{"id":16502,"date":"2019-10-04T09:20:59","date_gmt":"2019-10-04T17:20:59","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2019\/10\/04\/news-10242\/"},"modified":"2019-10-04T09:20:59","modified_gmt":"2019-10-04T17:20:59","slug":"news-10242","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2019\/10\/04\/news-10242\/","title":{"rendered":"Rolling back Ryuk Ransomware"},"content":{"rendered":"

Credit to Author: Sally Adam| Date: Fri, 04 Oct 2019 16:05:36 +0000<\/strong><\/p>\n

\n

In recent weeks SophosLabs has seen a significant spike in Ryuk ransomware. This particularly nasty threat is delivered via a sophisticated, multi-stage attack, paralyzing organizations and leaving them hostage to crippling ransoms.<\/p>\n

To understand how to stop Ryuk it\u2019s helpful to know how the attacks unfold.<\/p>\n

The actors behind Ryuk are active adversaries who combine advanced attack techniques with interactive, hands-on hacking to increase their rate of success.<\/p>\n

They typically target organizations that cannot withstand any downtime, such as newspapers, municipalities, and utilities, to increase the likelihood of payment. And speaking of payments \u2013 they\u2019re big. Often 6-figure sums payable in Bitcoin.<\/p>\n

Ryuk attacks are complex. They frequently start with an Emotet or TrickBot attack, delivered via malicious attachments in spam emails, which enables the cybercriminals to get on your network.<\/p>\n

Once there, they steal credentials and create a new admin user. With their escalated admin privileges in place, the hackers can move around your network, survey your Active Directory, and delete your backups.<\/p>\n

After removing your safety net they attempt to disable your cybersecurity products before finally releasing the Ryuk ransomware, encrypting your files and demanding huge ransom payments.<\/p>\n

\"\"<\/p>\n

Stopping Ryuk with Sophos Intercept X Advanced<\/h2>\n

Stopping Ryuk isn’t just about stopping one piece of software, it’s about stopping an active adversary and disrupting the attack chain that puts them in a position to run Ryuk. Sophos Intercept X Advanced includes a range of technologies to detect and disrupt different stages of the attack, including:<\/p>\n

    \n
  • Detecting and blocking the exploit techniques used to download and install Emotet and Trickbot (often via PowerShell or WMI), preventing the hackers from getting on your network.<\/li>\n
  • Blocking lateral movement across your network by working in real-time with Sophos XG Firewall.<\/li>\n
  • Preventing credential theft, thereby stopping unauthorized access to your systems and the escalation of admin privileges.<\/li>\n
  • Stopping the ransomware from executing by examining its “DNA\u201d with our deep learning neural network.<\/li>\n
  • Detecting and rolling-back the unauthorized encryption of files via the CryptoGuard capabilities<\/li>\n<\/ul>\n

    Watch this video to see the CryptoGuard capabilities in Intercept X stop Ryuk dead.<\/p>\n