Full Report
We take a look back at some of the more interesting — and innovative — hacker tradecraft we saw over the course of 2020.
Analysis Summary
Based on the technical details provided in the article regarding 2020 tradecraft trends, here is the summary of the primary technique and strategic shift observed.
# Tool/Technique: Double Extortion Ransomware (Big-Game Hunting)
## Overview
Double Extortion is an evolution of traditional ransomware tradecraft. Instead of immediately encrypting files, attackers focus on "Big-Game Hunting," targeting high-value victims (Fortune 500, Healthcare) and maintaining prolonged persistence to exfiltrate sensitive data before triggering encryption. This provides the attacker leverage to demand two payments: one for the decryption key and another to prevent the public release or sale of stolen data.
## Technical Details
- **Type**: Technique / Attack Strategy
- **Platform**: Cross-platform (specifically targeting enterprise servers and backup infrastructure)
- **Capabilities**: Data exfiltration, credential harvesting, backup destruction, and wide-scale encryption.
- **First Seen**: While ransomware is older, the "Double Extortion" trend and shift to "Big-Game Hunting" peaked in 2020.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1053.005 - Scheduled Task/Job: Scheduled Task]** (Used to maintain access while poking around).
- **[TA0007 - Discovery]**
- **[T1083 - File and Directory Discovery]** (Identifying high-value data and backup locations).
- **[TA0010 - Exfiltration]**
- **[T1041 - Exfiltration Over C2 Channel]** (Stealing data before encryption).
- **[TA0040 - Impact]**
- **[T1486 - Data Encrypted for Impact]** (The final stage of the attack).
- **[T1490 - Inhibit System Recovery]** (Targeting and deleting backups).
## Functionality
### Core Capabilities
- **Delayed Encryption**: Adversaries no longer encrypt "within minutes." They maintain a foothold for days or weeks to perform reconnaissance.
- **Enumeration**: Probing the network to identify the most sensitive data and determine the victim's financial capacity to pay.
- **Data Exfiltration**: Extracting copies of sensitive files to a remote server controlled by the attacker.
### Advanced Features
- **Backup Neutralization**: Attackers specifically hunt for backup servers and storage to delete or encrypt them, removing the victim's ability to restore systems without paying.
- **Information Leak Sites**: Use of dedicated "shame sites" to publish snippets of stolen data as proof of theft.
## Indicators of Compromise
*Note: As this is a technique summary, specific hashes vary by variant (e.g., REvil, Conti, Maze), but behavioral indicators remain consistent.*
- **Network Indicators**:
- Connections to known file-sharing sites (e.g., `mega[.]nz`) or specialized C2 infrastructure for large-scale data transfer.
- **Behavioral Indicators**:
- Unusual volume of outbound data transfer (Exfiltration).
- Use of administrative tools like `AdFind`, `Advanced IP Scanner`, or `Rclone`.
- Attempts to disable Volume Shadow Copies (`vssadmin.exe delete shadows /all /quiet`).
## Associated Threat Actors
- **REvil (Sodinokibi)**
- **Maze**
- **Conti**
- **Ryuk**
## Detection Methods
- **Behavioral Detection**: Monitoring for the deletion of Volume Shadow Copies and mass file renaming/encryption activities.
- **Exfiltration Monitoring**: Alerting on large amounts of data leaving the network to unusual destinations or outside of business hours.
- **EDR/AV**: Detection of common lateral movement tools (e.g., Cobalt Strike beacons, PowerShell Empire) used during the "poking around" phase.
## Mitigation Strategies
- **Offline Backups**: Maintain immutable or "air-gapped" backups that cannot be reached or deleted from the primary network.
- **Least Privilege**: Restrict administrative access to prevent attackers from easily discovering and wiping backup repositories.
- **Segmentation**: Separate sensitive data environments from general user environments to slow down lateral movement.
## Related Tools/Techniques
- **RMM Tool Exploitation**: Using Managed Service Provider tools to deploy ransomware.
- **Living off the Land (LotL)**: Using native Windows tools to perform reconnaissance and move laterally without triggering traditional signature-based alerts.