Top Banner
UNCLASSIFIED UNCLASSIFIED Statewide resource to investigate complex computer intrusions and digital crimes. • Theft of Personal Identifiable Information (PII) • Destruction or loss of data by malicious exploits • Sales of PII • Complex computer intrusions by organized crime • Exploitation of vulnerabilities in critical infrastructure • Network sabotage by insiders • Education • Forensic expertise Oregon Cyber Task Force
26

UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

Jul 22, 2020

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Statewide resource to investigate complex computer intrusions and digital crimes.

• Theft of Personal Identifiable Information (PII) • Destruction or loss of data by malicious exploits• Sales of PII• Complex computer intrusions by organized crime• Exploitation of vulnerabilities in critical infrastructure• Network sabotage by insiders• Education• Forensic expertise

Oregon Cyber Task Force

Page 2: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

http://www.propertycasualty360.com/2016/04/12/what-are-the-leading-causes-of-data-security-breac / https://healthitsecurity.com/news/healthcare-data-breaches-top-reported-data-security-incident / http://www.cunacouncils.org/news/11568/news-article/

http://www.propertycasualty360.com/2016/04/12/what-are-the-leading-causes-of-data-security-breac /
https://healthitsecurity.com/news/healthcare-data-breaches-top-reported-data-security-incident /
Page 3: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

3

https://www.calyptix.com/research-2/verizon-data-breach-report-2015-top-10-charts-and-summary/ - Verizon Breach Report

https://www.calyptix.com/research-2/verizon-data-breach-report-2015-top-10-charts-and-summary/
Page 4: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

• Darkweb and Hidden Services

• Cryptocurrency

• Organized Cyber Crime

Page 5: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Page 6: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

The DarkNet consists of overlaying networks that use the public Internet but require specific software, configuration, or authorization to access.

Examples of tools to access the DarkNet include:

• TOR

• I2P

• Freenet

Deeper into the DarkNet

Page 7: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

The Tor network is a group of volunteer operated servers that allows people to minimize their digital footprint, and increase privacy and security on the Internet. Tor connects through a series of virtual tunnels rather than making a direct connection, thus allowing both organizations and individuals to share information over public networks without compromising their privacy.

• Derived from US Naval Research Laboratory’s the onion routing project

• Managed by the non-profit agency The Tor Project

• Why would people use this technology?

History of TOR

Page 8: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

How Tor Works

Tor UserInternetWebsite

Encrypted link

Unencrypted link

Nodes

100.100.1.2

100.100.1.3

100.100.1.1

Tor Network

Page 9: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Hidden Services Websites

A website that anonymously resides on the Tor network

• Approximately 50-60k onion addresses on Tor

• Hidden services use the .onion domain

Example: 3g2upl4pq6kufc4m.onion.

• 16-character alpha-semi-numeric hash value created from a key

• Can be made up of any letter of the alphabet, and decimal digits from 2 to 7

• Vanity .onion addresses can be created as well through a hash (facebookcorewwwi.onion)

Hash value:

A hash function takes a group of

characters (called a key) and

maps it to a value of a certain

length (called a hash value or

hash). The hash value is a

representative of the original

string of characters, but is

normally smaller than the

original.

Key:

A key is a piece of information

(a parameter) that determines the

functional output of a

cryptographic algorithm.

Page 10: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

How Hidden Services Work

Tor User

Hidden

Service

Tor Network

3g2upl4pq6kufc4m.onion

Hides physical location of hidden service by using a rendezvous point.

Encrypted link

Nodes

Rendezvous

Page 11: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Page 12: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

CRYPTOCURRENCY

Page 13: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Virtual Currencies /Cryptocurrencies

Internet-based peer-to-peer (P2P) virtual currency having an element of cryptographic security wherein value is electronically transmitted between parties, without an intermediary.

Page 14: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Page 15: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

16

BOTNETRentals can be used by crooks to stress test networks or distract their target during a larger cyber heist.

Rental Costs-Daily: $60-Weekly: $400

Discounts-10% on orders of $500-15% on orders of $1000

RANSOMWARE RENTAL“Radamant” Ransomware

CostsKit for One Month: $1000

Average cost for Basic Malware: $10

Compromised Web Access

Compromised websites and servers are a favorite means for distributing malware and launching attacks.

Costs-Cpanel: $3-$5-RDP: $10-$25

EXPLOIT KITSOffer criminals a turnkey way to jump right into an attack with very little technical abilities.

Costs“Nuclear Exploit Kit” Lease: $50/day, $400/week, $600/month

“Sweet Orange Exploit Kit” Lease: $450/week, $1800/month

STOLEN IDENTITY AND FINANCIAL INFORMATION All sorts of shapes, sizes and packaging.

CostsUS Payment Card Number With CVV2: $5-$8Plus Bank ID Number: $15Card Number with details about card & owner ("Fullz"): $30

Page 16: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Significant Cyber Incidents in Oregon

• Point of Sale Malware

• Online Extortion

• Ransomware

• Business Email Compromises

• Data Breaches

• Internet Fraud

• Insider threats

• Theft or destruction of data

• Sabotage of infrastructure

• Intentional leaking of information

Page 17: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Ransomware – Putting It Together

Page 18: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Before/After

Page 19: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

CryptoWall Ransom and Personal Pages

20

CryptoWall 4.0 Ransom Page Personal Page

Page 20: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Page 21: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

What Can You Do?

