Ransomware groups deploy remote encryption for global attacks
By Kingsley Odii
Sophos, a leading cybersecurity company, has released a report revealing that multiple active ransomware groups are intentionally using remote encryption in their attacks. The report titled ‘CryptoGuard: An Asymmetric Approach to the Ransomware Battle’ identifies the ransomware groups Akira, ALPHV/BlackCat, LockBit, Royal, and Black Basta as actively employing remote encryption techniques.
Remote encryption attacks, also known as remote ransomware attacks, involve cybercriminals exploiting a compromised and typically poorly protected device to encrypt data on other devices connected to the same network. This method enables them to infiltrate an entire network by targeting a single vulnerable device.
Sophos acquired CryptoGuard, their anti-ransomware technology, in 2015. This technology is included in all Sophos Endpoint licenses and provides immediate protection and the ability to reverse encryption, even if the ransomware itself is never detected on a protected device.
The unique aspect of CryptoGuard is that it acts as a last line of defense in Sophos’ comprehensive endpoint protection system. It only activates if an attacker triggers it later in the attack chain.
According to the report, CryptoGuard has observed a significant 62% year-over-year increase in intentional remote encryption attacks since 2022.
Mark Loman, the Vice President of Threat Research at Sophos and the co-creator of CryptoGuard, commented on the issue. Loman emphasized the vulnerability of companies with numerous interconnected devices, stating that a single under protected device can compromise the entire network. He further added that remote encryption attacks will continue to be a recurring problem for defenders, as the frequency of such attacks is steadily increasing.
Companies can have thousands of computers connected to their network, and with remote ransomware, all it takes is one under protected device to compromise the entire network. Attackers know this, so they hunt for that one ‘weak spot’—and most companies have at least one. Remote encryption is going to stay a perennial problem for defenders, and based, on the alerts we’ve seen, the attack method is steadily increasing,” Mark said.
Traditional anti-ransomware protection methods are unable to detect or prevent remote encryption attacks on devices. These methods are limited to identifying malicious files or activities on devices themselves. However, Sophos’ CryptoGuard takes a unique approach to combating remote ransomware. It analyzes the contents of files to identify any encrypted data, detecting ransomware activity on any device within a network, even if no malware is present on that device.
The use of remote encryption in ransomware attacks first emerged with CryptoLocker back in 2013. Since then, cybercriminals have been quick to exploit this tactic due to the widespread security vulnerabilities across organizations worldwide and the rise of cryptocurrencies.
Loman explained that the early awareness of remote encryption’s potential challenges prompted the development of CryptoGuard. While other solutions focus on identifying malicious binaries or executions, CryptoGuard concentrates on protecting the files themselves. By implementing mathematical analysis, the technology can detect signs of manipulation and encryption within documents, changing the dynamics between attackers and defenders.
Loman further stated that CryptoGuard does not rely on indicators of breach, threat signatures, artificial intelligence, cloud lookups, or prior knowledge to be effective. Instead, it focuses on securing the files, ultimately increasing the complexity and cost for attackers and dissuading them from achieving their objectives.
Remote ransomware attacks continue to plague organizations, contributing to the sustained existence of ransomware overall. Attackers like LockBit and Akira strategically encrypt only a fraction of each file to maximize their impact in minimal time. This technique reduces the window for defenders to respond effectively.
RECOMMENDED ARTICLES
Comment
No comments found.