Combating Ransomware With NDR – How to Respond If You’ve Been Hit

Over the past few years, ransomware has become an increasingly prevalent issue and a highly profitable criminal activity. There are many strains of ransomware malware including the 2017 WannaCry, Ryuk, Cerber, Cryptolocker, and many more. Targeted businesses frequently think that paying the ransom is the most economical method to get their data returned; regrettably, this may also be the case.

The issue is that every company that pays to have its files recovered is directly contributing to the creation of the next iteration of this cyber threat. As a result, it keeps getting more advanced, with more specialized variations and targeted ransomware attacks. The costs also keep going up. It’s estimated that by 2021, ransomware attacks will cost the world economy $6 trillion yearly. Protecting your company’s data is more important than ever. In this article, you will learn how to combat ransomware with NDR and how to respond if you have been hit.

Understanding the anatomy of a ransomware attack—that is, the typical order of events and the actions that organizations should take for a responsible and efficient response—helps with planning for and responding to such assaults. The steps of an attack and a defense are described below:

1. Reconnaissance: To find and steal sensitive information, reconnaissance is a crucial step. Attackers would have access to specific information during a proper recon. In this way, penetration testing in information security uses reconnaissance. An attacker utilizes recon to communicate with the network’s open ports, active services, etc. to gather information without actively using the network. Accessing networks outside of the internet can be made easier with the information it offers. In essence, reconnaissance is a gold mine of important information that is vulnerable to intrusion.
2. Initial access: An organization’s systems are accessible after the initial attack. This can be done using phishing, zero-day vulnerabilities, or other techniques that result in one or more individuals unintentionally installing malware. Clicking on email attachments or links given by unidentified sources is a frequent occurrence. The organization has now been compromised, regardless of how the attack was initiated.
3. Persistence: At this point, new processes are being started, the malware is installed, and the infection process is just getting started. Some processes could appear to be normal, but they’re being launched from odd places in the file structure. The ransomware alters the configuration and hijacks the code to maintain a firm foundation in the system.
4. Lateral movement/collection: Once an attacker has gained access to an organization, they start to become more active and knowledgeable about the larger digital estate. They will use this method to locate and access the files that they will later try to exfiltrate and encrypt. It starts with reconnaissance, scanning the network, compiling a list of its devices, and locating the most valuable assets.
   The attacker then starts to move laterally. They spread their infection to new devices and attempt to elevate their privileges, such as by getting admin credentials, to gain more control over the environment. They can go on to the final stages of the attack once they have gained control and presence within the digital estate.
5. Command and control: at this stage, your computer is fully controlled by an attacker. To store stolen data or execute harmful commands, C&C servers act as the headquarters or command centers where malware is connected to targeted attack reports back. A crucial step for attackers to move laterally within a network is to establish C&C communications.
6. Impact: Once the virus has finished its search and disabled operation, it will start the encryption process, first encrypting local data before moving on to network shares. The network data is copied, encrypted, and then uploaded back to the sharing location of the original document.

Network Detection and Response (NDR) assists in locating and eliminating evasive network attacks that are difficult to counteract using well-known attack patterns or signatures. The NDR systems use machine learning and data analytics to identify cyber threats on corporate networks. By continuously examining network east-west lateral traffic as well as north-south traffic that crosses the corporate perimeter, these tools create models of typical activity. They then use these models to find unusual or suspicious traffic patterns. The NDR uncovers the following types of threats.

• Unknown malware: External attackers who manage hosts on your network by installing undetectable malware 
• Targeted attacks: External attackers who penetrate applications or endpoints, acquire legitimate user credentials, establish command and control, move laterally, or steal, alter, or delete data via social engineering, exploits, brute force attacks, or other means.
• Insider attacks: Employees or contractors involved in a variety of actions, including; accessing, stealing, manipulating, and changing access rights for files and data, as well as installing malware and other forms of malware.
• Risky behavior: Sharing user accounts, giving unauthorized individuals access to confidential information, allowing remote access to endpoints, and other actions are examples of risky behavior.