{"id":7059,"date":"2023-09-19T09:28:59","date_gmt":"2023-09-19T09:28:59","guid":{"rendered":"https:\/\/fortgale.com\/blog\/?p=7059"},"modified":"2023-12-20T11:33:39","modified_gmt":"2023-12-20T11:33:39","slug":"what-happens-during-a-ransomware-attack","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/featured\/what-happens-during-a-ransomware-attack\/","title":{"rendered":"What happens during a Ransomware Attack?"},"content":{"rendered":"\n

The Incident Response<\/em><\/strong> activities carried out by our Team in the last period confirm the growing trend<\/strong> in the number of cyber attacks<\/strong> against Italian companies. What should make us reflect (beyond the numbers and the damage caused) is the technical evolution<\/strong> and increase in complexity<\/strong> of the latter.<\/p>\n\n\n\n

In fact, we notice greater interaction of the attacker during the stages of compromising company systems. Ransomware and the resulting data encryption represents only the latest step taken by criminals within the affected company. Today we talk about “Human-operated ransomware<\/strong>” and “Big Game Hunting<\/strong>“.<\/p>\n\n\n\n

This type of cyber attack often begins with the compromise of an employee’s workstation (via email) and the use of Trojans<\/strong> and Spyware<\/strong>.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

In other cases, the first system to be affected is a perimeter server<\/strong> through the exploitation of vulnerabilities (often RDP<\/strong> and SMB<\/strong>).<\/p>\n\n\n\n

From a Workstation to Servers<\/h2>\n\n\n\n

The compromise of an employee’s workstation should not be underestimated. Threat actors<\/em><\/strong> are increasingly moving from the employee’s desk to the rest of the infrastructure and systems. The criminals’ objective is represented by the compromise of the internal servers of the company network (typically the Domain Controllers, Web Servers and Mail Servers), an objective achieved through Lateral Movement<\/em><\/strong> and Privilege Escalation <\/em><\/strong>activities.<\/p>\n\n\n\n

Lateral movement consists of the series of steps performed by the attacker to access other systems in the same computer network.<\/p>\n\n\n\n

Would you be able to identify behaviors and tolls of this kind?<\/strong><\/p>\n\n\n\n

Some offensive tools often used by criminals (and penetration testers):<\/p>\n\n\n\n

Initial Compromise and Post-Exploitation Tools:<\/strong><\/p>\n\n\n\n