The vast majority of ransomware attacks target a region or demographic, but there are some that are strategically selected to do the most damage and make the largest profit. Extortionists go through great effort to penetrate a business, and the ransom demands for these Advanced Ransomware Threats (ARTs) far exceed those for a typical attack.
The goal of the ART is to hold your most valuable assets for ransom and ensure that copies of the data are not available for restoration. The ART can be broken down into six phases.
Reconnaissance
This process begins with reconnaissance. The attacker reviews information on the company. They might start by enumerating all the employees mentioned on the company website and then crawl the Internet for email addresses @companyemail.com. This might provide them with forum posts, blog comments, site registrations, and other information on employees. Attackers also search social media for people who work at the company. Attackers retrieve job postings, press releases, and company reports. They build a dossier on key employees and organizational processes from the information they gathered. This may also include contractors, partners, and other third parties that interface with the target company.
Penetration
In the penetration phase, attackers launch spear phishing or whaling attacks on individuals in the business. The attacker’s knowledge of employees enables them to craft an email that sounds legitimate, referring to people and services the target knows or routinely engages with. They construct a malicious payload designed specifically designed to circumvent controls based on their analysis of technical data gathered in the previous stage.
The attacker is just trying to establish a foothold at this point. High-value targets are best, but ARTs can accomplish their objectives by exploiting other individuals as well. The attacker’s malicious code allows access to one or more machines once targets fall for the phish.
Fortification
Attackers hide evidence of their entry, establish redundant methods of accessing the device, and methods to reinfect components in the fortification stage. They may also protect the acquired asset from other attacks so that another hacker does not target the same machine and inadvertently call attention to their activities.