Multifaceted Extortion: Analysis of Data Exfiltration TTPs Used by Ransomware Threat Actors
21SANS Ransomware Summit 2022
Speaker: Kunal Shandil, Senior Forensics and Incident Response Consultant, CrowdStrike
Ransomware attacks are one of the biggest challenges for a lot of organizations. Threat actors have graduated to multifaceted extortion tactics to maximize their probability of making money. Threat Actors give their victims additional incentives to pay the ransom to avoid the leak or auction of the exfiltrated data. As per reports from multiple Security vendors, over 80% of ransomware attacks involve the theft of corporate data in addition to file encryption. Threat actors use various techniques to perform exfiltration. This talk will cover the different tools like 7zip, MegaSync, Megatools, FileZilla, rlcone used by Threat Actors for Data Staging and Data Exfiltration. I will share different Network and Host Forensics artefacts generated by these tools that can help Blue Teamers to answer the most critical questions asked by Management and Legal Counsels: 1) When the data was exfiltrated? 2) How much data was exfiltrated ? 3) What data was exfiltrated? 4) From where (systems) the data was exfiltrated?
View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE