The Dever Ransomware Experience

I commend researchers in this field. Ransomware has a tangible impact on lives, particularly in cases involving healthcare facilities, for instance. Such criminals deserve harsh response for the chaos they create.

Also, I can’t help but thinking that the global internet that we’ve created is highly irresponsible. That criminals with sufficient skill and means can anonymously pull off these kinds of crimes with little chance for pursuing justice is indication of some fundamental flaw in the internet’s design. While people should have the right to be anonymous, there’s simply too much potential for abuse by such criminals. I wonder if the internet is ripe for disruption via redesign of core protocols. As I recall, this has been discussed on hn previously but I’ve lost track of such research..

Fantastic write-up, I really enjoyed all of the details on how the forensics are done for these cases. Certainly a good reminder to make frequent air-gapped backups of any mission-critical machines on the network. And even with those, as the author points out, rebuild time and effort could be horrible.

Steve Gibson has been heavily covering the increase in ransomeware on his excellent podcast Security Now. From SN I’ve learned some interesting points, including that Ransomeware-as-a-Service is now definitely a thing. There have been a few major operations which hand out ransomeware packages to unethical hackers in exchange for a % of the Bitcoin they collect.

I can only see ransomeware becoming more and more of a problem in the future, though I certainly hope I’m wrong.

I had a similar incident at my home lab:

- I had Windows Server 2016 with few Hyper-V VMs running

- RDP was exposed to the Internet

I remember I was working on that computer, and the screen got locked, like someone pressed Win+L. So, I logged in and saw the folder on my desktop called, if remember correctly "Process Explorer 2" or something similar. The screen got locked on me again after a few seconds. I immediately realized the computer got infected. But after a few minutes, I had a very important meeting and only came back to investigate after about 3 hours.

Results:

- most of the files on the computer were encrypted. But files, which were in use (should I say "locked"?) - stayed. For example, VM disk images stayed unencrypted (but not metadata). That's how I saved one VM, which was somewhat important for me.

- I had Synology NAS with btrfs connected via SMB to that Windows Server and few folders got encrypted. But because I have daily snapshots - I restored that in few minutes.

After that incident, I reinstalled Windows Server (this time 2019) and started to pay more attention to the security, installed winlogbeats and found, that RDP is getting brute-forces at about 400 000 attempts / week from ~55 000 IPs. So, I installed fail2ban analog for Windows: https://github.com/DigitalRuby/IPBan and now I'm getting about 600 failed attempts/week

Here is the screenshot of how the number of RDP attempts decreased after enabling IPBan: https://hsto.org/webt/oq/q1/ir/oqq1irnzeagwsqnbfpe4gbl9f_o.j...

Fascinating article. I'm especially concerned about the browser passwords being vulnerable - how serious is this, really? I would have hoped in 2020 that Mozilla, et al would have something better than plaintext for passwords.

Also the article never really identified how the "patient zero" machine was infected in the first place. RDP brute force?

"rdp exposed to internet" - this is the biggest issue. Don't be in the DMZ with your machines! I have an openssh server running (no password but unique credentials) and need to connect to my VPN in order to interact with my machines. Everying else just asks for hackers.

Amazing article. Introduced many ransomware topics to me.

Looks like textbook security services masquerading with whats known, but I wouldnt like to say which country. Most security researchers are not wise to the offline tactics employed by the security services which here in the UK starts when you are school, your school reports, your NHS medical records, your financial transactions, the motivators of your parents, siblings, relatives and friends, along with their phenomenal resource and cutting edge knowledge which they get from University and others leading their fields. Jeez when will people wake up and realise your lives are more scripted that you can possibly imagine because your knowledge and expertise is compartmentalised in mainly one domain, possible two, but never full spectrum domain knowledge, with an element of pre-emptive action based on genetics and socioeconomic standing which helps reinforce stereotypes. The spooks do what will never get passed the ethics boards of university's because in warfare & survival there is no ethics despite the rhetoric!