Is Your SOC/DFIR Team Ready?

Hey there, folks! It’s an exciting time to be in Bay Area where the pulse of innovation never slows down, especially around cyber security and health care. Cybersecurity, in particular, is always buzzing with activity. Though the topic du jour is Ransomware, a pesky and persistent cyber threat landscape. You remember the LockBit ransomware gang, right?

In February, there was a major win for law enforcement as they disrupted the LockBit operations, seized their infrastructure and website. It was a high-five moment indeed! But, as it turns out, the win was short-lived – it looks like we celebrated too soon. The leading members of the gang remained untouched and, unsurprisingly, rebounded within at matter of days.

Brace yourselves for the unfortunate news: there’s been a surge in LockBit activity. What’s worse, the gang is now equipped with updated encryption tools, directing victims to new servers. If you’re getting a déjà vu sensation, it’s because this isn’t the first time we’ve seen such a thing happen. It’s reminiscent of when ransomware groups like GandCrab was dismantled, only for REvil to rise from the ashes, likely wielding GandCrab’s source code.

So, who’s LockBit, you ask? They’re a cybercriminal organization that has mastery over ransomware and what’s known as advanced persistent threat (APT) capabilities. They work like a business (a twisted one), selling their horrible tools and infrastructure to affiliates who then launch attacks. Their primary target? Windows systems. But they’re not picky – Linux and MacOS can also fall victim to their vicious plots.

To give you an idea of the scale of their crime, the LockBit group has siphoned off more than $120 million from their numerous high-profile victims. Yes – you heard that right: $120 million!

After the temporary setback in February, the LockBit gang has renewed their attacks with updated encryptors and ransom notes. The wave of inactivity that we saw after the takedown was brief. According to a research study, the LockBit operations have sprung back to life, threatening the cyber world with their criminal audacity.

According to the researchers, the latest variant of LockBit, dubbed as 4.0, comes with a few changes. It doesn’t alter desktop wallpaper, its decryption process is slower, and it won’t self-delete after encryption. It’s an intriguing turn of events – a constant reminder of why cybersecurity vigilance is so critical.

LockBit’s MO focuses on Windows mainly, but they aren’t above targeting Linux and MacOS systems. To understand this relentless ransomware group and stay one step ahead, it’s crucial that we learn their tactics, techniques, and procedures (TTPs). As for the LockBit infection, it’s still a significant threat, and organizations everywhere should prepare for potential attacks.

At this point, you might be wondering how you can defend against such a threat. How can we counter zero-day exploits and advanced malware that can evade traditional security checks? The answer to that lies in real-time malware analysis and innovative cybersecurity solutions.

The fight against cyber threats is intricate and sophisticated, and I’m confident that together, we will rise to the challenge. Remember – we’re stronger when we work and learn together, especially here in the vibrant tech heartland of San Francisco Bay Area! Stay safe, folks! We’ve got this.

by Morgan Phisher | HEAL Security