In response to the Kaseya ransomware attack Ryan Chapman, SANS Certified Instructor Candidate, speaks on identifying the attack affiliate, navigating the aftermath of the attack, possible future cybercriminal activity, and the importance congress must place in drafting legislation curbing ransomware.
1. Why will identifying the origin of the attack be increasingly difficult?
Identifying the origin of a ransomware attack can be easy or difficult, depending on your viewpoint. To begin, we know an affiliate of the REvil Gang perpetrated the attack. In most ransomware cases these days, the groups are brazen about announcing who they are. This is a boisterous game of "WE DID THIS!" rather than a silent, hiding in the shadow’s thing. In that regard, the matter of finger-pointing to the overall association involved is simple.
A more complicated matter is that of identifying the actual affiliate who carried out the attack. With the Kaseya attack, a key matter of importance is identifying the initial access broker (IAB). Ransomware attacks are carried out by various teams, each of whom plays a specific role in the attack. In this case, initial access was gained via the exploitation of a "0-day" vulnerability.
The Kaseya case is an ongoing incident, and we as a threat intelligence community do not yet know what affiliates of REvil might be responsible for the attack. The possibility exists that events may unfold in certain forums involving one side or the other providing more information to the public. For that matter, ransomware operators and their affiliates have in the past disagreed to the point of instituting courtroom-like hearings. We won't know what to expect until more time has passed.
2. How can Kaseya best navigate the aftermath of the attack?
The best way for Kaseya to navigate the aftermath of this attack is for them to be as transparent as possible. The firm is currently working around the clock, and their dedication to updates on the matter shows. Kaseya's CEO, Fred Voccola, recently addressed the Kaseya community on July 5, 2021.
While the company has been working hard to respond to the incident, the community at large still has questions that will need to be answered. An organization named DIVD CSIRT has stated that they notified Kaseya of multiple vulnerabilities earlier in April of this year. We in the community would absolutely love additional information from Kaseya on this - if the company had pre-knowledge of vulnerabilities leveraged in the attack, they might have been working on a fix. Patching is not an easy task, especially with a system as complicated as theirs.
Some people will scream, "they had 90 days!" while others recognize that timelines don't always play out so easily. We could also learn that the vulnerabilities disclosed to them in April weren’t even involved here, at which point bashing the company over current theories is just silly.
3. What are the far-reaching implications of the attack and how it could be leveraged for future cybercriminal activity?
This latest REvil ransomware attack involving Kaseya is not "new." Sure, the vulnerability exploited was new, but otherwise, things are reminiscent of what we've seen in the past. The overarching goal was simple: attack a vendor platform capable of granting access to additional targets (your MSPs, MSSPs, etc.).
While various implications loom, my fear is that this method of attacking those with visibility and access to numerous companies will increase. The attack vector isn't new, but it could become more enticing given the visibility this incident has in the public eye. I'm also worried about the $70MUSD price tag for a universal decryptor. That price may not sound legitimate at first. But for the companies who were hit with $5m/$10m ransoms, banding together to minimize individual company payment may eventually seem like a good idea. And that's what worries me; we could experience a greater push for companies to band together to support the enemy.
4. Why is incorporating feedback from ransomware negotiators and cyber professionals prior to drafting legislation aimed at curbing ransomware so important?
Any form of legislation dealing with ransomware could have a major impact on organizations and security professionals. To better understand those impacts, Congress should do their best to engage everyone who is involved with ransomware. The business, financial, reputation, personal, and other impacts of ransomware are different for everyone involved, and we need to recognize that when making broad policy decisions. Those involved can include victim organizations, incident responders, legal counsel, insurance companies, negotiators, and more, all of whom are be impacted differently by ransomware. Changing how they deal with an attack through legislation must take their experiences into account as not doing do could increase the impact of an attack rather than mitigate it. We also have to understand how threat actors might react to legislation like changing tactics that might make it more difficult to handle an attack. The true impact of any potential legislation can only be known once each and every one of the general roles involved has been probed for feedback.
The popular topic of discussion these days involves making ransom payments illegal. Let's keep these country agnostics for now -- Taking that as an example, what is the governing body behind the legislation going to do to ease the burden of not having payment as an option? Many organizations who pay a ransom do so because they feel they have no other choice. Sure, some organizations perform a cost analysis and thus determine that paying the ransomware will be "less expensive" to them. Yet many organizations feel as though not paying the ransom will force them into extinction. I believe that these types of decisions should be reviewed, and a system of ethics must be applied. If that system is utilitarian in nature, that could mean that organizations begin to willingly break the law to work with ransomware actors. Why might they do so? Where is the money *really* going when a ransom is paid? What if such legislation leads to the next level of extortion? Would Ransomware Group X dare exfiltrate data, encrypt the network, receive payment to destroy data plus decrypt the network (at least promise to do so), only to then later return with the threat of making public the fact that the organization paid them? Then what? The push to draft, impose, and enforce legislation concerning ransomware is growing. I just hope that those involved do a thorough job of getting feedback on the true implications should a given piece of legislation become reality.
.png "SANS DFIR FOR478 Survey logo")
