to start with this. In my case, my tip is monitoring. I believe this is one of the most effective strategies because you can be preemptive. You can simply check how these things are evolving and try to fix it before it reaches you. I mean, there are, like, all these general recommendations, of course, but monitoring what exactly is being used, what kind of tools, what kind of malware, and making sure that you're protected, I think that this is extremely useful.

Perfect.

Vlad, anything from you?

Install updates.

Patch faster. That's right. Classic.

Yeah.

Thank you very much for participation. I know the favorite resource we'll highlight is of course your report. Any other resources you want us to highlight?

Read Taks blog. Yeah, of course.

Yeah, everybody does.

That's right.

Also, the No More Ransom is a good resource to check in case that you are infected. Maybe there is some free decryptor for you.

Perfect.

We will note those in the show notes. Again, thank you very much. This was fascinating. And of course, we want the audience to read the report because all the juicy details are there.

Thanks a lot.

And now we are at time. Thank you very much for listening and of course for subscribing as well. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. You can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter as well, twitter.com/cloudsecpodcast, or your hosts are on Twitter as well, Anton_Chuvaikin and @TimPeacock. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode in 2022. Because keep in mind, we are going on a brief break at the end of December, and we will return in January. See you on the next Cloud Security Podcast episode. Security.

Security.