Ransomware 101: Get Smart Understanding Real Attacks

Session today, Ransomware 101: Get Smart, Understanding Real Attacks, which is— I'm sure we all need to learn a little bit more about this. So, uh, with— I just want to remind you, at the end, don't forget to do your surveys. And also, at the end, when, when he starts to take some questions, please speak into the microphones because we're recording the audio and they can't hear the questions if you don't do that, even if you think you have a booming voice. And without further ado, Jibran, thank you. All right, thank you. Oh, thanks. All right, well, first of all, um, really, really thankful that you could make it here. It is such a privilege, uh, to be speaking in front of you. Um, the talk is going to be about ransomware, a little bit about me and ransomware. We go back about a decade when there used to be a one-size-fits-all ransomware called CryptoLocker. I've been tracking the ransomware threat actors for almost a decade. So much so that last year, the ransomware— one of the ransomware threat actors, they actually put a bounty on me for about $100K. It was at this conference last year that they actually posted something on dark web saying that my company Mandiant, which is now part of Google Cloud, and myself, we've been part of unethical practices and provocative practices. And when you read a little under that, they said that they had an impact to their organization by protecting against ransomware. So long story short, for the last year I've been getting a lot of spam, a lot of attacks, Everywhere, so I've gotten to know them a little bit more. But my family warns me about all of this, but you gotta do what you love. So I'm really, really passionate about protecting evil, even more passionate about sharing what I learned in the incident response trenches. And the way I really wanna spend the next 50 minutes is to show you the visuals, 'cause I'm a visual learner. And I'm pretty sure some of you are, if not most of you. So what we'll be doing is walking through the whole ATT&CK lifecycle with demos and screenshots. So anybody excited about that? Yeah. All right, we're gonna have a lot of fun. Like I said, the next 50 minutes we are one family and I do want some questions and answers towards the end. The RSS theme this year is we are stronger together. And by sharing this knowledge, by sharing with the community, I think you'll all be stronger. And I'd love some feedback afterwards as well. All right, so let's begin. Here's a disclaimer slide that I must show. And here's the agenda. Why should we understand ransomware? Attack lifecycle. Some of the fun parts are gonna be some of the tips that I wanna share about negotiating with the ransomware threat actors. And then last but not the least, the tips from the trenches, like what could you do in the next week, next 3 months, next year to protect you and your organizations, okay? So how does it hit home? I think it hits home in several different ways. Just this year, I mean this week, if you read the news and you just put ransomware on Google and check the news tab, you will see that one big point-of-sale company, NCR, is going through a ransomware attack. And because of that company, there are a lot of other companies that are affected. They are not in business or they've had delays in their operations. So if you look at the first one, ransomware attack at fuel pipeline, I think you know what I'm talking about, Colonial Pipeline. So yes, there was fuel shortage. Yes, the gas was expensive on the East Coast, but the way they took it was kind of like an act of war 'cause that's how the protocols were when you respond to a ransomware attack in such critical organization. The next one is really personal to me. I feel like, you know, we, when we come in cybersecurity, we come with a mission to protect against evil. And this one hits home. I call these attackers heartless, heartless hackers because they are playing with people's lives. And I've actually seen how critical the networks are when the hospitals are trying to protect human lives. So this one, I've seen banners or placards at the entrance gates saying that, hey, if you had an appointment today, we won't be able to serve you, we won't be able to do your surgery because our networks are down. Now imagine if you have a loved one, your parents or your kids, you're taking them to the hospital and that's the sign you see. It's huge impact. It hurts you. It hurts that a human being can do that to another human. The next one is a corporate one. I think a pretty famous law firm had this sign that, hey, we are down. Sorry, just everybody go home, turn off your laptops. So the impact is real. And the impact, you know, you have to look in terms of money as well, but I think what if you have the money and you want to pay but you're not allowed to? So one of the last bullet points that you'll see here is, do you know what OFAC is? It's a, you know, part of Department of Treasury. They can tell you that, hey, this threat actor that you're dealing with, they're sanctioned, you cannot pay them. So imagine if you have all of your data for your organization for the last 15, 20 years all locked up, all encrypted, and you actually want to pay but you can't. What do you do, right? What about this one, the loss of trust by business partners? So if you