The recent incident involving a ransomware affiliate and their attempt to evade security measures has shed light on the evolving tactics employed by cybercriminals. This particular case, as detailed by Huntress, showcases a unique strategy that ultimately backfired, providing valuable insights into the cat-and-mouse game between attackers and defenders.
The Akira affiliate's initial breach involved a credential spraying attack, exploiting a SonicWall SSL VPN with no multifactor authentication (MFA) in place. This allowed them to gain initial access and enumerate Active Directory (AD) resources, a common playbook in Akira attacks. The threat actor then proceeded to steal files and transfer them to cloud storage, a classic double extortion tactic where data is stolen before encryption, ensuring the victim's data is compromised regardless of whether they pay the ransom.
However, the real intrigue lies in the affiliate's attempt to evade detection and security tools. In a deviation from the typical Akira strategy, the attacker initiated a reboot into Safe Mode with Networking using msconfig.exe, a technique listed by MITRE ATT&CK as 'Impair Defences: Safe Mode Boot'. This move was intended to disable third-party services and security tools, including the Huntress agent and Defender real-time protection, essentially blindsiding the security controls.
What happened next was both surprising and insightful. The Safe Mode environment, with its stripped-down configuration and limited virtual memory, interfered with the ransomware's detonation process. The Akira process tree starved for virtual memory, resulting in 'Out of Virtual Memory' pop-ups and PowerShell hard errors, preventing the encryption process from completing. This fortunate outcome for the victim was a result of the attacker's own mistake, as the Safe Mode environment inadvertently prevented the encryption it was intended to enable.
This incident highlights the importance of understanding the intricacies of security tools and the potential countermeasures employed by attackers. While the Safe Mode technique may have blinded security controls, it also inadvertently protected the victim's data. This outcome serves as a reminder that security professionals must stay vigilant and adapt their strategies to counter evolving threats.
Looking ahead, Huntress emphasizes the need for organizations to fortify their defenses. They recommend blocking credential spray attacks, deploying MFA on VPN accounts, and monitoring for Safe Mode-related boot configuration changes. Additionally, organizations should prioritize EDR deployment, SIEM integration, and log monitoring to detect early signs of compromise. By adopting a proactive approach and staying informed about emerging attack vectors, security teams can better prepare for and mitigate the impact of ransomware attacks.
In conclusion, this incident underscores the dynamic nature of cybersecurity and the importance of continuous learning and adaptation. As attackers devise new methods to evade detection, defenders must remain agile and innovative in their response. The battle against ransomware is far from over, and the lessons learned from these incidents can help organizations strengthen their defenses and safeguard their critical assets.
