Talos Q3 2021 Report: Ransomware Dominated Incident Response Engagements
Summary
Talos reports ransomware was its most commonly observed threat in Q3 2021, followed by record levels of business email compromise. Local government was the most targeted sector, and MFA and logging gaps hindered security and incident response.
Key points
- Ransomware accounted for about 38% of observed threats. REvil and Vice Society were the only ransomware groups seen in multiple engagements.
- Business email compromise reached its highest level across Talos’s reports since late 2019; attackers sometimes bypassed MFA by using basic authentication.
- Local government was the most frequently targeted sector, ending a three-quarter run in which health care led.
- Talos observed suspected pre-ransomware activity involving tools such as Cobalt Strike, Sharphound, and remote access software; timely detection and remediation could contain incidents before encryption.
- Redline infostealer incidents involved scraping domain-controller credentials from browser caches; stolen information was observed for sale on Russian dark web forums.
- Email was the most common identified or assumed initial vector, but logging deficiencies prevented Talos from determining the initial vector in most incidents.
- Talos highlighted MFA on critical services and retaining logs as important measures for reducing risk and improving incident response.
Article Details
- Publisher
- Talos Intelligence
- Report Period
- Q3 2021
- Scope
- Cisco Talos Incident Response engagements; the article describes observations from July to October 2021.
- Sample Size
- Not disclosed
- Key Statistics
- Ransomware accounted for about 38% of all threats this quarter, compared with 46% in the previous quarter.
- REvil and Vice Society were the only ransomware groups observed in more than one engagement this quarter.
- CTIR engaged in two incidents involving Redline.
- More BEC incidents occurred this quarter than in any quarter since Talos began compiling these reports in late 2019.
- Recommendations
- Save organizational logs to make incident response engagements more efficient and effective.
- Implement multi-factor authentication on critical services wherever possible.
- Detect suspected pre-ransomware behaviors promptly and remediate quickly to help contain incidents before encryption occurs.
MITRE ATT&CK
T1003 · OS Credential DumpingOS Credential Dumping: tools such as Mimikatz were used to compromise credentials.T1021.001 · Remote Desktop ProtocolRemote Desktop Protocol was used in attempts to move laterally.T1048 · Exfiltration Over Alternative ProtocolExfiltration Over Alternative Protocol: an actor moved gigabytes of customer information via SMB to an attacker-controlled IP.T1053 · Scheduled Task/JobScheduled Task/Job: scheduled tasks were created on a compromised server.T1055 · Process InjectionProcess Injection was used to hide aspects of a malware execution chain.T1059.001 · PowerShellPowerShell was used to retrieve information about a client's Active Directory environment.T1078 · Valid AccountsValid Accounts: adversaries leveraged compromised credentials.T1083 · File and Directory DiscoveryFile and Directory Discovery: adversaries explored directory contents.T1114 · Email CollectionEmail Collection: adversaries accessed email accounts.T1219 · Remote Access ToolsRemote Access Software was found on compromised systems.T1486 · Data Encrypted for ImpactData Encrypted for Impact: REvil ransomware was deployed.T1562.001 · Disable or Modify ToolsImpair Defenses: security tools were disabled or modified.
CVE
People
Threat Actors
Malware
Contioften the most frequently observed variant from previous quarters. Many security researchers believe the Conti ransomware family is a successor to Ryuk, potentially explaining the decline in observations of RyukCryptBDCryptBDGriefGriefHiveHiveKarmaKarmaRedLinethis quarter include the Solarmarker malware, which Talos has covered extensively, as well as the Redline information-stealer, with leaked information observed being sold in Russian dark web forums.REvilCTIR helped resolve several significant ransomware events this quarter, including ones that involved the REvil ransomware leveraging a vulnerability in the Kaseya VSA software (CVE-2021-30116) against managed serviceRyukof emerging ransomware variants. This is the first quarter in which we had no observations of the Ryuk ransomware, a variant that was often the most often observed variant from previous quarters. CTIR alsoSolarMarkerOther threats observed this quarter include the Solarmarker malware, which Talos has covered extensively, as well as the Redline information-stealer, with leaked information observed being sold in Russian dark webThanosThanosVice Societyagainst managed service providers (MSPs) and their downstream customers. REvil, along with Vice Society, were the only ransomware groups observed more than once this quarter. This highlights the greater
Vendors
CiscoOnce again, ransomware was the most dominant threat observed in Cisco Talos Incident Response (CTIR) engagements this quarter.Kaseyaevents this quarter, including ones that involved the REvil ransomware leveraging a vulnerability in the Kaseya VSA software (CVE-2021-30116) against managed service providers (MSPs) and their downstream customers.