are a service provider or you have other entities connected to you, what if you get attacked by a ransomware threat actor and those businesses say, sorry, we're gonna have to cut off our network with you because you're not sure that you're contained. And these investigations are not like sprints, they're marathons. So they could take up to 3 weeks before somebody can even tell you that you are contained. So what do you do for 3 weeks when your business partners can't connect to you? Huge impact, right? The fines are now north of $30 million and people are paying. And guess why people are paying? Because a lot of firms have cyber insurance and some people have good enough coverages. So let's move forward. Let's talk about a lifecycle. of an attack. So there's several ways the attackers get in, several ways attackers establish foothold. The lifecycle that we're gonna run through is a pretty common one, and for the folks who've been part of incident response or seen this in real life, you're gonna resonate with that because it is a very similar lifecycle in most ransomware attacks. So infiltration is either via an exploit or email spear phishing, then they install command and control or remote access app. Then they wanna steal more credentials 'cause the credentials that they come in with or the credentials that they get initially are not enough for furthering their attack. Then they do some more reconnaissance like internal network mapping and then lateral movement via remote desktop or some other tools that they use, built-in tools. And then the last part is completing the mission. So what these threat actors are doing these days is before encrypting the data, they are also taking your data to their infrastructure so that if you have really good backups, guess what? They still wanna take your money and they'll say, look, we have your data. So we understand that you found a way to restore your data, but we can still get you because we're gonna release your data. So we're gonna talk about like how they do that as well. All right, so let's talk about one of the first, well, not the first 'cause they do some external recon, but this is the first time we as incident responders, we see them in the network when they actually infiltrate in. So password spray attacks they do on Citrix VPN, remote desktop, if it's open from outside, believe it or not, I still see it. I don't know why, but that's still out there. Purchasing of credentials on dark web forums, and then once they have it, so it doesn't even have to be your company who's getting hacked. It could be an employee user whose credentials were hacked somewhere else and they come in with those credentials because they happen to use the same password in your network as they were using in the hacked company. in the hacked entity. So they do this attack called multi-factor MFA fatigue attack. They keep sending those push notifications to the user and again, I don't know why, but some people still click on that green button that, okay, go for it, whatever you wanna do, I'm busy with my kid's soccer game. Okay, so exploitation on publicly available servers. So you probably heard about these vulnerabilities, that are pretty common and it's not, I would say that sometimes it's really, really hard to patch them on time. Like let's say that you, there's a vulnerability that comes at like, you know, 2:00 AM Saturday morning, right? You're not gonna be up to even put a patch. And some patches when they first come in, like for example, Log4j, when the patch came, it wasn't even a full patch. People were changing registry keys and thinking they were secure, then they went away for Christmas only to realize that that little hack wasn't enough and they got hacked again. So these publicly available servers are also one of the key infiltration vectors. In fact, if you read our Mandiant mTrends report, you will see a huge rise compared to the spear phishing email. this vector is rising. And zero days, again, there's no real cure. Third-party VPNs, like if you're connected to some network via VPN and that network is compromised, then yeah, they can come in via that as well. So the example that we're gonna demo is an email spear phishing attack because it is one of the most common vectors and it hits home because we all get emails and we are all as human species are getting better at detecting this sort of spear phishing email. So here's an email that came to a user about a few months ago. I was investigating and I kept wondering like why that person clicked on the attachment. But here's the background story. You see that there is a signature of the user. It's the signature of the recipient. The email actually comes from a legit business partner. So this is one thing that you have to understand. When you're doing business with somebody and you are used to receiving an email from that person, even if there is an attachment, you happen to click on it. Now this email, this person sent about 3, 2, 2 and a half years ago when there was COVID. So if you are able to read the text a little bit, you will see this talks about COVID-19 crisis, but nowhere this victim requested a file or payment. Okay, but nonetheless, there is this 2-megabyte file with payment something something .html, and that gets clicked. We are going to do a demo of what happens when the user actually clicks on it. Anybody excited about the demo? Okay. So we're going to see how excited you are. I'm going to ask a question just like Michael Jordan would ask before game time. I'll ask, what time is it? You'll say, demo time. Deal? All right. What time is it? Demo time. That was weak. I gotta do one more. What time is it? Demo time. There you go. All right, so in this demo, what you, it's gonna go really fast, but I think what I want you to understand is how clever, you know, there's the technical piece to it, which is brilliant, but what I want you to note is how the attackers don't break the social engineering chain. 