Ransomware Trends in Q2: How Threat Intelligence Helps

If you’re anything like me, it can be a struggle to keep up with the latest ransomware news. Last quarter, it seemed like there was a new variant or high profile event every single week. Snake ransomware hits Honda. Sodinikibi ransomware hits Elexon. You get the idea; the list goes on. And on. And on.

Ransomware operators have realized that there are alternative ways of monetizing the data they have encrypted, which can also more effectively pressure companies into paying the ransom demands. This has led to the emergence of many ransomware data dump sites. This “pay or get breached” trend, when combined with a surge in new variants, makes ransomware an understandably prescient topic right now. 

Rather than add to your growing pile of woes, I wanted to focus on how we help security teams apply our data around the latest ransomware trends to their operations. From what I have been able to tell, there are three main aspects to this:

1. Inform Third-Party Risk: Identify data dumps associated with suppliers.
2. Prioritize Patching: Research associated vulnerabilities.
3. Stay on Front Foot: Identify early discussions and adverts for new variants.

The Rise of the Ransomware Exfiltration

When I set out to write this blog, I had lofty goals of listing all the ransomware variants we’ve seen in Q2 of 2020. That would be rather dull (for both reader and writer). So instead, let’s cut to the chase and focus on the juicy bit –  data exfiltration.

As I mentioned in the introduction, it’s been variants like DoppelPaymer, Sodinokibi, Nefilim, Nemty, NetWalker, and Maze that have made my ears really prick up. These variants have popularized exfiltrating data with ransomware and threatening victims with public disclosure if the ransom is not paid. 

Our intelligence team has been tracking when the related websites name specific companies, which indicates they are likely to have been a victim of the related ransomware variants. 

1. Identify Data Dumps Associated with Suppliers

As you can see in the chart above, Digital Shadows (now ReliaQuest) tracks a large number of ransomware dump sites. Unsurprisingly, the security teams we work with need this visibility to understand if their suppliers have been referenced on any of these ransomware blogs. You can see an example of these alerts below.

Almost 80% of the Digital Shadows (now ReliaQuest)’ intelligence tippers are associated with just three ransomware data dump blogs – DoppelPaymer, Sodinokibi, and Maze.

DoppelPaymer. Active since 2019. It shares most of its code with the “BitPaymer” ransomware variant, which is operated by the cybercriminal group known as Indrik Spider (which is also associated with the “Dridex” banking trojan). Associated victims are posted on the Doppel Leaks blog.

Maze. The Maze ransomware is a variant of the previously named ChaCha ransomware, but it was only in November that they began receiving substantial attention and earning a reputation. The group is known for impersonating government entities in spearphishing emails to spread the Maze payload. Associated victims are posted on the “Maze News” blog (although Maze has also since partnered with variants like Ragnar)

Sodinokibi. While the Maze ransomware group went some way to establishing this trend, Sodinokibi created additional improvements that may put them ahead of the game. On 15 May 2020, the Sodinokibi group made a post on Happy Blog, the dark web site used to leak victims’ data, titled “Press release #1”. The “press release” essentially called out two victims who had settled on a ransom, then turned around and hired security teams to recover the files without paying the ransom. The group not only called the victims out, but stated all negotiations were null and void; the ransom demands doubled to USD $15 million and USD $42 million respectively. The group posted three press releases within the week addressing law firm Grubman, Shire, Meiselas, & Sacks, and stated they obtained stolen data from them that involved President Donald Trump. The group threatened to release the data on the president if a payment was not made.

On 02 Jun 2020, the Sodinokibi group made a post on Happy Blog announcing a new auctioning feature on their page. The group stated they did not want to lose out on profit when victims refused to pay and would be auctioning off the data in smaller pieces at a time to replenish some of the funds they would have made if the victim’s paid. On 26 Jun 2020, the group posted the full data dump from Grubman, Shire, Meiselas, & Sacks on the auction page with a starting price of USD $21 million, which was the original negotiated ransom payment. Beginning 02 Jul 2020, the group started posting portions of the law firm’s files  on the auction page, giving buyers the choice to buy all available data for one client of the firm. The client list included singers, professional sports players, record labels, and producers. Sodinokibi stated that data on President Donald Trump would be one of the last released, as it will be the most expensive. The group claimed they would release portions of data weekly on the auction page, indicating more files from the law firm would be posted in the immediate future. Each post maintained a “blitz” price that a single user could pay to automatically win the auction and procure the data. The group acknowledged this scenario would allow the law firm’s clients to purchase their own data to prevent it from being released or used for malicious purposes.

In addition to press releases and an auction page, the Sodinokibi group, or users representing them, have repeatedly initiated posts on cybercriminal markets, advertising opportunities for partnerships with the group. The Sodinokibi group may have followed in the Maze groups’ footsteps in creating a data leak site, but they have quickly made creative changes likely in an attempt to remain prevalent as a threat, stand out from other ransomware groups, and maintain financial success. 

2. Research Associated Vulnerabilities

As well as understanding which suppliers have been referenced on these blogs, another form of actionable intelligence is to understand the vulnerabilities associated with different variants. We’ve written before about some of the top vulnerabilities exploited, but there are some specific vulnerabilities that researchers have tied to variants. (This is not an exhaustive list of exploited vulnerabilities, as many will also be delivered via various exploit kits).

CVE-2014-6287 (Lucifer) 

CVE-2015-1701  (NetWalker) 

CVE-2017-021  (NetWalker) 

CVE-2017-10271 (Lucifer) 

CVE-2017-0144 (Lucifer) 

CVE-2017-0145 (Lucifer)

CVE-2017-8464 (Lucifer)

CVE-2017-9791 (Lucifer) 

CVE-2018-1000861 (Lucifer) 

CVE-2018-20062 (Lucifer) 

CVE-2018-7600 (Lucifer) 

CVE-2018-8174 (Maze)

CVE-2018-8453  (Sodinokibi) 

CVE-2019-11510 (Maze)

CVE-2019-19781 (Maze)

CVE-2019-1458  (NetWalker) 

CVE-2019-2725 (Sodinokibi) 

CVE-2019-9081 (Lucifer) 

CVE-2020-0796  (NetWalker) 

It’s not uncommon to see these CVEs mentioned across criminal forums, as shown below. Understanding how often these appear in criminal discussions and combining this with other factors gives security teams useful context on the patches to prioritize. 

3. Identify Early Discussions and Advertisements on Criminal Forums

Finally, for those teams seeking earlier intelligence about new and upcoming variants, it’s possible to identify adverts across criminal forums. Two examples of this are shown below: Nemty ransomware in August 2019, and Thanos ransomware in February 2020. These posts often provide details on the variant itself, and the types of partnership models they are offering. Tracking these conversations can give an idea of the emerging popularity of a given variant.

Access Search Light (now ReliaQuest GreyMatter Digital Risk Protection)’s intelligence on ransomware trends

Tracking ransomware trends can be daunting, and it’s easy to get buried in a deluge of information. By highlighting specific use cases, you can focus on gaining actionable insights from ransomware trends.

If you’re a Digital Shadows (now ReliaQuest) client, you’ll be able to use this search term to set up alerts on new instances of data dumps on ransomware sites: ransomware dumps. If not – no problem. Just sign up for demo request to explore yourself.