Ransomware 101: Get Smart Understanding Real Attacks
summary
Walkthrough of a real incident shows a phishing HTML that mounts an ISO with an on-screen password and delivers Qakbot infection via HTML->ISO with password, attackers escalate by dumping lsass memory then cracking offline — LSASS memory dump → Mimikatz offline — and deploy Cobalt Strike, AnyDesk/Splashtop and reverse RDP tunnels (Plink) to move laterally — Cobalt Strike and reverse RDP via Plink. Data exfiltration uses customized uploaders (SVC_host) to attacker SFTP, backups and VSS are deleted, negotiations yield multi‑million payouts (example $14M) and even a 24‑page intrusion report; containment often takes days to weeks — custom SVC_host uploader to SFTP.
AI-written summary · about
chapters (15)
- 0:00RSAConference 2023
- 3:30It hits home
- 5:33Impact is Huge
- 7:12Attack Lifecycle
- 8:39Top Infiltration Tactics
- 17:47Establishing Foothold tactics
- 19:36Escalate Privileges Tactics
- 20:46Evolution of Attaining Credentials Tactics
- 30:04Top Exfiltration Tactics
- 32:10Custom Data Uploader
- 33:54Hunt for Critical Systems
- 35:12Stopping Security Services
- 40:29Payment Considerations
- 42:26Fair Counter Demands
- 44:38In an event of Ransomware attack, follow these guidelines for War Room
related talks
32mSurviving a Ransomware Attack - Lessons from the Field
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
40mRansomware: New Recipe For An Old Dish
52mRansomware; The Real Pandemic
42mStart Covering Your Bases And Stop Chasing APT Headlines
37mRansomware Resilience: Holistic Defense for SOC Leaders
40mRansomware Threat Landscape
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?