Adrian Johnson
TLDR:
- Ransomware attack by Qilin group steals VPN credentials and Chrome data
- Attackers used credential harvesting and ransomware encryption tactics
Article Summary:
The recent Qilin ransomware attack involved stealing credentials from Google Chrome browsers on compromised endpoints, marking a new twist in ransomware tactics. The attackers gained access to the network through VPN credentials without multi-factor authentication, conducting post-exploitation actions after 18 days. They used logon-based Group Policy Objects to harvest credentials and erase evidence before encrypting files and dropping ransom notes. This attack highlights the evolving trends in ransomware, with groups like Mad Liberator and Mimic using new techniques for data exfiltration and initial access. Ransomware continues to be a profitable venture for cybercriminals, with a record-breaking ransom payment of $75 million to the Dark Angels group. The ransomware landscape is shifting, with Russian-speaking threat groups dominating cryptocurrency proceeds and targeting sectors like industrials.
The article also mentions the increase in ransomware attacks targeting utilities and critical infrastructure providers, where attackers aim to maximize disruption and pressure for ransom payments. While ransomware payment events have declined year-over-year, the median ransom payment for severe strains has spiked, indicating a shift towards larger businesses and critical infrastructure providers as targets. The dismantling of major ransomware groups has led to an erosion of trust within the cybercriminal community, causing affiliates to operate independently and leading to the fragmentation of active ransomware groups.
Overall, the article emphasizes the need for continuous penetration testing, breach prevention strategies, and vigilance against evolving ransomware tactics. It highlights the importance of integrating Zero Trust Network Access (ZTNA) with existing security infrastructure, modernizing data protection strategies, and leveraging AI in threat management. With ongoing developments in the ransomware landscape, organizations need to stay informed, adapt their security measures, and collaborate with experts to mitigate cyber threats effectively.
