🛡️ Ransomware Defense & Response — Module 1
1) Theory — Understanding Ransomware
Ransomware is malicious software that encrypts or locks an organization’s data until a ransom is paid. Modern groups operate as commercial syndicates, offering “Ransomware-as-a-Service” (RaaS) to affiliates who conduct the intrusions. Initial access typically stems from phishing, weak or leaked credentials, exposed remote access (RDP/VPN), or unpatched vulnerabilities. Once inside, operators move laterally, escalate privileges, disable or tamper with backups, and disrupt business operations at scale.
- Initial access: phishing, credential stuffing, exposed RDP/VPN, unpatched software.
- Lateral movement: pivoting across hosts (e.g., SMB sessions, remote execution) to widen impact.
- Extortion: single, double, or triple extortion to maximize pressure and payment likelihood.
- Business impact: downtime, data exposure, legal obligations, reputational damage, and cost.
- Defense: MFA, EDR, segmentation, least privilege, immutable/offline backups, tested response plans.
1.1 How attackers operate (tactics & techniques)
- Backup sabotage: deletion of Volume Shadow Copies, disabling backup agents, encrypting NAS shares.
- Privilege escalation: token theft, credential dumping, abusing domain admin/misconfigured service accounts.
- Living off the land: PowerShell, PsExec, WMIC, scheduled tasks — blends with admin activity.
- Discovery & spread: scanning internal subnets, reusing cached credentials, abusing SMB and RDP.
- Exfiltration: staging data to internal shares, then exporting to attacker-controlled cloud or servers.
1.2 Extortion models (pressure ladder)
- Single extortion: data encryption.
- Double extortion: data theft + encryption, with leak threats if unpaid.
- Triple extortion: adds direct harassment of clients/partners/regulators or DDoS for extra leverage.
1.3 Entry points (practical priority)
- Phishing (malicious attachments/links; MFA push fatigue).
- Credentials (password reuse, leaked hashes, weak MFA posture).
- Public-facing services (RDP/VPN, unpatched gateways, web apps).
- Supply chain/3rd parties (compromised vendor accounts or tooling).
1.4 Defense-in-depth (controls that actually help)
- MFA everywhere that matters: especially VPN/RDP/admin portals. Prefer phishing-resistant factors where possible.
- EDR + central visibility: detect lateral movement, script abuse, mass encryption behavior.
- Network segmentation: break flat networks; limit east-west traffic and admin access scopes.
- Least privilege & PAM: unique admin accounts, no shared creds, tiered administration, time-bound access.
- Immutable/offline backups: at least one backup copy untouchable by ransomware; test restores regularly.
- Patch cadence: prioritize internet-exposed and high-impact systems; track exceptions aggressively.
- Email & domain protections: SPF/DKIM/DMARC, attachment sandboxing, link-rewriting, phishing simulations.
- Monitoring & logging: centralize logs (SIEM), alert on anomalous SMB, mass file renames, VSS deletions.
1.5 Response playbook (first 24–72 hours)
- Isolate affected endpoints/servers from the network immediately; do not power off unless advised.
- Triage scope and crown-jewel impact; document indicators (file notes, extensions, ransom messages).
- Engage IR & legal (internal or external). Preserve evidence (memory, disk, logs) following chain of custody.
- Contain credentials (rotate), disable compromised accounts, block malicious C2, tighten firewall rules.
- Eradicate persistence (scheduled tasks, services, GPO artifacts) and verify clean state via EDR/SIEM.
- Recovery from known-good, offline backups; rebuild critical services first; validate before reconnect.
- Communicate with stakeholders/customers as required; coordinate PR with legal guidance.
1.6 After-action (hardening & lessons learned)
- Close root causes (patches, MFA gaps, exposed services).
- Strengthen segmentation and tiering; review privileged access.
- Improve detection rules (VSS deletes, mass file change rates, unusual SMB use).
- Run a post-mortem tabletop; update runbooks; re-test backup restores.
2) Real-world example
Colonial Pipeline (2021) was hit by the DarkSide group. Attackers infiltrated the IT network, forcing shutdowns that disrupted fuel supply across the U.S. East Coast. A multi-million-dollar ransom was paid. Weak segmentation and rapid lateral movement amplified impact — proof that one foothold can cascade into a systemic crisis.
3) Assessment — 18 Professional Questions
Choose the best answer for each question. Answers and feedback appear after you submit.
4) Finish
When you’re done, mark this module as completed to update your Premium Hub progress.
