Full Report
The success of enterprise ransomware attacks has motivated more and more threat actors to join the game.
Analysis Summary
# Tool/Technique: Big Game Hunting (Enterprise Ransomware)
## Overview
Enterprise ransomware (often referred to as "Big Game Hunting") is a specialized attack methodology where threat actors target large organizations rather than individual users. The goal is to maximize illicit profits by paralyzing critical infrastructure and demanding massive ransoms. This approach typically involves a prolonged period of network infiltration, lateral movement, and data exfiltration before the final encryption phase.
## Technical Details
- **Type:** Attack Methodology / Malware Ecosystem
- **Platform:** Primarily Windows (Servers and Workstations), increasingly Linux/ESXi.
- **Capabilities:** Lateral movement, credential theft, data exfiltration (double extortion), security software disabling, and large-scale file encryption.
- **First Seen:** The trend accelerated significantly around 2018-2019 (e.g., Ryuk, BitPaymer).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1133 - External Remote Services
- T1566.001 - Phishing: Spearphishing Attachment
- T1566.002 - Phishing: Spearphishing Link
- **TA0002 - Execution**
- T1059.001 - PowerShell
- T1047 - Windows Management Instrumentation
- T1204 - User Execution
- **TA0003 - Persistence**
- T1547.001 - Registry Run Keys / Startup Folder
- T1053 - Scheduled Task/Job
- T1078 - Valid Accounts
- **TA0005 - Defense Evasion**
- T1553.002 - Code Signing
- T1140 - Deobfuscate/Decode Files or Information
- T1562.001 - Disable or Modify Tools
- T1070.004 - File Deletion
- T1036 - Masquerading
- T1055 - Process Injection
- **TA0006 - Credential Access**
- T1003 - OS Credential Dumping
- T1110 - Brute Force
- T1056 - Input Capture
- **TA0007 - Discovery**
- T1087 - Account Discovery
- T1482 - Domain Trust Discovery
- T1083 - File and Directory Discovery
- T1046 - Network Service Scanning
- T1135 - Network Share Discovery
- T1018 - Remote System Discovery
- **TA0008 - Lateral Movement**
- T1021.001 - Remote Desktop Protocol
- T1105 - Ingress Tool Transfer
- T1021.002 - SMB/Windows Admin Shares
- **TA0009 - Collection**
- T1005 - Data from Local System
- T1039 - Data from Network Shared Drive
- T1074 - Data Staged
- **TA0011 - Command and Control**
- T1043 - Commonly Used Port
- T1102 - Web Service
- **TA0010 - Exfiltration**
- T1002 - Data Compressed
- T1537 - Transfer Data to Cloud Account
- **TA0040 - Impact**
- T1486 - Data Encrypted for Impact
- T1490 - Inhibit System Recovery
## Functionality
### Core Capabilities
- **Propagation:** Spreading throughout the network to infect domain controllers and backup servers.
- **Data Encryption:** Using strong cryptography (RSA+AES) to lock enterprise data.
- **Inhibiting Recovery:** Deleting Volume Shadow Copies and backups to prevent restoration.
### Advanced Features
- **Double Extortion:** Exfiltrating sensitive data to "leak sites" before encryption to blackmail victims who might otherwise restore from backups.
- **EDR Evasion:** Using signed drivers (Bring Your Own Vulnerable Driver) or process hollowing to bypass security software.
- **Automated Deployment:** Using GPOs (Group Policy Objects) or WMI to push ransomware to all endpoints simultaneously.
## Indicators of Compromise
- **File Names:** `readme.txt`, `DECRYPT_INSTRUCTIONS.html`, unique encrypted extensions (e.g., `.locky`, `.crypted`).
- **Network Indicators:**
- C2 Communication: `hxxps[:]//[random-domain].com/api/v1`
- Cloud Storage: `mega[.]nz`, `rclone` configurations for exfiltration.
- **Behavioral Indicators:**
- Mass execution of `vssadmin.exe delete shadows /all /quiet`.
- Unexpected use of `AdFind.exe`, `BloodHound`, or `Advanced IP Scanner`.
- Widespread `PowerShell` scripts for service disabling.
## Associated Threat Actors
- Wizard Spider (Ryuk/Conti)
- DarkSide / BlackMatter
- REvil (Sodinokibi)
- LockBit
## Detection Methods
- **Signature-based:** Monitoring for known ransomware file headers and ransom note strings.
- **Behavioral detection:** Monitoring for rapid file renaming/encryption events and the deletion of shadow copies.
- **YARA Rules:** Target specific packers used by ransomware families (e.g., rules for Cobalt Strike beacons or specific ransomware loaders).
## Mitigation Strategies
- **Multi-Factor Authentication (MFA):** Mandatory for all external remote services (RDP, VPN).
- **Network Segmentation:** Isolating critical servers and backups from general user segments.
- **Immutable Backups:** Maintaining offline or "air-gapped" backups that cannot be encrypted or deleted by the ransomware process.
- **Hardening:** Disabling PowerShell for non-admin users and restricting RDP access.
## Related Tools/Techniques
- **Cobalt Strike / Brute Ratel:** Frameworks used for post-exploitation lateral movement.
- **Rclone:** Frequently used for automated exfiltration of data to cloud providers.
- **Mimikatz:** Used for credential harvesting to escalate privileges.