RMM-ber this ransomware. [Research Saturday]

The episode begins with an introduction to the importance of cyber threat intelligence, emphasizing the value of connecting insights across incidents to see common patterns. Ismail Valenzuela from Arctic Wolf discusses their focus on tracking a ransomware operation called Anubis, highlighting that the threat is part of a broader pattern of organized cybercriminal activity. The discussion underscores the importance of understanding attack chains and behaviors to better defend against evolving threats.

This section details what Anubis is: a ransomware service operation that evolved from a rebranded version of Sphinx in 2024. It's a multi-platform, affiliate-based ecosystem targeting Windows, Linux, and cryptors, with over 80 victims reported. Arctic Wolf emphasizes that Anubis is not a single entity but a network of affiliates using similar tools and tactics to deploy ransomware, akin to a coordinated business model, which complicates attribution and response.

The episode explains two primary attack vectors used by Anubis affiliates: exploiting pre-authenticated vulnerabilities in Citrix Netscaler appliances and stealing VPN credentials. A notable detection detail is the use of VPS hosting providers in VPN activity, which signifies malicious actors operating from data centers rather than residential IPs. The attackers predominantly use legitimate IT tools—such as RDP, PsExec, and remote management software—making their actions harder to detect and classify as malicious.

Valenzuela describes a detailed attack sequence: attackers gain initial access, often through stolen credentials or vulnerabilities, then move laterally within networks to high-value targets like domain controllers and backup systems. They use common, legitimate tools like SMB, FTP, SSH, and tunnel setups for persistence and data exfiltration. The process is highly resilient, with attackers pivoting when certain methods are blocked, revealing a well-rehearsed playbook approach.

The attackers heavily rely on legitimate administration and remote management tools—such as ScreenConnect, Zoho Assist, and Mesh Agent—rather than custom malware. This approach helps them blend into normal activity, making detection difficult. The discussion emphasizes that the use of such 'living off the land' techniques is a common tactic to evade traditional security measures and emphasizes the importance of contextual analysis in detection efforts.

The research illustrates how quickly attackers can operate once inside a network, targeting critical systems like Active Directory databases and moving at machine speed to encrypt or exfiltrate data. Credential theft is crucial, focusing on key systems and backup infrastructure. Attackers aim for impact—financially or operationally—by swiftly compromising essential assets, often before organizations can respond effectively.

Valenzuela stresses the importance of a layered security approach—'defense in depth'—including proper network segmentation, least privilege principles, continuous monitoring, and understanding what normal activity looks like within an environment. Early detection involves correlating seemingly benign activities to identify malicious patterns. Organizations are urged to assess vulnerabilities proactively and recognize that the most effective defense combines architecture, monitoring, and response.

The episode concludes with the insight that reliance on legitimate, simple tools for malicious activity is likely to persist, making continuous vigilance necessary. Attackers are characterized as lazy—if a tactic works, it will be reused—and organizations must adapt by maintaining consistent monitoring and refining detection capabilities. The overarching message is to focus on early detection and building a resilient security posture as the best way to disrupt attacks before they escalate to ransomware deployment.