The 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?

The 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?

Speakers: Eric Chin, Vikram Thaker, Symantec (part of Broadcom)

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=nX-bZxLVejQ

Overview

The 2024 ransomware threat landscape continues its relentless expansion, presenting an escalating epidemic that challenges conventional cybersecurity defenses. In this illuminating talk at RSAC 2024, Eric Chin and Vikram Thaker from Symantec, a division of Broadcom, dissect the current state of ransomware, revealing the tactics, techniques, and procedures (TTPs) employed by threat actors and proposing a paradigm shift in defensive strategies. Vikram Thaker initiates the discussion by presenting sobering statistics and trends, highlighting the pervasive nature of ransomware and the ingenuity of its operators.

The core of their presentation revolves around two critical shifts: how ransomware actors gain initial access and the tools they leverage once inside a network. They explain a move away from traditional spam-based entry methods to exploiting vulnerabilities in public-facing infrastructure, significantly reducing dwell times. Furthermore, attackers are increasingly "living off the land" by utilizing legitimate, dual-use tools already present in target environments, rendering signature-based and even next-gen anti-virus solutions less effective. Eric Chin then introduces the concept of adaptive security, advocating for a context-aware defense mechanism that understands an organization's unique operational behaviors to proactively block malicious activities without disrupting legitimate business processes.

This talk is crucial for cybersecurity professionals, IT leaders, and anyone involved in organizational defense. It not only quantifies the scale of the ransomware problem but also provides actionable insights into the evolving methodologies of adversaries. By understanding the shift towards exploiting public vulnerabilities, the reliance on dual-use tools, and the rapid exfiltration of data, organizations can better prepare and deploy more intelligent, adaptive security measures to counter this persistent and financially devastating threat. The speakers' call for a departure from one-size-fits-all security solutions underscores the urgent need for tailored, preventative defenses in the face of sophisticated and adaptable adversaries.

Background

▶ Watch: Introduction to 2024 Ransomware Threat Landscape (0:00)

The ransomware epidemic shows no signs of abating, with statistics revealing a continuous upward trend over the past two years. Vikram Thaker shared that Symantec's automated scraping of open-source news, social media, and data leak sites indicates a consistent increase in victimized organizations. A critical insight from this data is the disproportionate impact on small and medium-sized businesses (SMEs), which often lack the robust security infrastructure and resources of larger enterprises. These figures are considered highly accurate, with the only missing data points being instances where victims pay extra to prevent their names from appearing on data leak sites, a common but undisclosed practice.

Contrary to popular belief, the vast majority of ransomware attacks are not orchestrated by a massive army of hackers. Instead, Symantec's analysis suggests that the nightmare for CEOs, CIOs, and Security Operations Center (SOC) personnel is largely fueled by a very small group—perhaps a mere dozen to two dozen lead individuals within these ransomware gangs. These individuals could be business leaders of the syndicates or lead developers, but they form the apex of a hierarchical structure that employs numerous affiliates to carry out the actual attacks. This lean leadership model allows for agility and resilience, making the groups harder to dismantle.

A prime example cited was LockBit, which accounted for over one-fifth of all observed attacks—nearly 5,000 confirmed victims in the past year alone. While law enforcement actions, such as those targeting LockBit's leader, Dmitry, might disrupt the syndicate's operations, the speakers emphasized that these actions are unlikely to significantly reduce the overall volume of attacks. LockBit's affiliates, who are the ones executing the attacks, are driven by financial incentives and will simply seek new employment opportunities with other ransomware groups. This fluidity means that while the "pie chart" of dominant ransomware families might change, the total number of attacks is expected to remain consistent or even increase in the coming year.

The methods of initial access for ransomware actors have also undergone a significant evolution. Historically, attackers heavily relied on spam email campaigns. Large-scale bot operators (e.g., Quakbot, IcedID, Emotet, Trickbot) would send out vast quantities of spam, hoping an employee would click a malicious link, download an attachment, or enable a macro, thereby installing malware. This initial foothold would then be sold to ransomware actors, who would proceed with lateral movement, deploy tools like Cobalt Strike, and eventually encrypt the network.

