Resources

⁠Recently Bryce Webster-Jacobsen, Director of Intelligence Operations at GroupSense, joined Bace Cybersecurity Institute for a webinar on Cryptocurrency and Security. The webinar walked through cryptocurrencies and the promise it delivers as a secure and efficient anonymous monetary transaction.

Ransomware attacks have exploded over the past few years, and ransomware groups have reinvested their earnings into their malicious businesses.

Threat actor groups have discovered a significant opportunity within the market to provide Ransomware-as-a- Service (RaaS). Much like the Software-as-a-Service (SaaS) offerings we are all familiar with, RaaS operations have employees, customer service, and a business structure to lean on. It paves the way for inexperienced threat actors to utilize the expertise of more advanced threat groups, ultimately expanding the effects of ransomware to a broader breadth of targets.

One RaaS group, Conti, became prolific over the last several years, with attack numbers above 1,000. The ransomware group is having a pretty bad month. After aligning themselves with Putin’s invasion of Ukraine, assumed Ukrainian members took the liberty of leaking months’ worth of internal chat logs and documents, revealing their internal business structure, office politics, and pay scales. GroupSense analysts have been translating and digesting the information, corroborating the intelligence with data that they have already collected on Conti through threat investigations.

Conti

Conti has successfully targeted and impacted significant players from the financial sector to the software industry, such as the Japanese electronics supplier JVCKenwood, London-based high society jeweler Graff, and the Irish health system. Last year, GroupSense threat analysts observed Conti’s tactics, techniques, and procedures (TTPs) when the group breached a client’s network and demanded ransom.

In a recent chat log leak, GroupSense learned that Conti has upper and middle management with entry-level employees that do the leg work. The separation of roles within Conti enables the employees to focus on specific parts of the cyber kill chain. Gaining initial access to the system is the most time-consuming part of the attack. It requires reconnaissance and planning, which “initial access brokers” work on over weekends. This leg work allows for more attacks and ultimately more revenue for the ransomware group.

Conti typically deploys their ransomware through targeted spear-phishing and broader phishing campaigns that contain malicious attachments or links. The attachments serve as vessels for deploying other malware that utilizes more advanced techniques. These vessels are typically called “loaders” or “downloaders,” and they will do their best to mask the actual malware such as TrickBot, or in this case, Conti ransomware.

When our client was hit with Conti last year, they hired GroupSense for our Ransomware Negotiation Services. As part of the service, GroupSense confirms that the actor returns the decrypted data before the client pays the ransom. After providing sufficient proof that the actor returned the data, our negotiator helped our client pay the ransom. Unfortunately, the story doesn’t end here.

Conti Again?

Months later, the client’s customers started receiving phishing emails on the same thread that Conti used to communicate with the client, meaning the actor had access to the old email thread. This method, called email chain hijacking, allows the threat actor(s) to send phishing emails by replying to old email threads, which tricks victims into thinking the email is
legitimate. Access to the original email thread strongly indicates that Conti could be behind a repeat attack.

The phishing emails were riddled with typos, grammar mistakes and had other pronounced signs of phishing, including mismatched sender names and addresses with a badly spoofed email domain. Typically, when Conti uses phishing as a vector, they are careful to cover their tracks and make the email look as legitimate as possible. Email chain hijacking increases the likelihood of success for phishers. Furthermore, Conti was not known to use email chain hijacking in previous attacks. With these conflicting pieces of evidence, our analyst dove deeper to find out if the phishing attack was coming from Conti or a second and unrelated actor.

Connecting the Bots

The GroupSense analyst started an investigation to compile a list of threat actors who had
historically used the email chain hijacking technique within previous campaigns. During this investigation, the analyst identified the following groups:

• TrickBot Gang
• The newly revived Emotet
• TA 551 (Shatak)
• IcedID campaigns
• QakBot campaigns

In November 2021, the intelligence community discovered that the TrickBot Gang teamed up
with TA551 to deploy Conti ransomware. In January 2022, SANS found that Emotet had reemerged with help from the TrickBot group. In February 2022, AdvIntel discovered that the Conti group had taken over the TrickBot operations.

Knowing several roads lead back to the Conti Group, the analyst deployed the malicious link in a sandbox environment. The link downloaded several pieces of malware to the device, including the IcedID loader operated by TA 551. GroupSense assessed with high confidence that the Conti ransomware syndicate was actively targeting our client’s customer base using stolen email threads.

Below are the hashes gathered upon detonation and the IP addresses that the payload contacted.

IP Addresses:

• 208.95.112[.]1
• 23.21.43[.]186
• 54.225.179[.]233
• 82.221.103[.]243

Repeat Attacks

It’s rare for ransomware groups to attack the same target twice. Because RaaS groups run like businesses, they work on similar reputational rules as legitimate companies. If a RaaS group says they will return stolen data from their victims, they are expected to keep their word. If they return the data to the victims, they can only cash out on the data once.

In this case, Conti was trying to cash out twice on the same set of stolen data. Our analysts have not seen such a brazen attack that would damage a threat actor’s reputation before.

