Full Report
The ransomware name on the ransom note doesn't tell the full story. See how RaaS affiliates drive initial access, persistence, and exfiltration and what defenders should watch for.
Analysis Summary
# Tool/Technique: RaaS Affiliate Tradecraft (General Ecosystem)
## Overview
This report summarizes the operational behavior of Ransomware-as-a-Service (RaaS) affiliates. The RaaS model separates the malware developers (operators) from the individuals who conduct the actual intrusion (affiliates). Consequently, the ransomware brand (e.g., Akira, Qilin) does not dictate the attack methodology; instead, the specific affiliate’s tradecraft determines the initial access, lateral movement, and exfiltration techniques used.
## Technical Details
- **Type**: Cybercrime Ecosystem / Attack Framework
- **Platform**: Multi-platform (Windows primary, Linux/ESXi variants increasing)
- **Capabilities**: Full attack lifecycle management including Initial Access, Persistence, Defense Evasion, and Exfiltration.
- **First Seen**: RaaS models emerged significantly around 2015-2016, with modern sophisticated structures (like Qilin and Akira) evolving in the early 2020s.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1133 - External Remote Services (VPN, RDP)
- T1566 - Phishing
- T1190 - Exploit Public-Facing Application
- **TA0003 - Persistence**
- T1219 - Remote Access Software (RMM)
- **TA0005 - Defense Evasion**
- T1562.009 - Impair Defenses: Safe Mode Boot
- **TA0010 - Exfiltration**
- T1020 - Automated Exfiltration
## Functionality
### Core Capabilities
- **Initial Access Brokerage (IAB)**: Purchase of pre-existing footholds to bypass early-stage effort.
- **RMM Abuse**: Utilizing legitimate Remote Monitoring and Management tools (ScreenConnect, TeamViewer, Bomgar) to maintain persistent access and execute commands.
- **Vulnerability Exploitation**: Targeting edge devices (e.g., SonicWall VPNs) to gain entry into internal networks.
### Advanced Features
- **EDR/AV Termination via Safe Mode**: Rebooting infected systems into Windows "Safe Mode" to disable security agents and Endpoint Detection and Response (EDR) tools before deploying the encryptor.
- **Diversified Infrastructure**: Affiliates (like Scattered Spider) use varied intrusion styles regardless of the ransomware payload used.
## Indicators of Compromise
- **File Names**: Legitimate RMM binaries (e.g., `ScreenConnect.Client.exe`, `TeamViewer.exe`) in unusual directories.
- **Network Indicators**:
- Unauthorized connections to remote support domains (e.g., `[.]screenconnect[.]com`, `[.]bomgar[.]com`).
- Connections to known VPN vulnerabilities (defanged: `hXXps://[VPN_IP]/cgi-bin/`).
- **Behavioral Indicators**:
- Execution of `bcdedit` to modify boot configuration for Safe Mode.
- Massive data transfers via tools like Rclone or MegaSync prior to encryption.
- Enabling RDP via MSSQL or SMB commands.
## Associated Threat Actors
- **RaaS Operators**: Akira, Qilin, LockBit.
- **Affiliates/Groups**: Scattered Spider, Moonstone Sleet, Devman.
## Detection Methods
- **Behavioral Detection**: Monitoring for unauthorized usage of RMM tools in environments where they are not standard.
- **Process Monitoring**: Alerting on commands that modify boot configuration data (e.g., `bcdedit /set {default} safeboot minimal`).
- **Anomaly Detection**: Identifying spikes in outbound traffic to cloud storage providers (exfiltration indicators).
## Mitigation Strategies
- **MFA Implementation**: Enforce Multi-Factor Authentication on all remote access points (VPNs, RDP, RMM).
- **Vulnerability Management**: Prioritize patching edge appliances (firewalls, VPN gateways).
- **Tool Whitelisting**: Restrict the execution of RMM tools to only those sanctioned by the IT department via AppLocker or similar solutions.
- **Audit RDP**: Disable RDP on systems where it is not required and restrict it to VPN-only access.
## Related Tools/Techniques
- **RMM Tools**: ScreenConnect, TeamViewer, AnyDesk, Bomgar.
- **Exfiltration Tools**: Rclone, WinSCP.
- **Initial Access**: Phishing, Help-desk scams (Social Engineering).