However, a pivotal shift has occurred. Ransomware actors discovered that they could bypass this third-party dependency by directly scanning the internet for public-facing infrastructure with known vulnerabilities. This technique gained significant traction a few years ago with a "slew of vulnerabilities" in on-premise Exchange servers. Since then, it has become a prevalent method, with attackers exploiting flaws in various internet-facing applications and servers, including those targeted by Citrix Bleed and vulnerabilities in Ivanti products. This direct exploitation eliminates the need for user interaction, allowing attackers to rapidly gain a foothold. The critical observation here is that ransomware operators typically do not discover zero-day vulnerabilities themselves; instead, they leverage publicly available exploits as soon as they become known. This leads to characteristic "spikes" in attacks immediately following the public disclosure of a new vulnerability.

This shift in initial access has also altered the attackers' strategy once inside a network. Instead of focusing on encrypting entire networks and endpoints, they often prioritize gaining access to server infrastructure (e.g., Exchange servers, Citrix servers). Once inside, they can quickly escalate privileges, disable security software, and exfiltrate large volumes of data. This approach is often less technically demanding, as attackers can utilize readily available tools and public code that exploit vulnerable drivers to achieve their objectives.

Key Findings

▶ Watch: Unmasking the small groups behind ransomware operations (2:00)

The talk unveiled several critical findings regarding the contemporary ransomware threat, emphasizing its persistent growth and evolving sophistication:

• Accelerating Epidemic and SME Focus: Ransomware activity continues to surge year-over-year, with no signs of deceleration. A significant proportion of victims are small and medium-sized businesses (SMEs), which are often less equipped to defend against and recover from sophisticated attacks.
• Centralized Leadership, Distributed Execution: The ransomware ecosystem is characterized by a small number of core leaders (a dozen to two dozen) who orchestrate operations through a large network of affiliates. This structure ensures resilience; even if a prominent group like LockBit (responsible for over 20% of attacks, nearly 5,000 confirmed victims in the last year) faces law enforcement action, its affiliates simply migrate to other syndicates, maintaining overall attack volume.
• Shift to Direct Vulnerability Exploitation: The primary method of initial access has decisively moved away from spam email campaigns. Attackers now extensively scan the internet for and exploit publicly disclosed vulnerabilities in public-facing infrastructure such as Exchange servers, Citrix Bleed, and Ivanti products. This direct approach eliminates dependency on user interaction and third-party bot operators.
• Leveraging Public Exploits, Not Zero-Days: Ransomware operators are generally not discovering new zero-day vulnerabilities. Instead, they are highly opportunistic, rapidly adopting and weaponizing publicly available exploits as soon as they are disclosed, leading to predictable spikes in attacks.
• Prevalence of Living Off The Land (LotL) and Dual-Use Tools: Once inside, attackers increasingly rely on living off the land (LotL) techniques, utilizing legitimate, dual-use tools already present within the compromised network. This list of commonly abused tools has dramatically expanded from fewer than 10 to 25 within a single year, including PowerShell, Rclone, PSX, AnyDesk, RDP, VNC, and ScreenConnect. This strategy allows them to evade traditional signature-based and even next-gen anti-virus solutions, as these tools are not inherently malicious.
• Massive Data Exfiltration as Extortion Leverage: Data theft has become a standard component of ransomware attacks, often involving the exfiltration of 100-200 gigabytes of sensitive information. This data acts as "insurance" for attackers, providing additional leverage for extortion even if victims have robust backup and recovery capabilities, making the decision not to pay significantly harder.
• Exploitation of Vulnerable Drivers: Attackers are exploiting vulnerable drivers (either genuinely flawed but signed drivers or maliciously signed drivers) to gain elevated privileges and disable security software, further facilitating their operations within the compromised environment.
• Drastically Reduced Dwell Times: The shift to direct exploitation of internet-facing devices has led to a significant reduction in dwell times—the period between initial compromise and the execution of the ransomware payload. What once took weeks (due to lateral movement from an endpoint) now often occurs within hours, underscoring the urgent need for proactive and immediate prevention.
• Inadequacy of Traditional Security: Signature-based AV, next-gen AV, and even EDR solutions, while valuable, are proving insufficient against the current ransomware TTPs. Their one-size-fits-all approach struggles to differentiate between legitimate administrative use and malicious exploitation of dual-use tools, highlighting a critical gap in conventional defenses.

Technical Deep Dive

▶ Watch: LockBit's market share and future after takedowns (3:00)

The technical evolution of ransomware attacks hinges on two primary pillars: the method of initial access and the tools and techniques employed post-compromise. The speakers meticulously detailed how these have shifted, demanding a fundamental change in defensive posture.