Wider Implications

This investigation suggests that the Conti ransomware syndicate is rapidly increasing its sophistication and standing in the initial access ecosystem. This increased sophistication means that they can hit larger, more complex systems and demand even higher ransoms in the future.

Austin, Texas & Arlington, Va. --CynergisTek (NYSE American: CTEK), leading cybersecurity, privacy, compliance, and IT audit firm helping organizations in highly regulated industries navigate emerging security and privacy issues, announces a new agreement with GroupSense to provide organizations with vital threat intelligence to identify and mitigate attacker activity. This partnership offers CynergisTek’s customer base ransomware negotiation services and provides increased capabilities around incident response (IR) training and tabletop exercises.

“In order for healthcare organizations to more successfully anticipate where cyber attackers are likely to be present, they need a clearer picture of their risk and a better understanding of their environment,” said Mac McMillan, President & CEO of CynergisTek. “Incorporating GroupSense’s capabilities into our Risk and Incident Response services enables us to assist our clients in performing better reconnaissance, thereby enhancing their resilience. Just as important as being able to anticipate the threat, so is being able to execute more precisely when adverse situations arise. Incorporating ransomware negotiation and deeper awareness into client IR immersive exercises and incident response further enhances the value of our support to our clients,” he says.

“I am excited about the launch of our partnership with CynergisTek,” said Kurtis Minder, founder and CEO of GroupSense. “Given the increased attack surface, especially in the healthcare industry, organizations need solutions, not an increase in alerts or data feeds. The combined digital risk and attack surface capability of GroupSense, with the solution expertise of CynergisTek, solves IT risk problems while reducing operational overhead.”

This partnership marks CynergisTek’s focus on building cyber resiliency by helping businesses become proactive against threats and develop effective incident response procedures. CynergisTek and GroupSense are providing customers with threat intelligence capabilities that allow for healthcare specific insight on where organizations should prioritize remediation efforts based on their specific risk profile. CynergisTek clients will have access to additional threat monitoring and foot printing capabilities that help expose unknown gaps that organizations may have with the use of GroupSense’s cyber reconnaissance platform and team of highly trained analysts.

About GroupSense

GroupSense is a digital risk protection services company that delivers customer-specific intelligence that dramatically improves enterprise cybersecurity and fraud-management operations. Unlike generic cyber-intelligence vendors, GroupSense uses a combination of automated and human reconnaissance to create finished intelligence that maps to each customer's specific digital business footprint and risk profile. This enables customers and partners to immediately use GroupSense's intelligence to reduce enterprise risk, without requiring any additional processing or management by overstretched security and fraud-prevention teams. GroupSense is based in Arlington, Va., with a growing customer base that includes large enterprises, state and municipal governments, law enforcement agencies and more.

About CynergisTek, Inc.

CynergisTek is a top-ranked cybersecurity consulting firm helping organizations in highly-regulated industries, including those in healthcare, government, and finance navigate emerging security and privacy issues. CynergisTek combines intelligence, expertise, and a distinct methodology to validate a company's security posture and ensure the team is rehearsed, prepared, and resilient against threats. Since 2004, CynergisTek has been dedicated to hiring and retaining experts who bring real-life experience and hold advanced certifications to support and educate the industry by contributing to relevant industry associations.

Original Press Release: https://www.businesswire.com/news/home/20220316005363/en

Entrepreneurship Day is back at Colorado Mesa University. Join GroupSense CEO, Kurtis Minder, as he gives the keynote on Wednesday, April 27th, 2022. 

Kelly Milan, GroupSense, will attend HIMSS with our friends at CynergisTek on Tuesday, March 15th and Wednesday, March 16th. He will give two demos on Tuesday and Wednesday in CynergisTek's booth (#4942) on Hacking and Healthcare.

Earlier this week, a Ukrainian security researcher with insights into the Conti ransomware group leaked almost two years’ worth of internal chat logs. Conti is responsible for a number of high profile ransomware attacks.

Adam Bregenzer, GroupSense's CTO, was a guest on the ModernCTO podcast. He spoke to Joel Beasley about ransomware readiness, defense, and negotiation. Below are a few of our favorite clips, as well as the full episode! 

On Wednesday, March 9th, GroupSense CEO, Kurtis Minder, will co-present "Wisconsin Under Attack: Responding to Cyber Criminals" at the 54th Annual - Wisconsin Governor's Conference on Emergency Management and Homeland Security with LTC Sarah Frater. 

Kurtis Minder, CEO of GroupSense, was a guest on Episode #209 of Task Force 7 Radio's podcast. Kurtis talked to co-host Andy Bonillo about lessons from a ransomware negotiator, why small businesses need cybersecurity resources, as well as how cyber criminals may be shifting their focus during the Russia/Ukraine conflict. Below are a few highlights from the interview.

Kurtis Minder, GroupSense CEO, will speak at a CHIME focus session with Mac McMillan, CynergisTek CEO on Monday March 7th. Kurtis and Mac will have an active discussion around the sophistication of cyberattacks affecting healthcare institutions across the country and around the globe.