How to detect and defend against REvil ransomware

With news breaking daily about ransomware attacks, the most recent attack on a major global meat-producer shocked the cybsersecurity world. As one of the biggest REvil attacks, the meat-producer in question has slowly resumed operations after a weekend attack but experts feel that the vulnerabilities exposed by this attack are far from over. In fact reports also suggest that REvil is one of the most popular ransowmares targeting India and the APAC region at large. Sophos threat researchers have done a deep dive into the tactics, techniques and procedures (TTPs) of REvil attackers.

Sophos researchers report on how to detect and defend against REvil ransomware when no two attacks are the same

REvil, also known as Sodinokibi, is a mature and widely used ransomware-as-a-service (RaaS) offering. Criminal customers can lease the ransomware from the developers, adding their own targeting and deployment of the ransomware to victim computers. The approach and impact of an attack involving REvil ransomware is therefore highly variable, depending on the tools, behaviors, resources, and skills of the adversary leasing the malware.

In a new article, “Relentless REvil, Revealed: RaaS As Variable As the Criminals Who Use It,” Sophos researchers from SophosLabs and the Sophos Rapid Response team detail the tools and behaviors they have seen adversaries use most often to implement a REvil attack. The aim of the research is to arm defenders with actionable insight they can use to spot an impending or unfolding REvil ransomware attack and protect their organizations.

REvil ransomware attack tools and behaviors that Sophos researchers have seen include:

· Breaking-in through brute-force attacks against known internet-facing services like VPNs, remote desktop protocol (RDP), desktop remote management tools like VNC, and even some cloud-based management systems; abusing credentials obtained through malware or phishing; or simply by adding the payload to other malware that’s already on the target's network

· Credential harvesting and privilege escalation using Mimikatz to obtain the credentials of a Domain admin

· Laying the groundwork for the release of the ransomware by disabling or deleting back-ups, attempting to disable security technologies and identifying target machines for encryption

· Uploading large volumes of data for exfiltration – although Sophos researchers have only seen this in around half of the REvil/Sodonokibi incidents they’ve investigated. In cases that included data theft, roughly three-quarters used Mega.nz as a (temporary) repository for the stolen data

· Rebooting the computer into Safe Mode before data encryption in order to bypass endpoint protection tools

The article also includes a look under the hood of REvil ransomware, from its composition to how it behaves when executed.

Andrew Brandt, Principal Researcher, Sophos, said: “For a common, everyday ransomware that’s been around for a few years, REvil/Sodinokibi manages to do considerable damage and command multi-million-dollar ransom payments. Its success may be due in part to the fact that, as a ransomware-as-a-service offering, every attack is different. This can make it hard for defenders to know the warning signs to look out for.

“The adversaries deploying REvil ransomware can be very hands-on and persistent, according to the findings of Sophos Rapid Response. In one recent REvil attack investigated by the team, the data collected from a compromised server showed approximately 35,000 failed login attempts taking place over a five-minute period, originating from 349 unique IP addresses around the world. It is also worth noting that the ransomware landscape has not only become increasingly complex, but increasingly crowded. In at least two REvil attacks seen by Sophos researchers, the initial point of access was something that had been left behind from an earlier ransomware attack by another adversary.

“Fortunately, there are things defenders can do to protect their organizations, networks and endpoints. The ideal is to prevent the attackers from gaining access to the network in the first place. That may not always be possible, so effective detection is a must. If you can detect the presence of an intruder at an early stage, you can stop the attack from unfolding further.”

To learn more about REvil/Sodinokibi ransomware attacks and how to defend against them, see the article on SophosLabs Uncut.

If you would like to speak to one of our experts about REvil ransomware or any other ransomware-related topic, please get in touch.

Mr. Andrew Brandt, Principal Researcher, Sophos