'Cause they're dealing with a human at the other end. Unlike other attacks, there is a lot of human contribution in it. And you might ask like, hey, why wouldn't the attacker just make one-click malware? 'Cause when they click, when they do that, the user gets more suspicious. Does it make sense? So they actually help the user become an accomplice to the attack. Okay. Let's go. All right. Let me see if you're able to see. There we are. Okay. So you've got that same attachment here, right? So what's going to happen is the user is going to click on it. Just going to show you what the properties are. Everything looks a little normal. So when the user actually clicks on it, guess what happens? 2 things happen really quick. The browser window opens. There is a file that gets downloaded. And then there is an error message. Is it in attacker's best interest to give an error message for a malware? Conventional wisdom, not really, right? 'Cause they would want a one-click solution. But not only that they do that, they actually give a password. Guess what it's doing to the victim? It's actually making this more believable that it is some file that she needs to open, right? So here's the file that we're gonna open. It is an ISO file. So what do the ISO files do? They mount a drive letter. But before the drive letter is mounted, you need that password. And guess where the password is? It's in that screen, right? So the victim takes that password thinking it's all real. And when they do that, a new drive letter, E drive, opens up. Now again, E drive is open and there is a document named payment.docx. that shows up just so that attackers don't break the social engineering chain. So as soon as they click that, this is where the magic happens or this is where the attack actually detonates. This is basically something that me, if I was the attacker, I would get at my end and it would say like, hey, hi attacker, connection established with victim so-and-so. I am your genie in the shell. Forgive my ASCII graphics. a little bit, but it is a genie, it is a lamp, so trust me on that. And then the question that I would be asked or the attackers would get asked, like what do you wanna do? I'm your genie, what can I do for you? So you can do a lot of things, install remote access app, conduct recon, dump credentials, create a reverse tunnel for remote desktop, anything that is legal or illegal in their world, but this is my demo, so. Mostly legal stuff. So basically what you've learned is, by the way, this attack is, the malware is called Qakbot, Q-A-K-B-O-T. So if you ever read up on that, you will actually see more technical write-up like in what happens on the file system. But this is the flow. They come in, they make everything believable, and because they make everything believable, the user doesn't create an IT ticket. Does it make sense? So if they did something like, haha, we hacked you, guess what was gonna happen? They were gonna report to their cybersecurity team and then they would start, the security team was gonna start the investigation. But they, because they do that, they go under the radar and the attackers need about 3 days to like about a couple weeks to actually get all the way to completing the mission. So this is why they make the attacks so believable. All right, so with that, let's go back to the PowerPoint. All right, so we did that. Let's talk about how they establish foothold in the environment. So now they're in, right? So you saw those 4 options. Create a remote desktop type of solution and conduct recon. So all of this is next steps. They wanna establish as much foothold as they can. So what we see attackers do is install a very popular tool called Cobalt Strike. Have you heard of Cobalt Strike? Very, very common command and control tool. The demo that we're gonna do next is installing remote access tools like AnyDesk, Splashtop, Screen Connect. So we're gonna do Splashtop. Establishing reverse RDP tunnel for interactive access, that's also very, very common. And backdoors like ngrok tunnel, front door access gaining. And do you know what NTDS file is on domain controllers? No. So it's basically your authentication database. So if attackers take that, guess what? Then not only they're good for that attack because they have the hashes for all the usernames and all the user accounts, but the best part about this for the attackers is that they know after cracking those hashes is who are the people who are gonna be vulnerable even next time. And how would they know? 'Cause their password is gonna be something like Chicago 2022 with an exclamation and an@ sign or something along those lines. So they know that those users are good targets for next time even if they wanna create a spear phishing email the next time. So that is very, very important. So how do they escalate privileges? Now this is very, very key phase of the attack. So you have to understand when they come in, they attack a user who's not very, very IT-centric, right? Because they're the ones who fall prey to those spear phishing attacks. So they have the credentials for maybe like HR or marketing or any other department but the IT. They want the credentials of IT people because they wanna be, domain admins on a Windows network. And what's domain admin on a Windows network? It's like God on a Windows network. So they want that, right? So what do they do? They run Mimikatz, there are several ways we're gonna go into it. They run other tools like Impacket or cred dump of Impacket Suite, some of the other tools to get passwords. I don't know if you do it, but some of the other tools Sometimes I'm guilty of saving passwords in the browser and if they get to my computer, they could get a lot of cool passwords from my browsers. All right, so let's do a little case study on Mimikatz. And I've been seeing again these attacks for about a decade and here's what I've seen. They used to use Mimikatz this way, just run mimikatz.exe and that would be the end of it. Then this method started getting detected by security tools. So they said, okay, we'll run Mimikatz via PowerShell. So they would use a module called Invoke-Mimikatz.ps1, a PowerShell script to do that. And that started getting caught. So then they said, okay, you know what, screw Mimikatz on victim machines, we keep getting detected. We're gonna do this, we're gonna take the LSASS dump because the LSASS dump, LSASS is a process in Windows, this process has plaintext credentials in memory. So they take the process dump of lsass.exe, and once they have it, they can crack the password, or they can extract the passwords offline. So this part is happening on the victim machine, and once they have this dump file, they take that dump file on their infrastructure and they run Mimikatz there. So there are no security tools running there for the organization. So this even started getting caught. So this is their latest method. They run this DLL with the process ID of LSASS and then they take the dump and it's a pretty simple one. We're gonna see it in the demo as well. So it's kind of like a game that we used to play when we would take long drives and we would have a radar detector. The cops would come up with a radar detector detector. and we would have a better radar detector. So this is the cat and mouse game that the attackers play. All right, so this is how the password looks like in plaintext. So once they have the dump and they see, they run the Mimikatz tool, this is how neat their output actually looks like. And WDigest, like when it's not on, one of the first things that the attackers do with a very quick registry script is to turn WDigest on. And once you have that on, then you have come up with a plaintext password. Now this password, I get a lot of cheers when I'm doing it in Midwest, but I do realize I'm on the West Coast and this may be your favorite team, Warriors. We did a 72-10 with Michael Jordan and Chicago Bulls back in '96. Back then NBA was different, but I totally understand if you like your Warriors. But anyway, coming back to the presentation, this is how neat their output is. is when they are able to run Mimikatz on the victim system or offline. Okay, so let's do another demo. All right, so I have to, I think, end, not end, but, all right, so here it is. So you remember the option that we got about installing Splashtop or remote access tool? So that's the option that attackers in this lifecycle, that's the option that attackers took. And this is how, again, it's very, I really want you to visualize what attackers see at the other end. So this is Splashtop. This is the victim PC where the malware detonated and this is what they're able to do. So just check all the features very carefully just to understand like how easy it becomes after the infiltration for the attackers. So as you can see, the manage option would give them all of this and now you're wondering why would they wanna do patch management, right? They don't, this is a tool that attackers use that is made for remote system management, they just use it. So the option that we're gonna choose is the command prompt, 'cause command prompt, once they have it, it's kinda like game over because they can do a lot. So the first few things are gonna be recon, like checking with the dir command what's, like how the system looks like. System info, do you know what this one does? No. Well, you'll see it in a second. It gives a lot of other good information of who owns the computer, when it was installed, what kind of patches, Windows patches are there, what is the IP address and whatnot. Whoami is a really good command 'cause if they see that they could run their commands as system user, that's great access. System access can do a lot of things. Tasklist, anybody, any guesses on why they would run tasklist? To see what's running. AV viruses. Excellent, yeah. They wanna understand what security tools you're running on your system. And why do they wanna learn that? 'Cause before they actually put their best malware in there, they wanna make sure that that malware doesn't get detected by AV or any of the security tools. 