Threat Intelligence Report July 9 - July 15 2024

Inc. Ransomware

Emerging in July 2023, Inc. Ransomware quickly carved a niche in the cybercrime landscape with its calculated approach. This malware employs a twist on the typical double extortion tactic, positioning itself as a "service" to its victims. While the exact origins of Inc. Ransomware remain unclear, security researchers suspect it may be linked to a Russian-speaking cybercriminal group.

Tactics, Techniques, and Procedures (TTPs):    

Inc. Ransomware attempts to distinguish itself from its brutal counterparts by presenting a facade of offering "data recovery services" after encryption. However, this is a manipulative tactic designed to pressure victims into paying the ransom. Here's a closer look at Inc. Ransomware's tactics:

• Spear-Phishing Attacks: Unlike the ransomware strains that rely on mass phishing campaigns, Inc. targets victims with meticulously crafted spear-phishing emails. These emails appear to be from legitimate sources, such as business partners or service providers and often leverage social engineering tactics to trick recipients into clicking malicious links or downloading infected attachments.
  
  
• Exploiting Unpatched Vulnerabilities: Inc. actively seeks out unpatched vulnerabilities in software and operating systems to gain unauthorised access to networks. This reinforces the importance of keeping all software and systems updated with the latest security patches.
  
  
• Lateral Movement: Once a foothold is established on a single device, Inc. utilises various tools to move laterally across a network. This allows it to infect additional devices, escalate privileges, and potentially compromise critical systems.
  
  
• Living-off-the-Land Techniques: Similar to many malware strains, Inc. can utilise legitimate system administration tools for malicious purposes. This makes detection more challenging as these tools may appear as normal system activity.
  
  Read more on Living-off-the-land attacks and defending against APTs.
  
  
• Data Exfiltration: Before encryption, Inc. often exfiltrates sensitive data like financial records, personal information, and intellectual property. This stolen data serves as a double-edged sword. Inc. threatens to not only encrypt but also leak this data on the dark web, escalating pressure on victims.
  
  
• Deceptive "Recovery Service": Following encryption, Inc. presents victims with a ransom note disguised as a "data recovery service agreement." This facade creates a false sense of negotiation and can manipulate victims into paying the ransom, believing they are regaining access to their data.
  
  
• Strong Encryption: Despite the deceptive tactics, Inc. utilises robust encryption algorithms to render files inaccessible. Decrypting them without the attacker's key is extremely difficult, if not impossible. This effectively cripples a victim's operations until a decision is made.
  
  

A Global Reach with Focused Targets

While Inc. Ransomware exhibits a global reach, it also displays a preference for specific targets:

• Small and Medium-Sized Businesses (SMBs): SMBs are frequent targets due to their potentially less robust cybersecurity defences compared to larger enterprises. Inc.'s deceptive tactics can be particularly effective in these organisations.
  
  
• Supply Chain Attacks: There are concerns that Inc. might target vulnerabilities in software suppliers or third-party vendors to gain access to a wider network. By compromising a trusted vendor, attackers can infiltrate a larger number of victims through a single point of entry.
  
  

Leak Site: Inc. ransomware maintains a leak site on the dark web where they threaten to publish stolen data if the ransom is not paid.

Ransom Note:

The emergence of Inc. Ransomware underscores the ever-evolving landscape of cyber threats. Its focus on social engineering tactics, combined with its deceptive "recovery service" facade, highlights the need for organisations to prioritise robust cybersecurity measures and employee awareness training. Here are some crucial steps organisations can take:

• Security Awareness Training: Educate employees on identifying phishing attempts and other social engineering tactics used by attackers. Regular training can significantly reduce the risk of human error leading to breaches.
  
  
• Phishing Simulations: Conduct simulated phishing attacks to identify vulnerabilities in employee awareness and response.
  
  
• Multi-Factor Authentication (MFA): Enable MFA for all user accounts wherever possible. MFA adds an extra layer of security by requiring a second verification factor beyond just a username and password.
  
  
• Endpoint Security Solutions: Deploy endpoint security solutions that can detect and prevent malware infections at the device level. These solutions can act as a first line of defence against Inc. and other malware threats.
  
  
• Network Segmentation: Segmenting your network can limit the lateral movement of ransomware, potentially preventing it from spreading throughout your entire infrastructure.
  
  
• Incident Response Plan: Develop and regularly test an incident response plan to effectively respond.
  
  

Kill Chain:

Indicators of Compromise (IOCs)