Ransomware tied to attacks on critical infrastructure last year

Varying tactics, same goal

The most notable takeaway from this year's report, Milam said, is how easy these attacks have become to continually execute. The bar of entry to leverage ransomware as a service (RaaS) and exploit toolkits for someone who isn't even knowledgeable is decreasing, he said, and it may only require $120.

"You don't have to set up your infrastructure; you don't have to hide. You don't have to do anything," he said. "You can just ride on the back of something else that's already built. It's like a one-stop shop."

Lately, Milam said the way ransomware groups operate mimics the corporate world. However, each one employed an array of tactics.

REvil utilized phishing campaigns, brute-force attacks and software vulnerabilities, according to the report, while DarkSide targeted machines running both Windows and Linux. Though many ransomware groups use double extortion techniques to pressure victims into paying, Avaddon also subjected victims to a "distributed denial of service attack until the ransom is paid."

The Conti variant, which is provided a "saleable service," was even more risky because it "can be altered from one infection to another."

"Many analysts regard Conti as the ransomware that replaced Ryuk and consider it to be one of the most troubling ransomware threats in the wild," the report said.

Another tactic widely employed in ransomware attacks is the use of stolen Cobalt Strike penetration testing tools. One issue Milam pointed out is that only pen testers can buy it, not researchers, which he said puts them at a disservice to better understand the software. It's been successful in attacks against enterprises, he said, because it's well done.

"A lot of the stuff executes in memory so when you look at it, if you don't have a really good map defense or multiple layers within memory detection, it's able to execute; and it's not just that, you execute Powershell from memory [too]," he said. "I think we as defenders need to continue to make that more robust."

Additionally, Milam said the RaaS business model is making it harder and harder to attribute attacks. Now, he said, nation-states may be continually outsourcing different things, with an increase in contracting independent ransomware operators.

"The mission of most threat actors today is to exfiltrate data and launch ransomware for profit," the report said.

Protecting critical infrastructure

The report cited several factors that make protecting critical infrastructure, like gas, power and water, increasingly more difficult. For one, they are high-value targets. They are also "older and inherently vulnerable," with legacy operating systems that may not have been designed to receive security updates through the internet.

"Since these environments can be difficult and expensive to modernize, they typically run older and usually unsupported operating systems," the report said.

Critical infrastructure organizations not only have to protect against old threats, but upcoming ones as well. According to the report, "an entire field known as adversarial learning has emerged as a threat to all products employing predictive algorithms."

While Milam said BlackBerry has not observed attacks in the wild yet, there probably are attacks that they haven't heard about yet.

When it comes to security, "anything less than around-the-clock monitoring is not sufficient," according to the report, but "prevention is key."

"The ability to recover from backups does not address the double extortion tactic derived from attackers threatening to sell stolen data," the report said.

While it is a challenging environment to secure, the situation is not hopeless, according to the report.

One positive highlighted is recent law enforcement action, which BlackBerry said has had some effect on the ransomware landscape.

"Law enforcement efforts to track down malware operators visibly increased after the attack on Colonial Pipeline, which likewise prompted DarkSide to shut down operations," the report said.