{"id":34416,"date":"2020-07-13T02:49:00","date_gmt":"2020-07-13T06:49:00","guid":{"rendered":"http:\/\/blog.cybercon1.com\/?p=34416"},"modified":"2020-07-13T02:49:00","modified_gmt":"2020-07-13T06:49:00","slug":"ransomware-characteristics-and-attack-chains","status":"publish","type":"post","link":"https:\/\/www.cyberconservices.com\/index.php\/2020\/07\/13\/ransomware-characteristics-and-attack-chains\/","title":{"rendered":"Ransomware Characteristics and Attack Chains"},"content":{"rendered":"\n

MATTHEW JERZEWSKI<\/a> – Ransomware<\/strong> has been around for decades going back all the way to\u00a01989<\/a>. Since then it has only magnified in scope and complexity. Now at a time when working remotely is becoming more universal and the world is trying to overcome the Covid-19 pandemic, ransomware has never been more prominent.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Ransomware<\/strong> is a type of malware that prevents users from accessing their system or personal files and demands a \u201cransom payment\u201d in order to regain access. There are two types of campaigns for ransomware<\/strong> \u201cHuman-operated\u201d and \u201cAuto-spreading\u201d, this article focusing on the human-operated campaigns.<\/p>\n\n\n\n

Human-operated campaigns tend to have common attack patterns which include: Gaining initial access, credential theft, lateral movement and persistence. For many of the human-operated campaigns, typical access comes from RDP brute force, a vulnerable internet-facing system, or weak application settings. Once attackers have gained access they can deploy a plethora of tools to get user credentials. After gaining credentials lateral movement takes place with either deploying a widely known commercial penetration testing suite called\u00a0Cobalt Strike,<\/a>\u00a0<\/em>changing settings of the WMI (Windows Management Instrument) or abusing management tools with low-level privilege. Finally, attackers want to keep a connection and make it persistent; this is done by creating new accounts, making GPO (Group Policy Object) changes, creating scheduled tasks, manipulating service registration, or by deploying shadow tools. Read On:<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

MATTHEW JERZEWSKI – Ransomware has been around for decades going back all the way to\u00a01989. Since then it has only magnified in scope and complexity. Now at a time when working remotely is becoming more universal and the world is trying to overcome the Covid-19 pandemic, ransomware has never been more prominent. Ransomware is a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[636],"tags":[637],"class_list":["post-34416","post","type-post","status-publish","format-standard","hentry","category-ransomware","tag-ransomware"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t