Huntress Recaps Ransomware, Persistence and Evasion Tactics Seen in 2020
Summary
Huntress’s 2020 retrospective describes a shift toward high-value ransomware targets, data theft and double extortion, stealthier persistence, and changing defense-evasion techniques.
Key points
- Huntress reported ransomware campaigns shifting from managed service providers toward higher-value targets, including large companies and healthcare organizations.
- Attackers increasingly delayed encryption while exploring systems and stealing data, enabling double extortion threats alongside file encryption.
- Some ransomware operators targeted backup servers to undermine recovery.
- Attackers used scheduled tasks, services and startup shortcuts for persistence, sometimes adding obfuscation such as a batch file launched through VBScript.
- Huntress described TrickBot’s TrickBoot functionality as inspecting UEFI/BIOS firmware and potentially enabling firmware-level persistence when write access was available.
- Defense-evasion methods included hiding in trusted processes, using legitimate applications to run malicious scripts, and disabling security software.
Article Details
- Topic
- 2020 hacker tradecraft trends, including ransomware operations, double extortion, persistence, and defense evasion