Lesson 4.5: How ransomware works
Ransomware is the end of an intrusion, not the start. Before a single file is encrypted, operators usually get in, take over an account with wide access, copy data out to threaten publication, and destroy the recovery options. In the lab, Northwind's finance share on file server fs02 was encrypted overnight on Sunday. You read the ransom note, confirm the files are encrypted, and use the Samba audit log, the proxy log and the endpoint log to reconstruct exactly what happened, in what order, from which machine and with which account.
17 min
You will learn to
- Describe the stages of a ransomware attack
- Explain double extortion
- Confirm encryption with file and xxd
- Reconstruct a timeline from several logs
- Recognise attacks on recovery (shadow copies, backups)
Key terms
- Ransomware operator / affiliate
- The people running the attack; many groups rent their malware to affiliates (ransomware-as-a-service).
- Double extortion
- Encrypting data and also threatening to publish stolen copies.
- Exfiltration
- Copying data out of the organisation without permission.
- Shadow copies (VSS)
- Windows' built-in file snapshots, which ransomware deletes to prevent easy recovery.
- Dwell time
- How long attackers are inside before they're detected.
← Working with files and directories · All lessons · TCP: the three-way handshake, flags and connection states →