Cybercriminal Underground Networks Respond to Ransomware Activity After Colonial Pipeline Attack

Cybercriminal Underground Networks Respond to Ransomware Activity After Colonial Pipeline Attack

On May 7, 2021, Colonial Pipeline suffered a ransomware attack that led to systems being suspended for several days. The incident underscored the severity of modern-day ransomware attacks and how such attacks affect the general public's lives and critical infrastructure. In response to the incident, the United States (US) federal government worked quickly to enact legislation that assists US-based organizations affected by a cyber attack, including an executive order improving national cybersecurity. On the other hand, threat actors in cybercriminal underground networks also responded to the attack, with some forums banning ransomware discussion and ransomware operators banning attacks on critical infrastructure.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Ensure antivirus and intrusion detection software is up-to-date with all patches and rule sets
• Segment critical network resources using zero-trust configurations
• Maintain regularly scheduled backup routines, including off-site storage and integrity checks
• Limit file egress by size and type
• Disable macros whenever possible
• Avoid opening unsolicited attachments and never click suspicious links
• Enable 2-factor authentication for all of your organizational accounts
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• Reach out to your ZeroFOX account manager or [email protected] if you need help setting up monitoring, configuration or want more information about the associated website

Details

The threat of ransomware in today's cyber threat landscape makes it critical for organizations to take proper precautions to prevent attacks on their systems. Throughout 2020 and into 2021, ransomware continually matured into a severe threat to organizations and individuals through sophisticated infection vectors and double extortion tactics. Many ransomware groups emerged during this period where they operated data leak sites to expose their victims and threatened to release their data if ransom demands were not met within a specific timeframe. ZeroFOX observed a total of 36 ransom-and-leak operations dating back to as early as May 2019.

The DarkSide ransomware attack on Colonial Pipeline demonstrated how a ransomware attack could affect civilians and the federal government, especially in maintaining critical infrastructure. In the aftermath of the attack, the US government took action to draft legislation that centers around improving national cybersecurity. Such actions include enacting cybersecurity policies, leveraging threat intelligence, conducting incident response, and securing older systems and government infrastructure.

The prevalence of double extortion tactics and evasive malware attack chains made it so that ransomware operations became a trending topic among cybercriminal underground marketplaces due to the lucrative appeal. Despite some ransomware groups operating their websites via dark web networks, some groups engaged with cybercriminal forums and platforms to advertise their operations and recruit other actors to join their affiliate programs.

ZeroFOX monitors many cybercriminal communities and advertisements for affiliate programs. An example of a ransomware affiliate program was observed by ZeroFOX when Babuk ransomware operators posted an advertisement on a Russian-speaking forum (Figure 1) recruiting members to join their affiliate program in March 2021. The operators were looking for members to join their three different ransomware products.

Figure 1: Russian-language post of Babuk ransomware affiliate program (Note: translated from Russian)

After the Colonial Pipeline attack, some cybercrime marketplace networks banned any or all ransomware-related posts and advertisements, and some ransomware operators updated their affiliate programs to forbid affiliate members from targeting critical infrastructure. ZeroFOX Research recorded a number of examples where ransomware groups and cybercriminal forum administrators disclosed restrictions on ransomware-related activity.

On May 13, 2021, the REvil ransomware group (also known as Sodinokibi) published a thread on a cybercriminal underground network notifying members that a DarkSide ransomware member disclosed that the team lost access to the DarkSide leak site, payment server, and Denial of Service (DOS) servers after the Colonial Pipeline attack. The REvil member then discussed that affiliate members were forbidden from targeting government, healthcare, and educational institutions. Figure 2 is a screenshot of the Revil thread.

Figure 2: REvil actor announces ban on affiliates targeting government, healthcare, and education organizations after DarkSide attack (Note: translated from Russian)

One day after REvil's post, website administrators on a popular Russian-language forum opened a thread prohibiting discussion of all ransomware sales, advertisements, and affiliate programs. While it may be possible that some threat actors have concerns over repercussions for engaging with prohibited ransomware posts, the primary reason for the ban is to prevent further attention to these cybercriminal marketplace networks. These networks often include security researchers and law enforcement monitoring networks for threat intelligence and potential takedown opportunities, and threat actors are aware of their presence on such networks. The administrators Figure 3 is a screenshot of the original post translated from Russian to English.

Figure 3: Forum administrator prohibits ransomware discussions (Note: translated from Russian)

Indeed, major ransomware groups operating affiliate programs are working to adapt to the new realities for their presence in key underground forums. ZeroFOX observed an actor representing the Avaddon ransomware group recently attempt to open a new thread for recruiting penetration testers, but a forum administrator quickly removed it in line with the new ban. Despite initial concerns from some actors, posts advertising network access sales continue without disruption, and ransomware actors are showing their ongoing interest in this activity with positive reactions, such as “LockBitSupp” in Figure 4.

Figure 4: LockBit actor noting positive reaction to recent network access sale (Note: translated from Russian)

Conversely, the new restrictions have not prevented some ransomware groups from conducting activities. Groups like Conti and Avaddon ransomware continue operations at a higher rate even without regard to target industries. Figure 5 is a chart displaying a list of ransomware groups that participate in data leak exposures via double extortion schemes collected by ZeroFOX. Conti ransomware takes the lead with the highest volume of infections followed by Avaddon ransomware. REvil and DarkSide follow with the third and fourth highest data leak rates. However, this volume is likely to change due to the recent bans put in place by underground forum administrators and ransomware operators.

Figure 5: Volume of ransomware data leak targets from February 1, 2021, to June1, 2021

The massive attention that DarkSide ransomware received for the Colonial Pipeline attack signals a shift towards a targeted effort to thwart ransomware attacks. However, it is currently unclear if these efforts will result in fewer ransomware attacks. Although the bans put in place by administrators in cybercriminal underground networks may decrease the volume of ransomware-related activity, it does not guarantee that all ransomware-related activities will cease. For example, posts regarding network access sales are likely to continue as long as the advertisement does not mention ransomware. Furthermore, ransomware data leak websites will continue operations, but to avoid repercussions like that of DarkSide, these groups are likely to specify prohibited industry targets. Only time will tell if these actions will prompt lasting results.