'Cause they do spend at least a couple weeks developing all of that. So they learn all that. They also wanna learn the process ID of LSASS. The next command that they would run is like a dir /s. Do you know what this command does? Recursive. Recursive list of all the files on the system. So that if they get disconnected here, if they get interrupted, they can at least know what files are there and take it before something bad happens to them. This is what I had showed. This is a method of extracting a Mimikatz payload or LSASS dump to run Mimikatz later on. And very simple command, basically it's saying that run DLL, go run this comsvcs.dll and create a mini dump. The process name for number for LSASS is 792. And then give me the output in C:\Drivers\lsass.dll. LSASS.DMP file. Fair enough. Why do they choose the drivers folder? 'Cause they know nobody's gonna really take a look when somebody is just having a cursory look. So they choose folders like that. So in the drivers folder, now that the recon is done, there are all of these files like dir_output, which is the output for dir /s command. And the LSASS dump. So this is basically some information. Do you know what a Windows registry is? Especially the SAM hive and the system hive? If they get that, guess what they have access to? They can basically then extract some local admin passwords too. What do they do with local admin password? They can run more tools. And if the local admin password is the same on these workstations and some servers, goldmine for them. They can run, they can go to that system and run Mimikatz again and gain domain admin credentials. So the system hive and the SAM hive, when they have that together, that's a lot of game over for at least that box. They can control that whole box. So basically, go ahead. The domain admin login that recently they could get that wrong. Exactly. So basically there is this thing called, in Windows called cached credentials. Very, very important question. Like when you're sitting at an airport and you type in your username and password, you're not authenticating against a domain controller, right? You're authenticating against something that's stored on your system somewhere in the registry. So you get right into your computer, right? Everybody following so far? So you're not connected to your local network, you type in your password, you're still able to connect, right? So that password is like a hash in registry. And when you type in your password, it gets converted into a hash and it matches. And you basically are able to authenticate. So that password, if a domain admin or help desk person, somebody with elevated credentials, if that person has logged into your computer recently, they can get that password. Or actually there is a tool called Windows Credentials Editor. They don't even need that password. They can actually take the hash and use that to— it's basically called pass-the-hash attack. So you can actually take that hash and say, I wanna access this F drive folder of corporate secrets. So that user is an allowed to access that, but if they have the domain admin's hash, they can actually use that to authenticate to access that folder. Make sense? Okay, great question. All right, so how are we doing on time? 20 minutes. 20 minutes, okay, good, we're doing good. All right, so let's talk about top exfiltration tactics. Now this is where I have a lot of fun 'cause we usually inherit the attackers in the phase when they're actually doing credentials dumping or they're actually scanning the network. So this is a live battle. This is when we actually get to play chess with them. They're trying to outdo us, right? And we're trying to stay undetected and outdo them. So they're trying to be 5 moves ahead, we're trying to be 10 moves ahead of them. Right? So they run these tools. We run these tools like, so have you heard of 7-Zip as a utility? Yeah. So there are several like that. So one of the key things that we do is we hunt for tools with the headers of the compression tool. So like we could do a search for 7zip.exe, But there's no good attacker that is gonna name their 7-Zip 7-Zip.exe. They name it something like svchost or something along those lines. So we run a search, a comprehensive search on all of the network for any tool, any binary running with the headers of these compression tools. We look for Rclone, third-party apps like MegaSync. This is very, very popular these days. Because they can sit there and do drag and drop for one file at a time, but these tools are there. Once they have that deep access into the network, they can use a utility like Megasync to sync all the folders that they set out to take. That's much easier for them 'cause they don't have to sit there and just wait for data transfers to happen or manually do it. I've seen people do SmartFTP tool Now the latest kind of innovation of sorts that we're seeing from the attackers is they're deploying these custom data uploaders. So let's actually see how that looks like. So this svchost in the C:\Windows folder, that is their uploader. Now the beauty of it is that it already has the SFTP server's address, the username and password, and the folder where on attacker's infrastructure where the files should get uploaded. So for the attacker, they just have to drag and drop the