By Ben Smith, Field Chief Technology Officer, NetWitness
Vulnerability is a four-letter word in the world of cybersecurity, as one leading business application vendor learned the hard way in May. The company’s managed file transfer (MFT) software, MOVEit, experienced a sizable attack orchestrated by the Russian ransomware group, CL0P.
According to the victimized company, the gap in security had the potential to allow unauthorized users access and privileges to the software, and the supply chain attack against MOVEit impacted many of its own downstream customers, including other companies in the payroll services and identity theft verticals, as well as several government agencies. In recent years, supply chain attacks have become more prevalent as threat actors have evolved to extract even more value from personal data, especially when 80% of companies disrupted by ransomware wound up paying the ransom. This is a profitable exercise, because after all, cybercrime is a business and has its own business models.
The Business of Cybercrime
When you think about cybercrime, you really should think of it like you would any other business. CL0P is best known as a “ransomware-as-a-service” provider, helping other threat actors create and deploy their own ransomware campaigns. The end goal is almost always money, and in MOVEit’s case, CL0P sought an undisclosed amount of money to prevent the distribution of the victim organization’s private data. And like any growing business, CL0P has diversified its offerings to include complementary capabilities such as access to a dedicated botnet as well as direct access to compromised networks as a means to mint future victims (and revenue).
Every action a threat actor like CL0P carries out is intentional, including widely publicizing and threatening the potential disclosure of the sensitive information it now controls through its ransomware capability. The group’s intention is to create additional urgency in the hopes of forcing the affected company to act quickly or suffer further embarrassment or even operational impact as more details are released.
Mitigating Ransomware Attacks
It’s no easy feat to protect a supply chain against determined threat actors who own a growing toolbox of potential weapons, including ransomware. These threat actors may even work harder than vendors to identify and leverage zero-day vulnerabilities, because your data is their payday. In a sense, companies need to take a cue from groups like CL0P and understand how these cybercrime enterprises operate.
Since most attackers rely heavily on their own supply chains, one of the best defenses is to seek, understand, and document potential bottlenecks in these adversarial supply chains – this information represents low-hanging fruit where you (or the managed security provider who protects you) can gain the biggest bang for the buck. For example, how does a typical ransomware attack arrive into a victim’s environment? How does an infected laptop communicate back to the threat actor with its status? How does a threat actor ultimately monetize its efforts? These are all questions that may be addressed with skill sets on your extended team like threat intelligence and incident response, and technology solutions such as network-based threat detection and response. To disrupt this chain, one needs to hone in on the adversary’s business model and use it against them, much as we see in the martial art of jiu-jitsu.
Unfortunately for many companies, the approach after a ransomware attack is to focus on the primary vulnerability, remedy it, and then go back to business as usual. In the case of MOVEit, there were new and previously unannounced vulnerabilities still being announced more than six weeks after the first vulnerability’s public announcement. It’s critical that affected companies remain proactive; where there is one vulnerability, there are frequently others.
While companies should move forward with improved security measures to enhance the documentation, monitoring and protection of their own supply chains, enlisting external help is almost always a suitable option. Not only can these externally-based defenders help respond to or even prevent ransomware attacks, they may also be explicitly involved in the takedown of threat actors. In January 2023, the U.S. Department of Justice announced it had disrupted the actions of the ransomware-as-a-service group Hive, which had targeted more than 1,500 victims. The disruption indicates that these groups aren’t infallible, and with the right defenses and knowledgeable defenders, those adversarial supply chains can be disrupted.
The State of Cybersecurity
Threat actors are constantly active and evolving, and we are all definitely hearing about more and more ransomware attacks today. As security measures become more advanced and third-party defenders help reduce vulnerabilities, one would hope that the volume of these attacks should be dwindling. It’s true that bad actors are on the rise, but it’s also true that current disclosure requirements may be driving a lot of the activity we see in the news today. An attack which might have been quietly handled completely out of sight of the public and the government a few years ago is much more visible today.
Despite all of these challenges – adversaries working with one another through their supply chains, using evolving tools and techniques in an effort to crack open your own supply chain at a weak point – there is still reason to be optimistic. While preventing these types of attacks is always preferred, mature organizations today recognize that prompt and timely detection of these attacks may be even more important. You want to know where “patient zero” is within your environment, and to be able to take action early in a ransomware attack, before it spreads and spirals out of control. After all, if you can’t see what’s happening on your network, if you can’t see what’s happening on your endpoints, you may not see the attack until it’s too late. Don’t be afraid to ask for help.
About the Author
Ben Smith is Field Chief Technology Officer with NetWitness. He brings more than 25 years’ experience in the information security, risk management, networking and telecommunications industries; his prior employers include RSA Security, UUNET, and the US Government, along with several technology startups. Smith holds industry certifications in information security (CCISO, CISSP), risk management (CRISC), and privacy (CIPT); he is an acknowledged contributor to NIST SP 1800-1, -3, and -7 and he chairs the Cybersecurity Canon Project. He is a patent holder, a published contributor of four of the “97 Things Every Information Security Professional Should Know” [O’Reilly, 2021] and previously served as a corporate representative to the National Cybersecurity Center of Excellence (NCCoE). Ben can be reached online at https://www.linkedin.com/in/bnsmth/ and at our company website https://www.netwitness.com/.
