Ransomware Affiliates Use Varied Intrusion Tactics, Huntress Says
Summary
Huntress explains that RaaS affiliates use varied access and intrusion methods, so a ransomware brand alone does not reveal an attack’s path. It highlights common tactics and recommends broad monitoring and sound security fundamentals.
Key points
- RaaS operators maintain ransomware and related infrastructure, while affiliates often handle access, reconnaissance, data theft, and deployment.
- The same ransomware family can be used in intrusions with different access paths and tactics, making attribution by brand unreliable.
- Reported access methods include phishing, weak or compromised RDP credentials, vulnerable edge appliances, rogue RMM tools, and access purchased from brokers.
- A compromised Bomgar remote-support environment was used in an April campaign affecting multiple organizations.
- Attackers may maintain access with new or hidden accounts and remote-management tools, and evade defenses using exclusions or security-tool killers.
- Data staging and exfiltration methods include encrypted archives, MegaSync, RClone, S5cmd, and finger.exe.
- Huntress recommends maintaining an asset inventory, reducing attack surface, monitoring broadly, and investigating incidents without assuming the intrusion path from the ransomware brand.
Article Details
- Topic
- Ransomware-as-a-Service tradecraft and the varied intrusion methods used by affiliates
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolAffiliates use Remote Desktop Protocol for initial access and persistence.T1560.001 · Archive via UtilityAttackers compress staged data into encrypted archives using tools such as 7-Zip.T1562.001 · Disable or Modify ToolsSome attackers use Defender exclusions to evade defenses.T1567.002 · Exfiltration to Cloud StorageAttackers exfiltrate data using cloud storage tools including MegaSync and RClone.
People
Threat Actors
Malware
AkiraThe same ransomware family (whether it’s Akira, Qilin, or LockBit) can show up across very different intrusion chains.LockBitThe same ransomware family (whether it’s Akira, Qilin, or LockBit) can show up across very different intrusion chains.QilinThe same ransomware family (whether it’s Akira, Qilin, or LockBit) can show up across very different intrusion chains.
Products
AnyDeskThey may also install RMMs post-initial compromise to retain access, including Chrome Remote Desktop and AnyDesk.BomgarRogue RMMs: threat actors use RMMs like ScreenConnect, TeamViewer, or Bomgar to get into the victim’s environmentChrome Remote DesktopThey may also install RMMs post-initial compromise to retain access, including Chrome Remote Desktop and AnyDesk.DefenderSome attackers do very little to cover their tracks; others use Defender exclusions.ScreenConnectRogue RMMs: threat actors use RMMs like ScreenConnect, TeamViewer, or Bomgar to get into the victim’s environmentTeamViewerRogue RMMs: threat actors use RMMs like ScreenConnect, TeamViewer, or Bomgar to get into the victim’s environment
Tools
7-ZipRansomware actors stage data by consolidating and compressing it into encrypted archives using tools like 7-Zip.finger.exeFor the actual exfiltration of data itself, we’ve seen various techniques, including the use of cloud storage tools MegaSync, RClone, as well as S5cmd and even finger.exe.MEGAsyncFor the actual exfiltration of data itself, we’ve seen various techniques, including the use of cloud storage tools MegaSync, RClone, as well as S5cmd and even finger.exe.RCloneFor the actual exfiltration of data itself, we’ve seen various techniques, including the use of cloud storage tools MegaSync, RClone, as well as S5cmd and even finger.exe.s5cmdFor the actual exfiltration of data itself, we’ve seen various techniques, including the use of cloud storage tools MegaSync, RClone, as well as S5cmd and even finger.exe.