files to this SVC host. And then once they do that, they have all these files in their SFTP server. It's brilliant because one, if we are hunting for things like MegaSync, Rclone, SFTP, or SmartFTP, we're not detecting it because it's a brand new tool. And guess what, nobody has those signatures because if it's not detected, none of the security tools, none of the EDR, they're not recognizing this software. So that's the kind of customization that ransomware attackers do because there's a lot at stake. They get paid in multi, double-digit million dollars. One of my recent ones had a $14 million payout, and I'll share a little bit when we talk about negotiations. All right, so completing the mission. Now this is again one of my favorite parts. in the attack. So they have really deep access, they do the infiltration, they get the privileges, they do get godlike access, right? They move laterally to critical systems. And then to complete the mission, they have to understand like where are the database servers, where are the FTP servers, where are some of the other key servers. So some of these ports are for like Hypervisor, do you know what Veeam is? Veeam for like VMware backups. So they look for anything that could have backups or very critical data. So this database server ports, you probably recognize some of them, right? Like MS SQL, this is MySQL. So they scan for these ports. And when they're scanning for these ports, they find out, hey, these are the critical servers, these are the ones we wanna encrypt Make sense? Because they really wanna cripple the environment before they go ask for money. Okay? What's happening here? Anybody? This is their custom script that we usually see. What's happening here? They hate backups. They hate backups. So they're deleting these VHD files. These are virtual disk files. Actual backup files, all kinds of backups, even like volume shadow copies they wanna delete, okay? What's happening here? So check the names here. Deleting antivirus. Yep, they're disabling, yeah, deleting or deactivating antivirus. So you remember the tasklist command that they ran earlier? You know, one thing that I've actually observed them really closely on a human level, I think they're very lazy too, 'cause they could have just picked what tool that they were running and just stopped that. But they have a catch-all approach. They're like, okay, what if we did not see something in tasklist? So they delete or disable the antivirus tools, And this is basically their ransomware file, svchost, and that is basically what starts encrypting the data. So you might wonder, okay, why don't they just run it at the beginning stages? They don't do it because unlike other attacks like nation-state sponsored attacks, these things get detected pretty fast. How do they get detected? Not because like we as an industry are doing a really, really good job, but when something happens like a system is inoperable, a system is unavailable, guess what happens? People complain. People complain. And that's how, so they wanna actually get all their ducks in a row before they deploy the ransomware. And then what happens when they run this ransomware, then they leave a file on desktops which they call like a ransom note. And how does that look like? This is how it looks like. It is just, I'm giving you a fair warning, they put a lot of thought into these notes. So they kind of called themselves as the world's fastest and most stable ransomware since 2019, as if they're running a business. They actually are running a business. A lot of you might be wondering like, hey, do they actually give the decryption key if you pay them data, if you pay them money? They actually do. Depends. Mostly they do. The more organized they are, the more they comply because they don't want a reputation that they don't live up to their part of the deal. Because if one person says on Google that, hey, this Team XXX doesn't pay up, then the next victim will not pay them. So they treat it like a business. So some interesting parts here. They say, we're the oldest ransomware affiliate, nothing is more important than our reputation. If you pay, we will provide you with a decryption key and destroy the stolen data. Lots of, you know, they talk about their credentials and whatnot. This is interesting, our pen test services should be paid just like you pay the salaries of your system administrators. They're trying to connect to you on a human level, right? Let's see what else. Then they tell you like how to chat with them, so they ask you to install a Tor browser. Do you know what a Tor browser is? It's like you can access onion links, so they give you an onion link and they say, hey, this is your customized website, as if they spent a lot of time developing a website for you. Right? Your personal ID, yeah, that gives you a warm and fuzzy feeling that a hacker's created something personal for you, right? Just like any good criminal, they say, you know, if you don't go to the police or FBI, don't tell anyone that we attacked you. They're kind of doing their job, right? That's what a good criminal would do. And then they kind of explain that why contacting police or FBI is counterproductive. They kind of say something like it doesn't guarantee your files will get decrypted. I think they say something like they've never caught us. Lots of