Initial Access Evolution:

Historically, initial access was predominantly gained through spam email campaigns. Botnets like Quakbot, IcedID, Emotet, and Trickbot would distribute malware, gaining an initial foothold on an employee's workstation. This access was then often sold to ransomware groups, who would proceed with their operations. This method was often slow, relying on user interaction and subsequent lateral movement.

The modern approach, however, prioritizes direct exploitation of public-facing infrastructure. Attackers now actively scan the internet for known vulnerabilities in servers and appliances. Prominent examples include the "slew of vulnerabilities" in on-premise Exchange servers that emerged a few years ago, and more recently, flaws like Citrix Bleed and vulnerabilities in Ivanti products. This strategy bypasses the need for user interaction, allowing immediate access to critical server infrastructure, often within the DMZ. The key here is that ransomware actors are not typically discovering zero-day vulnerabilities; instead, they are highly opportunistic, rapidly weaponizing publicly available exploit code as soon as it is released. This leads to sharp "spikes" in attacks targeting specific vulnerabilities, as attackers race to compromise unpatched systems.

Post-Compromise TTPs: Living Off The Land (LotL) and Dual-Use Tools:

Once inside a network, the attackers' toolkit has dramatically changed. Instead of deploying custom malware, they increasingly rely on living off the land (LotL) techniques, utilizing dual-use tools already present on the compromised systems or commonly found in enterprise environments. This list of abused tools has grown rapidly, from less than 10 to 25 within the last year. These include:

• PowerShell: A powerful scripting language native to Windows, frequently abused for reconnaissance, execution, and privilege escalation.
• Rclone: An open-source command-line program for managing files on cloud storage. Symantec identified it as the most widely used tool for data exfiltration, often moving hundreds of gigabytes of data.
• PSX (PsExec): A legitimate tool from Sysinternals for executing processes on remote systems, used by attackers for lateral movement.
• Remote Access Tools: AnyDesk, RDP (Remote Desktop Protocol), VNC, and ScreenConnect are legitimate remote access solutions that attackers co-opt for persistent access and command and control.

The challenge with these tools is that they are legitimate and often essential for IT administration and business operations. Traditional security solutions, such as signature-based AV and even next-gen AV (NGAV), struggle to differentiate between legitimate and malicious usage. NGAV, while capable of detecting new malicious binaries through machine learning, cannot block a legitimate tool like Rclone without causing widespread business disruption. Endpoint Detection and Response (EDR) products collect vast amounts of data, but often shift the burden onto human analysts to triage "hundreds of alerts" for Rclone usage, making it difficult to distinguish between a developer's legitimate activity and a ransomware actor's malicious exfiltration.

Exploiting Vulnerable Drivers:

Another critical technical vector is the exploitation of vulnerable drivers. Attackers leverage publicly known flaws in signed drivers or even use malicious drivers that have somehow been signed by legitimate authorities (e.g., Microsoft). Public code is readily available to exploit these drivers, allowing attackers to gain kernel-level or system-level privileges. This enables them to disable security software, bypass operating system controls, and execute arbitrary code, making their operations significantly harder to detect and mitigate.

The Adaptive Security Paradigm:

Eric Chin introduced adaptive security technology as the necessary evolution to combat these TTPs. This paradigm moves beyond the "one-size-fits-all" approach of traditional security.

1. Attack Chain Cataloging: Symantec continuously catalogs known attack chains and TTPs (e.g., "Word doc drops PowerShell, which launches a script, hits LSAS, uses PSX, transits network, uses Rclone").
2. Environmental Learning: The adaptive technology continuously monitors and learns an organization's specific environment, tracking all user behaviors, tool usage, and legitimate business processes. This is akin to EDR's data collection but with an added layer of intelligence.
3. Contextual Policy Generation: By comparing the organization's unique behavioral baseline against known attacker playbooks, the system can automatically generate highly granular, preventative policies.

• Low-Hanging Fruit: If an organization never uses Rclone to upload data to the cloud, the system can automatically block any attempt to do so, knowing it's a common attacker technique. This "quick tune" approach can reduce the attack surface by 50%.
• Fine-Grained Adaptations (AI/ML): For more complex scenarios, where a dual-use tool is legitimately employed (e.g., an accounting department using Word documents to launch PowerShell scripts), machine learning (ML) and artificial intelligence (AI) are used. The system learns the precise context—which machines, which directories, what specific command-line parameters are legitimate—and allows only those specific behaviors while blocking all other variants. For instance, if an attacker's Word-launched PowerShell writes to the temp directory, but the legitimate business process writes to a specific accounting directory, the former is blocked.