PASSWORD DISCIPLINE

- Use long passwords

- Don’t re-use passwords for more than one account

- Consider changing passwords frequently

- Consider using a Password manager

UNCLASSIFIED

How Does it Work?Types of SchemesStatisticsHow is the Money Moved?Why is it Growing?What Can You Do?

Page 22: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

What Can You Do?

INFORMATION TECHNOLOGY SAFETY

- Patch and Update Immediately.

- Use Antivirus and anti-Spyware.

- If you run a company, consider setting up a stand-alone network for employees to use for personal email and web activity.

UNCLASSIFIED

How Does it Work?Types of SchemesStatisticsHow is the Money Moved?Why is it Growing?What Can You Do?

Page 23: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

What Can You Do?

EMAIL TIPS

- If suspicious activity is ever suspected with your email:

- Change your password right away & Log out all others

- And then check for new “Rules” on your account

- Look for Webmail that allows for monitoring logins to your account and gives you the ability to log out others.

UNCLASSIFIED

How Does it Work?Types of SchemesStatisticsHow is the Money Moved?Why is it Growing?What Can You Do?

Page 24: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

What Can You Do?

IT SECURITY & STAFF

- If you run a company large enough to have IT staff, allow them to attend conferences and training to stay current with industry trends.- Consider Penetration testing services

- If you outsource IT needs, ask your provider what they are doing to protect you from cyber attacks.

UNCLASSIFIED

How Does it Work?Types of SchemesStatisticsHow is the Money Moved?Why is it Growing?What Can You Do?

Page 25: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

What Can You Do?

SOCIAL MEDIA

- Posting of business or vacation travel of company staff could let scammers know when executives are out of reach.

- Social Media can also provide scammers with information about friends, family, and business deals.

UNCLASSIFIED

How Does it Work?Types of SchemesStatisticsHow is the Money Moved?Why is it Growing?What Can You Do?

Page 26: UNCLASSIFIED Oregon Cyber Task Force - OR-PRIMA · RANSOMWARE RENTAL “Radamant” Ransomware Costs Kit for One Month: $1000 Average cost for Basic Malware: $10 Compromised Web Access

UNCLASSIFIED

UNCLASSIFIED

Questions?

Oregon Cyber Task Force9109 NE Cascades ParkwayPortland, Oregon, 97220Tele: (503) 460-8000


Related Documents
Hive Ransomware

Hive Ransomware

Category: Documents
Malware - courses.cs.washington.edu...• Spam • Fake antivirus sales, Ransomware • Advertising clickfraud • Bitcoinmining – According to Symantec, one compromised machine

Malware - courses.cs.washington.edu...• Spam • Fake...

Category: Documents
Evaluating the Customer Journey of Crypto- Ransomware€¦ · is to include it in the payload of an exploit kit. Users can be exposed to exploit kits when they visit a compromised

Evaluating the Customer Journey of Crypto-...

Category: Documents
Ransomware: bloccare gli hacker con una difesa a più livelli · Cerber Radamant HydraCrypt Rokku Jigsaw PowerWare GPCoder QiaoZhas Reveton Ransomlock Protezione dal ransomware Per

Ransomware: bloccare gli hacker con una difesa a più...

Category: Documents
UNMASKING RANSOMWARE

UNMASKING RANSOMWARE

Category: Documents
Ransomware Tips to Help Avoid Ransomware Attacks · 2019. 5. 8. · installed the ransomware. Tips to Help Avoid Ransomware Attacks 1. Don’t click. Visiting unsafe, suspicious or

Ransomware Tips to Help Avoid Ransomware Attacks · 2019......

Category: Documents
Cybercrime Tactics & Techniques: Q2 2019 Ransomware ......Ransomware shifts to business targets » Consumer ransomware drops -12% YoY & -25% QoQ » Business focused ransomware increase

Cybercrime Tactics & Techniques: Q2 2019 Ransomware...

Category: Documents
Ransomware is Big Business - Tech Community · 2016-09-23 · Infection Vector User clicks malicious link to a compromised site or malvertising OR user clicks links in phishing emails

Ransomware is Big Business - Tech Community ·...

Category: Documents
RANSOMWARE PROTECTION€¦ · RANSOMWARE PROTECTION UIDE . ... Exploitation Exploit Mitigations Application Behavior Payload Execution ... PREVENTION AGAINST RANSOMWARE.

RANSOMWARE PROTECTION€¦ · RANSOMWARE PROTECTION UIDE .....

Category: Documents
American Public Power Association’s Cybersecurity Services ... · and managing (RMM) software. Actors behind the Sodinokibi ransomware infection likely leveraged compromised network

American Public Power Association’s Cybersecurity Services...

Category: Documents
Einfache Möglichkeit, zu deinstallieren PadCrypt ransomware: Entfernen PadCrypt ransomware

Einfache Möglichkeit, zu deinstallieren PadCrypt...

Category: Technology
Preparing for a Ransomware Attack · 2017-06-23 · – If ransomware is part of larger breach, and PII is compromised, breach notification and third-party liability coverage may

Preparing for a Ransomware Attack · 2017-06-23 · – If....

Category: Documents