interesting stuff. By the way, you will have these slides so you can actually go read it in. Okay, so what— now this is the part that impressed me for a little bit because they kind of know about the ramifications, like the legal ramifications. Do you know what GDPR is? So it's like this, there are a lot of fines if you have to be compliant with GDPR and you lose somebody's data, you can be sued by your customers. So they're doing really, really convincing job of telling you that, hey, why it is in your best interest to go pay up. They work really, really hard. Now here's the interesting part. If you do not pay the ransom, we will attack your company again in the future. So they're giving you a lot of threats too. They're very nice, they're trying to hold your hand, they're trying to say that, hey, we're kind of like your pen testers, but then if you don't pay up, this is what we'll do. All right, so let's talk about negotiations. When do you pay? So obviously, you know, summary here is that There are 3 parts. One, if you want the decryption key and there is no other way, right? Second, if your data is stolen and you don't want it out there, right? And third, you want them to leave you alone. A lot of people know about this part about like, hey, if you want the data, you kind of have to pay. What people don't really think about is, like, hey, they're gonna keep attacking you. But again, you remember the part where I said, hey, they put a bounty of $100K on me saying that, hey, if anybody reveals Jibran's secrets, they'll pay them $100,000. So this is what security professionals live for. So if you've got good incident responders, if you've got good security professionals, So if you wanna fight them, there is, we do, we are able to save you, especially if the data is not encrypted. When we get into systems, there are 2 scenarios. One is after the fact, everything is encrypted, but more often than not these days, it's what we call pre-ransomware phase, which is we know that the first 3 phases of the attack look like a ransomware attack, And we basically spend nights, days, weekends, anything that we have, and we protect the businesses. So just don't think that game is over when an attacker gets into your network. Again, like RSS says, we are stronger together. So whatever you're going to learn here, apply it. And, you know, we will do the best as a community to fight these criminals. who are sometimes very heartless. Okay, so fair counterdemands, I'll touch on one because I do wanna leave some time for questions. For my recent one, because they had agreed on a multimillion dollar deal, I just threw in a requirement. I was negotiating with the threat actors and I said, hey, they would need to provide a full intrusion report to get their money. Any guesses what they did? They gave a 24-page report. This is how we got in, these are the passwords that we have. It's like, this is brilliant, I'm gonna ask every time. So if you happen to be in a situation, unfortunate situation that you have to pay up, you can get all of these demands fulfilled, okay? All right, apply the lessons learned from this talk. So by next week, try to create that core team who will be the stakeholders who will decide which vendors you need. Then in the first 3 months, choose the vendors with service level agreements, 'cause I will tell you when there's like a big attack, like big ransomware attack that's common between organizations, you don't get the IR firm of your choice. So you wanna have the service level agreements. with them, okay? Not only for them, but there is a ransomware negotiator company involved who actually pay the Bitcoins. So have the SLA with them as well. Test your data backups. Within 6 months, this is gonna be the most fun thing if you do this. Do a tabletop exercise not just for the executives, but for the technical staff too. 'Cause executive tabletops are more like high level and everybody takes their word for what's said. It's the technical tabletops where somebody like me leading that exercise will say, I need the firewall logs for the last 6 weeks. And they'll say, oh, by the way, it will take 7 days. And nobody has time for 7 days in an investigation. The first 72 hours are extremely, extremely critical 'cause you're battling the attackers. You can't wait for an answer. So you wanna have both kinds of— Tabletops. Okay, so this is actually if you actually are in a situation where a ransomware attack has happened, this is very important. A project manager who executes on the priorities, this is what you would want from your IR firm. Like you would want the attestation letter because you want You would want a fact sheet first of all that you can use for critical decision-making. You would want this attestation letter from third parties because if you don't have that, guess what? Your business partners may not want to connect their networks back. Okay, so that's all I have. You will have that presentation for the sections that we ran fast forward. Faster on, we can, um, you can talk here. Some acknowledgments, um, do want to thank, uh, my dad, uh, who I recently lost, uh, about a month ago, my mom, uh, my brother, uh, my sister, especially my wife, um, who took care of the kids when I was busy, um, catching the bad guys. Like I said, we do a lot of weekends and night work. And also my wife for helping