From RATs to Extorting Multibillion Companies: The Evolution of a Modern Ransomware Group
summary
Evolution from commodity RATs into a professional ransomware-as-a-service operation that is active since early 2020 and is placing at least $100 billion of revenue at risk. Campaigns move from JS worms and custom RATs into Nephilim ransomware, delivered by RDP brute force and Citrix NetScaler exploits, using Cobalt Strike beacons, Mimikatz, AD enumeration and lateral tooling, then stealing data via MEGA sync exfiltration or FTP prior to AES+RSA per-file encryption. Affiliates choose payloads (77 unique payloads, 22 certificates, 43 RSA keys), use bulletproof hosting and C2 team servers across Europe, and the model works—operations remain active and highly targeted.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:11Intro
- 7:01NEMTY- Another ad
- 9:12Victimization
- 10:12The way in
- 11:17Persistence / C&C
- 12:55Pivoting laterally
- 14:40Exfiltrate
- 15:41Impact
- 20:03Ransom
- 20:47Cobalt Strike Team Servers location
- 21:32Leakage blog
- 22:41That's almost APT-level...
- 25:07Our report
related talks
40mRansomware Threat Landscape
40mRansomware: New Recipe For An Old Dish
33mLiving with Ransomware - The New Normal in Cyber Security
37mRansomware Resilience: Holistic Defense for SOC Leaders
32mProspecting Ransomware Tech
33mThe Evolution of Ransomware - from Floppies to Droppers
52mRansomware 101: Get Smart Understanding Real Attacks
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?