Full Report
Huntress analyzes ransomware activity, uncovering attack patterns and key detection opportunities while dispelling ransomware myths.
Analysis Summary
# Tool/Technique: Manual Ransomware Deployment (Human-Operated)
## Overview
This technique refers to the manual phase of a ransomware attack where a human threat actor, rather than an automated self-spreading worm, orchestrates the movement, staging, and execution of the ransomware binary. This dispels the myth that ransomware typically "embeds itself" or "spreads" autonomously; instead, it highlights the critical "middle" steps of an attack chain where an actor uses legitimate tools and stolen credentials to prepare the environment for final encryption.
## Technical Details
- **Type:** Technique / Procedure
- **Platform:** Primarily Windows (End-points and Servers)
- **Capabilities:** Lateral movement, file staging, defense evasion, and manual execution.
- **First Seen:** Continuous (Observed in recent incidents involving RaaS affiliates).
## MITRE ATT&CK Mapping
- **[TA0008 - Lateral Movement]**
- **[T1021.001 - Remote Services: Remote Desktop Protocol]** Use of RDP to move between systems.
- **[TA0009 - Collection]**
- **[T1074.001 - Data Staging: Local Data Staging]** Moving ransomware binaries to folders like `C:\Temp` or `C:\Users\Public`.
- **[TA0002 - Execution]**
- **[T1204.002 - User Execution: Malicious File]** Manual execution of the binary by the actor via CLI or GUI.
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]** Manually disabling EDR/Antivirus before deployment.
## Functionality
### Core Capabilities
- **Staging:** Threat actors manually copy ransomware executables to specific local directories (e.g., `C:\Windows`, `C:\ProgramData`).
- **Lateral Movement:** Utilizing stolen credentials to access neighboring systems via RDP or SMB.
- **Manual Launching:** Using the command line (CMD/PowerShell) or double-clicking the file within an RDP session to initiate encryption.
### Advanced Features
- **Affiliate Customization:** As seen in RaaS (Ransomware-as-a-Service) models like Akira or INC Ransom, different affiliates use unique deployment scripts or "LOLBins" (Living off the Land Binaries) to blend in with administrative activity.
- **Anti-Recovery Operations:** Manual deletion of Volume Shadow Copies (VSS) using `vssadmin.exe` prior to executing the ransomware.
## Indicators of Compromise
- **File Names:** Vary by actor, but often staged as `svchost.exe`, `update.exe`, or random strings in temporary directories.
- **Registry Keys:** Changes to `HKLM\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection` (Disabling monitoring).
- **Behavioral Indicators:**
- Multiple successful RDP logins followed immediately by file transfers to `C:\Temp`.
- Execution of `vssadmin.exe delete shadows /all /quiet`.
- Sudden spikes in file rename/write operations across network shares.
## Associated Threat Actors
- **Akira Affiliates**
- **INC Ransom Group**
- **BlackCat (ALPHV) Affiliates**
- **ReadText34 Operators**
## Detection Methods
- **Behavioral Detection:** Monitor for "Living off the Land" activity where administrative tools (like RDP or PowerShell) are used to move non-standard executables into system folders.
- **Anomalous Login Detection:** Flagging RDP sessions that occur outside of standard business hours or from internal IPs that do not typically perform administrative tasks.
- **Process Tree Analysis:** Identifying instances where a browser or remote access tool spawns a command shell that then executes an unknown binary.
## Mitigation Strategies
- **Network Segmentation:** Limit lateral movement by restricting RDP and SMB traffic between workstations.
- **Least Privilege:** Implement Restricted Admin mode for RDP and ensure administrative credentials are not cached on low-security endpoints.
- **Hardening:** Disable or password-protect the ability to stop EDR/Antivirus services to prevent manual disabling by the actor.
## Related Tools/Techniques
- **[LOLBins]** (Use of `certutil.exe` or `bitsadmin.exe` to download the ransomware).
- **[Ransomware-as-a-Service (RaaS)]** (The business model driving these manual deployment techniques).
- **[Data Exfiltration]** (The step usually performed manually just before the deployment of the ransomware).