By Anthony Giandomenico, Practice Director - Digital Forensics and Incident Response at Fortinet and Aamir Lakhani Global Security strategist and researcher

Ransomware attacks have increased in volume, morphing and evolving through the years, especially recently, into the debilitating attacks we see today. According to a recent Global Threat Landscape Report from FortiGuard Labs, ransomware attacks increased sevenfold in the last half of 2020 and became even more disruptive. 

Tactics from threat actors continue to shift and defenders need to not only continue to get the “basics” of defensive strategies correct, but continuously evaluate their own organisation’s security policies to ensure they still provide adequate responses against today’s ransomware threat actors. CISOs are now faced with a harsh reality: it’s less a matter of if, but when they will be attacked. 

FortiGuard Labs research also shows that almost all areas around the world are targets. And it is important to keep in mind that no sector is safe from ransomware. With this in mind, the following steps can help your organisation effectively deal with an active ransomware attack:

• Don’t Panic: Stay calm, and begin to execute your incident response (IR) plan, if available. If you do not have an IR plan, the steps below can help. Alternatively, reach out to your security vendor for help or report the incident to your insurance company; they may already have a list of expert security providers who can help you. Many organisations will use incident response services such as the FortiGuard Responder Team. Consider the potential impact the security incident may have. Take into account not only the obviously compromised areas, such as data encryption and application removal but also additional areas of potential compromise. 
• Isolate Your Systems and Stop the Spread: There are multiple techniques for isolating the threat to stop it from spreading. First, identify the range of the attack. If the incident is already known to be widespread, implement blocks at the network level, such as isolating traffic at the switch or the firewall edge, or consider temporarily take down the internet connection. If the incident scope is confirmed to be more narrow, infecting only a few systems, isolate attackers at the device level by possibly pulling the Ethernet or disconnecting the Wi-Fi. If available, endpoint detection and response (EDR) technology can may block the attack at the process level, which would be the best immediate option with minimal business disruption. Most ransomware attackers find a vulnerability to get into your organisation such as exposed RDP, phishing emails, or another method attackers are using to gain a foothold into your environment. 
• Identify the Ransomware Variant: Many of the tactics, techniques, and procedures (TTPs) of each ransomware variant are publicly documented. Determining which strain you are dealing with can give you clues on the location of the threat and how it is spreading. Depending on the variant, some decryption tools may already be available for you to decrypt your ransomed files. 
• Identify Initial Access: Determining the initial access point, or patient zero, will help identify and close the hole in your security. Common initial access vectors are phishing, exploits on your edge services (such as Remote Desktop services), and the unauthorised use of credentials. Determining the initial point of access is sometimes difficult, and may need the expertise of digital forensics teams and IR experts..
• Identify All Infected Systems and Accounts (Scope): Identify any active malware or persistent leftovers on systems that are still communicating to the command-and-control (C2) server. Common persistence techniques include creating new processes running the malicious payload, using run registry keys, or creating new scheduled tasks.
• Determine if Data Was Exfiltrated: Oftentimes, ransomware attacks not only encrypt your files but also exfiltrate your data. They will do this to increase the chances of ransom payment by threatening to post things like proprietary or embarrassing data online. They may even contact your business partners if they identify any of their data that was stolen and threaten them as well. Look for signs of data exfiltration, such as large data transfers, on your firewall edge devices. Search for odd communications from servers going to cloud storage applications. 
• Locate Your Backups and Determine Integrity: A ransomware attack will attempt to wipe your online backups and volume shadow copies to decrease the chances of data recovery. Because of this, ensure your backup technology was not affected by the incident and is still operational. With many ransomware attacks, attackers have usually been in your network for days, if not weeks, before deciding to encrypt your files. This means that you may have backups that contain malicious payloads that you do not want to restore to a clean system. Scan your backups to determine their integrity. 
• Sanitise Systems or Create New Builds: If you feel confident in your ability to identify all of the active malware and incidents of persistence in your systems, then you may be able to save some time by not rebuilding. However, it may just be easier and safer to create new, clean systems. You may even consider building an entirely separate, clean environment that you can then migrate to. This should not take too long if you are running a virtual environment. When rebuilding or sanitising your network, ensure the appropriate security controls are installed and are following best practices to ensure devices do not become reinfected.
• Report the Incident: It’s important to report the incident. You should also determine if reporting to law enforcement is needed and required. Your legal team can help address any legal obligations around regulated data, such as PCI, HIPAA, etc. If the attack is severe, and your business spans multiple geographical regions, you may need to contact national law enforcement services instead of a local or regional-based law enforcement agency. 
• Paying the Ransom?: Law enforcement advises against paying the ransom, however, if you are considering it, you should hire a security company with specialised skills to help you. Additionally, paying the ransom is not going to remediate the vulnerabilities that the attackers exploited, so still ensure you have identified the initial access and patched the vulnerabilities. 
• Conduct a Post-Incident Review: Review your incident response to understand what went right and to document opportunities for improvement. This ensures the continuous improvement of your response and recovery capabilities for the future. Consider simulating the technical and nontechnical details of the attack in red team and table-top exercises so you can review your options. 

Preparation in Case of a Ransomware Attack

When a ransomware attack occurs, taking the right steps is essential to minimise the impact on you, your team, and your organisation. Once an attack occurs, panic can spread through the organisation and only create bigger issues. CISOs know that surviving a ransomware attack requires an incident response plan, but the challenge is time to document a full plan and having the right resources to implement when needed.