1. Process Lineage Tracking: To prevent evasion through intermediary processes, adaptive security employs robust process lineage tracking. If a policy states "Excel is not allowed to create files," this rule applies across the entire execution chain. Whether Excel directly creates a file or launches CScript, which then launches PowerShell, which eventually creates the file, the originating process (Excel) is held accountable for the final action, and the activity is blocked. This makes it "very difficult for the attacker to bypass these fine-grained controls."

The ultimate goal of adaptive security is proactive, preventative blocking. By creating unique, environment-specific security hurdles, attackers face increased friction. As Eric Chin noted, "Every hurdle they reach is one step to them giving up," leading them to move on to easier, less protected targets, thereby significantly increasing an organization's resilience against ransomware.

Demo / Proof of Concept

▶ Watch: Exploiting public-facing vulnerabilities for initial access (4:55)

While the presentation did not feature a live product demonstration, Eric Chin effectively illustrated the conceptual power of adaptive security by walking through a hypothetical scenario using the well-known WannaCry attack chain. This served as a compelling proof of concept for how adaptive technology could proactively disrupt multi-stage ransomware attacks.

The WannaCry example (starting around [19:40]) outlined a typical infection path:

1. Chrome downloads a malicious zip file.
2. The zip file contains a script.
3. WScript launches that script.
4. The script then launches PowerShell.
5. PowerShell reaches out to the network to download a PE (Portable Executable) file.
6. This PE file then executes the final ransomware payload.

Chin explained how adaptive security could intervene at multiple points along this chain, effectively preventing the attack long before it reached its final impact:

• Early Stage Blocking (WScript): In environments where users "never have scripts come over, be downloaded and be executed," adaptive security could simply block WScript from executing the downloaded script. This would be a very "left of the final impact" block, stopping the attacker at the earliest stage.
• Behavioral Anomaly (WScript launching PowerShell): Even if WScript execution was allowed, the subsequent action of WScript launching PowerShell is often an unusual behavior for legitimate business processes, though common for attackers. Adaptive security could identify this "script program to a script program" interaction as suspicious and block it.
• Network Activity (PowerShell downloading PE file): If the previous stages were bypassed, adaptive rules could still detect and block PowerShell attempting to download an executable file (PE file) from the network, especially if the organization's legitimate PowerShell usage does not involve such network activity.

The key takeaway from this conceptual walkthrough was that adaptive security provides "many, many places where we are tracking these behaviors and finding every little place, every behavior the attackers are doing." By continuously monitoring and learning an organization's legitimate activities, it can precisely identify and block malicious deviations. The goal is not necessarily to block every single step but to introduce enough "hurdles" so that the attacker either gives up due to increased effort and cost or buys the defenders critical time to respond. This proactive, preventative capability is a stark contrast to traditional detection-focused security, which often alerts after significant damage has already occurred.

Defensive Implications

▶ Watch: Examples of critical public-facing vulnerabilities used (5:55)

The evolving ransomware landscape necessitates a significant shift in defensive strategies, moving beyond traditional, reactive measures to proactive, adaptive prevention. Eric Chin outlined several critical implications and recommendations for organizations:

1. Prioritize Proactive Prevention over Reactive Detection: Given the drastically reduced dwell times (from weeks to hours), "after-the-fact detection, let me go investigate, let me see if this is bad or not, it's all too late." Organizations must focus on preventing attacks at the earliest possible stages of the kill chain.

1. Strengthen Vulnerability Management for Internet-Facing Devices:

• Identify Gaps: The immediate priority is to identify and address weaknesses in the existing vulnerability management process. This includes knowing all assets on the network, their associated vulnerabilities, and having a robust patching regimen.
• Focus on Edge Devices: A critical vulnerability is the lack of visibility and control over internet-facing devices such as firewalls, VPN appliances, and Citrix appliances. Many organizations excel at patching endpoints and servers but overlook these critical perimeter devices. Attackers actively target these to gain direct access to sensitive network segments like the DMZ.
• Zero-Day Preparedness: Develop clear processes for responding to zero-day exploitation. This includes strategies for temporary mitigation (e.g., shutting down vulnerable services) when a patch is unavailable or cannot be immediately applied.

