Threat video1:00
SI-CERT Targeted Ransomware Analysis: Detection & IOCs
SI-CERT first documented targeted ransomware in 2021: access, backup wipe, then extortion. Includes 9 detection rules, 7 IOCs and a free Splunk SPL rule.
Read the full threat intel for SI-CERT Targeted Ransomware Analysis: Detection & IOCs →
Chapters
- 0:00The hookFive stages of targeted ransomware attacks.
- 0:04The storyAttacks shifted to targeted operations.
- 0:10Attack pathAttackers target organizations able to pay ransom.
- 0:28AttributionNo threat actor is attributed.
- 0:33Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques14 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Apply the February 2020 Microsoft security update.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Five stages of targeted ransomware attacks.
0:05Attacks shifted to targeted operations.
0:07SI-CERT maps the five stages.
0:11Attackers target organizations able to pay ransom.
0:14They exploit RDP flaws and Exchange vulnerabilities.
0:18Then harvest credentials and move laterally.
0:21Steal sensitive data, destroy backups.
0:24Deploy ransomware and demand payment.
0:29No threat actor is attributed. Confidence: low.
0:33No malicious indicators were published.
0:3914 ATT&CK techniques, from initial access to impact.
0:444 steps now: Apply the February 2020 Microsoft security update.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.