Products
0365implemented, but the adversaries were able to circumvent using “basic authentication” when logging in to 0365. This illustrates that MFA can be defeated by unsophisticated methods which make proper implementation ofCisco Duoif MFA had been enabled on critical services. All organizations should implement MFA solutions, such as Cisco Duo, wherever possible.Kaseya VSAthis quarter, including ones that involved the REvil ransomware leveraging a vulnerability in the Kaseya VSA software (CVE-2021-30116) against managed service providers (MSPs) and their downstream customers.System Center Operations Manageras TeamViewer or AnyDesk. In most cases, affected assets, such as domain controllers and System Center Operations Manager (SCOM) servers, are also a good indication of what the actor may be targeting and how they
Tools
AnyDeskas PCHunter and Process Hacker, as well as a variety of remote access tooling, such as TeamViewer or AnyDesk. In most cases, affected assets, such as domain controllers and System Center Operations Manager (SCOM)Cobalt Strikewas never deployed. The pre-ransomware behavior includes the use of red team frameworks such as Cobalt Strike and Sharphound, publicly available utilities such as PCHunter and Process Hacker, as well as a varietyMimikatzUse tools such as Mimikatz to compromise credentials in the environment.PCHunteruse of red team frameworks such as Cobalt Strike and Sharphound, publicly available utilities such as PCHunter and Process Hacker, as well as a variety of remote access tooling, such as TeamViewer or AnyDesk. InProcess Hackerframeworks such as Cobalt Strike and Sharphound, publicly available utilities such as PCHunter and Process Hacker, as well as a variety of remote access tooling, such as TeamViewer or AnyDesk. In most cases,PsExecin the use of remote access software, such as AnyDesk and TeamViewer, and command line utilities like PsExec.SharpHounddeployed. The pre-ransomware behavior includes the use of red team frameworks such as Cobalt Strike and Sharphound, publicly available utilities such as PCHunter and Process Hacker, as well as a variety of remoteTeamViewerutilities such as PCHunter and Process Hacker, as well as a variety of remote access tooling, such as TeamViewer or AnyDesk. In most cases, affected assets, such as domain controllers and System Center Operations
Countries
Industries
Entertainmentmanufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms.Financial Servicesof verticals, including manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, realFood manufacturingfinancial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms. Attackers targeted local government organizations the most often,HealthcareActors targeted a broad range of verticals, including manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, foodHeavy equipment manufacturinghealth care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms. Attackers targeted local governmentHospitalityActors targeted a broad range of verticals, including manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, foodITincluding manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate andlocal governmenttargeted a broad range of verticals, including manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, foodManufacturingActors targeted a broad range of verticals, including manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, foodNon-profitActors targeted a broad range of verticals, including manufacturing, non-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, foodreal estateservices, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms. Attackers targeted local government organizations the most often, breaking aRetailnon-profit, health care, hospitality, local government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms. AttackersTelecomsIT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms. Attackers targeted local government organizations the most often, breaking a three-quarter streak inUtilitieslocal government, financial services, IT, entertainment, retail, heavy equipment manufacturing, utilities, food manufacturing, real estate and telecoms. Attackers targeted local government organizations the