1. Block Known Vulnerable Drivers: Attackers frequently exploit vulnerable drivers to gain system-level privileges and disable security software. Organizations should ensure their security products, or their own manual processes (e.g., via EDR to SIM integration), are configured to block known vulnerable drivers. Resources like the "L drivers" list and lists produced by Microsoft should be consulted.

1. Adopt Adaptive Security Technology:

• Context-Aware Protection: Recognize that "security can't be one size fits all." Invest in security technologies that can adapt to your specific environment. These solutions must understand your organization's unique legitimate tool usage, user behaviors, and business processes.
• Differentiate Malicious from Legitimate: The technology should be capable of distinguishing between legitimate administrative use of dual-use tools (e.g., Rclone, PowerShell, AnyDesk) and their malicious exploitation by attackers.
• Automated Policy Tuning: Seek solutions that can automatically tune policies, blocking activities that are known attacker TTPs but are never legitimately performed within your environment. For complex scenarios, the technology should leverage AI/ML to allow only very specific, legitimate patterns of dual-use tool activity.
• Process Lineage Tracking: Ensure the chosen solution employs robust process lineage tracking to prevent attackers from bypassing controls by chaining multiple legitimate processes to achieve a malicious outcome (e.g., Excel launching PowerShell to create a file).

1. Maintain a Layered Security Approach: Adaptive security is an additional layer, not a replacement. "Adaptive is not the end all. Again, we still need signature-based AV, we still need next-gen AV, we still need EDR." A comprehensive security posture requires a robust combination of technologies to detect and prevent all types of ransomware TTPs, including traditional malware, fileless attacks, and the exploitation of dual-use tools and vulnerable drivers.

By implementing these defensive strategies, organizations can significantly reduce their attack surface, increase the cost and effort for attackers, and ultimately enhance their resilience against the persistent and evolving threat of ransomware.

Key Takeaways

• Ransomware is an Accelerating Epidemic: Ransomware attacks are continuously increasing, with small and medium-sized businesses (SMEs) being disproportionately affected. A small group of core leaders drives a vast affiliate network, ensuring the persistence of the threat regardless of law enforcement actions against individual groups like LockBit.
• Initial Access Shifted to Vulnerability Exploitation: Attackers have moved from relying on spam emails to directly exploiting publicly available vulnerabilities in internet-facing infrastructure (e.g., Exchange servers, Citrix Bleed, Ivanti products). This strategy dramatically reduces dwell times from weeks to mere hours, necessitating rapid, proactive prevention.
• Dual-Use Tools and Living Off The Land Dominance: Ransomware actors extensively use legitimate, dual-use tools already present in networks (e.g., Rclone, PowerShell, PSX, AnyDesk), making traditional signature-based and next-gen AV ineffective. This list of abused tools has grown significantly to 25 within a year.
• Data Exfiltration as Primary Extortion Leverage: Large-scale data exfiltration (often 100-200GB) is now a standard tactic, providing attackers with additional leverage for extortion, even if victims have robust backup and recovery systems.
• Adaptive Security is Essential for Proactive Prevention: Traditional "one-size-fits-all" security is insufficient. Organizations need adaptive security technology that learns their unique environment and legitimate behaviors. This allows for precise, preventative blocking of malicious usage of dual-use tools and anomalous attack chain activities (e.g., Excel launching PowerShell to create files) without disrupting business operations.
• Robust Vulnerability Management and Layered Defense are Crucial: Immediate defensive priorities include identifying and closing gaps in vulnerability management, especially for often-overlooked internet-facing devices (firewalls, VPNs), and implementing processes for zero-day mitigation. Adaptive security should be integrated as a vital new layer within a comprehensive, multi-faceted security architecture.

About the Speaker(s)

Eric Chin and Vikram Thaker are security experts from Symantec, which is part of Broadcom. In this RSAC 2024 presentation, Vikram Thaker led the first half of the discussion, providing an in-depth analysis of the current ransomware landscape, including statistics, the organizational structure of threat groups, and the evolving TTPs for initial access and post-compromise activities. Eric Chin then took over for the second half, focusing on the limitations of traditional security technologies against these modern threats and advocating for the adoption of adaptive protection mechanisms. Their combined expertise offered a comprehensive view of both the challenges posed by ransomware and the innovative solutions required to combat it effectively.