me lose some 30 pounds, all of the COVID weight, so that I could fit in my suit again. My 3 kids, Zohan, Suleiman, and Azaan, love of my life. And my team at Mandiant, now part of Google Cloud, They basically helped with this presentation, especially my Central US team. If you folks are listening, they're the most passionate and compassionate people that I know who help with resolving these crimes. And last but not the least, my mentor, who's the ex-Prime Minister of Pakistan, Imran Khan. So with that, I will take some questions. Thank you. So if you have a question, you can come up to the podium or just if you're loud enough, just holler. Okay, another question. So with your experience, do you feel that it is worth to deal with ransomware, like with these bad actors, like when they're putting demands and, you know, so do you recommend that like security folks, like for example, if I'm managing a small security shop with, for my organization, is I'm capable enough to directly engage with them or do I have to consult with experts? Very good question. Excellent question. The question is, as an IT organization, should you engage with them? My advice is no, because it takes a lot of experience to negotiate with them. So you wanna have your IR firm and negotiators, professional negotiators do that, because something that they can do is leak your conversations later on too. so you can put a lot of your business at risk. You don't want that. You want professionals doing that so they say whatever they feel is controlled, whatever won't put you at risk and whatever won't bring class action lawsuits on you. Great question. Thanks for the presentation. It was very informative. So during your ransomware investigation, what is the balance between trying to be ahead of the attacker versus like air gapping your critical deployments from Whatever blast radius you already see? Like how do you strike that balance? Okay, so air gap is basically the theme that you were trying to ask for, right? I think these days it makes sense. You probably remember the days of Iron Mountain going with their trucks with the backups. Yeah, with the tapes if folks are old enough in this business. But so that's what's happening, not in the tapes, but people are saying, okay, the backup is complete, dismount. Does it make sense? Yeah. So very, very important thought there that if something is connected when attackers are attacking your network, guess what they're gonna do? They're gonna delete those backups. In fact, a lot of people think that cloud backups are— I say that, hey, once they're that deep in the environment, then they find out you have a cloud backup, guess what they're gonna do? They're gonna delete the cloud backups first. So that air gap is the way to go. Great question. Thank you. Any other questions? Do you have any practical advice, like in the beginning when you were showing how they got in, like they're using RDP to connect to the computer, uh, I guess like with a standard user you probably ideally wouldn't have RDP enabled, uh, what other like practical advice can you get like at the ground floor so they don't even get in? Administratively. So RDP actually happens mostly internally in the network once they're that deep in the environment. There is a tool, do you know what PuTTY is? So with PuTTY, if you go on PuTTY's website, there's a tool called PLink. So what attackers do is they create reverse tunnel because normally if you have your system, your computer is not directly exposed to the internet. So they can't break that, they don't even have a connection, a NAT to come into your computer. But what they do is they create a reverse tunnel and then they piggyback on that connection to connect on remote desktop. What I was mentioning earlier that we see Citrix NetScalers or VPN with single-factor authentication, that happens with— so imagine like a multi— even in a global company, they would have really, really good security in their US networks, but not so good security in maybe like some third world countries where they're operating. So what attackers do is they map out their networks where they have things like RDP open, and they come in through that network and then they make their lateral movement into the main network. So that's what I was talking about, that RDP is still open in some countries where they don't have that good level of security. Good question though. Okay, one last one and then I'm also gonna be at this booth, N6058. I'm actually doing booth duty for the next 3 hours, so if you have questions, I'll take it there too. Yeah, so what kind of encryption algorithms do attackers use to encrypt the data? Very simple. And the encryption algorithms are not— but so what I will say is, very good question. You know the difference between symmetrical and asymmetrical encryption? So they use asymmetrical, which means that there needs to be a key. So they actually hold those private keys. So you can't reverse engineer, you can't decrypt without that key. So if they used even symmetrical, then you can reverse engineer the malware, you can break apart and figure it out, but they use asymmetrical encryption and that's why we're at their mercy. That's why a lot of people pay because of that key. So with that, I will end here. Thank you, thank you, thank you for being here. I appreciate it. Thank you.