Ransomware operators are increasingly employing sophisticated methods to disable endpoint detection and response (EDR) systems, disrupt Windows telemetry, and target backup services prior to initiating file encryption. This strategy aims to blind victims, reducing the likelihood of detection and impeding recovery efforts.
Recent analyses have identified ten ransomware families that frequently evade prevention measures. Notably, the Play ransomware exhibited a prevention rate of only 13%, while BlackByte followed at 25%. Other prominent families include LockBit, BabLock, Magniber, FAUST, Sodinokibi (REvil), Hive, BlackKingdom, and Maori.
Common Tactics Employed by Ransomware Operators
Security experts have observed a consistent pattern among these ransomware groups: after gaining initial access, they focus on stealth and disabling defense mechanisms. This approach facilitates lateral movement within the network and ensures the encryption process proceeds with minimal resistance.
Key tactics include:
- Terminating security, backup, and database services.
- Uninstalling or disabling protection software.
- Clearing Windows event logs to erase traces of their activities.
For instance, the BabLock ransomware has been documented using legitimate vendor uninstallers to terminate antivirus, EDR, backup, and database processes, followed by the deletion of Security and System event logs. This sequence creates a critical window where encryption can occur undetected, leaving minimal evidence for forensic analysis.
Advanced Techniques: Interfering with Windows Telemetry
Some ransomware variants, such as LockBit 5.0, have adopted more advanced methods by interfering with Event Tracing for Windows (ETW). ETW is a telemetry mechanism utilized by monitoring tools to collect system data. By modifying ETW, LockBit 5.0 causes key event-writing functions to return without recording data, effectively starving dependent security tools of vital information.
Additionally, these ransomware families employ various techniques to conceal their payloads and execution processes. Sodinokibi encrypts embedded code until runtime, Magniber executes code within other processes, and Play uses legitimate-looking names and locations to evade detection. BlackByte further complicates forensic investigations by removing execution traces and altering timestamps.
Mitigation Strategies: Strengthening Defenses
To counter these evolving threats, organizations must adopt a proactive approach to security:
- Comprehensive Testing: Regularly test security controls to ensure they can detect and block attempts to stop services, erase logs, alter telemetry functions, inject into processes, or misuse trusted system programs.
- Backup Security: Implement robust backup systems with isolated copies, separate administration from regular domain access, and conduct routine restoration tests in a clean environment.
- Preserving Evidence: Utilize centralized, tamper-resistant logging to maintain evidence even if local logs are cleared. Set up alerts for unusual service terminations, security tool uninstall attempts, and changes to telemetry functions.
- Access Control: Enforce least-privilege access and network segmentation to limit the spread of an intruder once detected.
While there is no universal ransomware playbook, the consistent use of defense-impairment tactics underscores the importance of continuous validation and enhancement of security measures. Organizations should regularly rehearse response actions to ensure preparedness against such sophisticated attacks.
As ransomware operators refine their methods to disable security defenses and backups before encryption, it is imperative for organizations to stay vigilant and adapt their security strategies accordingly. Proactive measures, including regular testing, robust backup protocols, and stringent access controls, are essential to mitigate the risks posed by these evolving threats.
