A beast by any other name. [Research Saturday]

Key takeaways

Ransomware groups frequently rebrand to escape law enforcement pressure, disassociate from controversial acts, or rename for strategic reasons.
The use of malicious kernel drivers like Poison X represents an escalation in ransomware attack sophistication, allowing threat actors to disable security defenses stealthily.
Techniques such as masquerading malicious tools as legitimate software (e.g., semantic.exe) and exploiting signed malicious drivers pose significant challenges for detection.
Adversaries are increasingly using legitimate tools and cloud services to blend malicious activities with normal network traffic, complicating detection efforts.
The attack speed is rising with advances in AI and automation, underscoring the importance of layered security, proactive detection, and rapid response to mitigate ransomware risks.
Maintaining good security hygiene, including access controls, multi-factor authentication, and continuous monitoring, remains crucial in defending against evolving ransomware tactics.

Summary

Introduction to Meter's Network Security Solutions

The podcast opens with an advertisement for meter, a network security platform that offers a comprehensive solution to manage and secure enterprise networks. It emphasizes the platform's ease of deployment, management, and its ability to provide detailed visibility into all network components, including wired and wireless devices, routing, switching, firewalls, DNS security, and VPNs. The key selling point is the unified platform that is secure by design, helping organizations eliminate hardware upgrade treadmill and freeing up IT resources.

Research Saturday: Focus on GD Ransomware and Its Rebranding

The episode features a discussion with Bridget O'Gorman from Symantec Threat Hunter about 'GodDamn Ransomware,' a rebrand of the Hyadina group. This group previously operated under names like Monster and Beast, adopting themes of beasts and devilish symbols to reflect their identities. The discussion explores the significance of the rebranding, suggesting it is a tactic to evade law enforcement or to distance themselves from past attacks, noting a pattern in ransomware groups to rebrand after controversial activities or law enforcement pressure.

Analysis of Ransomware Techniques and Attack Strategies

The conversation details a recent attack where the threat actors used tools like AnyDesk for remote access, credential harvesting tools, and malicious drivers such as Poison X to disable endpoint defenses. The attack methodology involves sophisticated techniques like kernel driver exploitation, using signed malicious drivers, and malware masquerading as legitimate software to evade detection. The attackers also employed lateral movement tools and persistent access mechanisms, demonstrating an escalation in the complexity and stealth of their operations.

Evasion and Defense Evasion Tactics in Modern Ransomware Attacks

The discussion highlights how threat actors evade detection by disguising malicious tools as legitimate software, exploiting signed malicious drivers like Poison X, and using legitimate processes and cloud services to blend malicious activities with normal network traffic. The use of kernel drivers with high-level access allows attackers to disable security software, making it difficult for defenders to detect and respond effectively. The tactics also include credential harvesting, lateral movement, and maintaining persistence even after reboots.

Future Trends in Ransomware and Recommendations for Defenders

Bridget O’Gorman emphasizes the ongoing evolution of ransomware, noting a shift towards extortion-only schemes, data theft, and faster attack speeds facilitated by AI and automation. She warns that ransomware will remain a significant threat, especially to critical sectors like healthcare and government, due to the potential for disruptive attacks. The discussion offers recommendations for security professionals, including deploying layered defenses, monitoring for pre-ransomware activity, managing privileged access, and maintaining a focus on detection and response capabilities to adapt to the rapidly changing threat landscape.

Show notes

Today we are joined by Brigid O Gorman, Senior Intelligence Analyst on Symantec Threat Hunter team, discussing their work on “GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses." GodDamn ransomware, the latest rebrand from the Hyadina group behind Monster and Beast, is using increasingly sophisticated techniques to evade defenses.

In a recent attack, the threat actors used AnyDesk for remote access, a broad credential-harvesting toolkit, and the PoisonX malicious kernel driver to disable endpoint security before deploying the ransomware. The activity highlights Hyadina’s continued development of its ransomware operations and an escalation in its defense-evasion capabilities.

The research and executive brief can be found here:

⁠⁠⁠⁠GodDamn Ransomware: Latest Beast Rebrand Uses Malicious Driver to Disable Defenses

Learn more about your ad choices. Visit megaphone.fm/adchoices