In the first major battle of the America Civil War at Bull Run, nearby residents gathered on the hill overlooking where that battle was to take place with picnic baskets and opera glasses to witness the battle and cheer their side to victory. They ended up fleeing in terror. For those without any military experience, a military battle must certainly seem chaotic and perhaps even haphazard as soldiers fight one another with apparent disorder. Yet, untold preparation goes into an initial attack and the strategies that govern these exchanges which can be broken down into distinct stages of operation.  

Ransomware is Highly Structured 

A ransomware attack is no different than a military one.  While ransomware attacks may have randomly been implemented early on, today’s ransomware assaults are not a hit-or-miss operation. These assaults are highly organized and have a recognizable structure to them that separates them from other types of malware attacks.  Just as an effective Incident Response plan can be broken down into seven steps, there are seven distinct phases of a ransomware attack. These stages make up what is referred to as the ransomware kill chain. In fact, phases are so well defined today that they can be prepackaged into Ransomware-as-a-service business models.   

Good News/Bad News 

It is this attention to detail and design that makes ransomware so effective.  Ransomware is big business for cybercriminal gangs.  These notorious organizations not only recruit some of the top cyber talent in the industry, but they also hire project managers to lead these attacks to maximize their return on investment. It’s no wonder that ransomware is considered the biggest threat facing CISOs in 2022. But while the organized structure of ransomware contributes to its robust nature, there is some good news in all of this. Each defined stage of ransomware provides an opportunity to detect an attack and eradicate it. You just need to understand how each stage operates and have the tools at hand to combat the threat. While these stages may be worded differently according to different analyzation models, the phases are basically the same. 

Stage 1 – Delivery 

The beginning is the point of entry in which the initial batch of malicious code is delivered.  This usually comes in the form of a phishing attack that coaxes an unsuspecting user to click on a malicious link or infected attachment. Other delivery mechanisms come in the form of exploiting unpatched systems or RDP connections as well as web deployment from malicious or compromised websites. Like most infections, it is easiest to stop an attack at the very beginning before the malware has had time to establish a beachhead. In addition to the necessary security tool set, it is the delivery stage where reputable and regular employee training employees concerning cyber hygiene practices can pay big dividends as most malware relies on some form of human action. 

Stage 2 – Payload Install 

Rarely is the actual malware installed upon a single click. This code that initially infiltrates only serves to create a communication link to the command-and-control center of the attacker. It then serves as a type of Trojan that downloads the payload containing the ransomware. It can also be used to push other types of malware as well.  Endpoint protection and patch management play critical roles in stopping the payload from installing. 

Stage 3 – Reconnaissance  

A military force today utilizes satellites, drones, scouts, and even spies to gather information on the enemy.  It is during the reconnaissance phase that the attackers attempt to learn as much as they can about your enterprise. They will scout out your datastores to identify high-value data to target. They seek control of highly privileged user accounts that will not only provide them access to these data stores but give them the power to modify permissions if necessary. They also go about assessing your security systems and backup operations. This is where file and permissions monitoring play a key role in identifying suspicious behavior prior to the attack itself. 

Stage 4 – Exfiltration 

Ransomware gangs no longer rely on file encryption alone to garner a payday. You could even say that a ransomware attack is just another data breach methodology.  Stealing the data and uploading it to a third-party site controlled by the attackers is a natural part of ransomware attacks today.  Active monitoring and detection coupled with an attention to the principle of least privilege practices are essential to protect your files from being compromised during this phase. 

Stage 5 – Encryption 

This is where the dreaded process begins.  It’s here where your data becomes transformed into its inaccessible form. There are two approaches to the encryption phase.  One is to encrypt everything as quickly as possible.  The other is a slow burn in which files are encrypted in slow order over time to escape detection. The key here is containment, which can be achieved through network segmentation and internal firewall zones. Automated detection and response systems can also terminate the encryption process before it has a chance to complete. Too often, IT teams rely on their disaster recovery solution in these circumstances, but DR is not suited to recovery from ransomware. 

Stage 6 – The Ransom 

Unfortunately, organizations don’t come to realize they have been victimized by a ransomware attack until the serving of the ransom note. At this point, it’s too late. Even if an organization’s backup systems have remained intact, restoring the encrypted data to its natural productive state doesn’t help recover the exfiltrated data. What’s more, the data restoration process can take days to complete, meaning that the organization cannot perform its critical business functions. 

Stage 7 -Remediation 

It’s always more difficult to clean up a mess at the very end.  Remediation cannot even begin until the IT team can confirm that the malicious code has been completely eradicated and all command-and-control links have been terminated. This requires an advanced tool set that most SMBs don’t have in-house.  The earlier you can remediate an attack, the better. 

Conclusion 

To protect yourself against a highly structured attack, you need a well-designed cybersecurity strategy.  You must be familiar with the latest ransomware methodologies and understand how these attacks are implemented into distinct phases and know where they are the most susceptible themselves. Because cybersecurity is a moving target, you also must be adaptable to counter new attack methodologies as well.  Just as is the case for an army, the key to victory is to know your enemy.