![Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/video-ATTCK2-1)
![Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/Edward-Gonam-Qatar-Blog2-1)
![Endpoint Protection and Threat Intelligence: The Way Forward [VIDEO]](https://assets.crowdstrike.com/is/image/crowdstrikeinc/GK-Blog_Images-1)
- Kaseya, makers of popular IT software used by managed service providers (MSPs), was recently affected by a REvil ransomware attack
- CrowdStrike associates REvil ransomware to the PINCHY SPIDER threat actor
- The CrowdStrike Falcon® platform protects customers from REvil ransomware
- The Falcon platform prevents REvil in early stages of execution using machine learning and behavior-based detection
What Happened?
On Friday, July 2, REvil ransomware operators managed to compromise Kaseya VSA software, used to monitor and manage Kaseya customer’s infrastructure. REvil ransomware operators used zero-day vulnerabilities to deliver a malicious update, compromising fewer than 60 Kaseya customers and 1,500 downstream companies, according to Kaseya’s public statement. These vulnerabilities were previously identified and privately reported to Kaseya by the Dutch Institute for Vulnerability Disclosure. Current reports suggest that the REvil operator made use of a privately disclosed vulnerability, now tracked as CVE-2021-30116, in order to achieve execution. Kaseya has recommended that on-premises partners keep their VSA servers offline, as they are currently in the process of releasing a patch to address the issues. Meanwhile, recent reports suggest REvil operators initially asked for a ransom of $70 million USD, claiming to have infected more than 1 million systems. A surprising development is that REvil operators may have lowered the ransom demand to $50 million USD along with an offer of a universal decryptor for all victims.How CrowdStrike Falcon Protects Customers From REvil Ransomware
The Falcon platform was designed from the ground up to leverage the power of the cloud, machine learning and behavioral detection to protect organizations from sophisticated attacks and threats, such as ransomware. The Falcon platform takes a layered approach to prevent, identify and protect customers from ransomware, including REvil ransomware. In this particular case, the Falcon sensor can prevent the attack whenever a suspicious process usually associated with ransomware is triggered, as well as detect the REvil ransomware using on-sensor and in-the-cloud machine learning as well as behavioral detection with indicators of attack (IOAs). It can also detect if a legitimate process, such as the one associated with the Kaseya VSA, is attempting to load malicious code. In addition, the Falcon OverWatch™ team is constantly monitoring and will immediately notify customers if they observe behaviors associated with nation-state or eCrime threat actors like PINCHY SPIDER, enabling the customer to take action against the threat. Falcon has the ability to protect clients from this campaign by identifying suspicious processes associated with ransomware. The Falcon platform uses IOAs to detect and prevent suspicious processes from being executed and protects customers from ransomware campaigns early in the attack chain, before the payload is executed.
The unique leverage that machine learning brings to the security industry is that it can identify both known and unknown malware, by understanding malicious intent based solely on the attributes of a file without prior knowledge of it. Falcon machine learning can provide coverage for REvil ransomware by accurately identifying and blocking the attack in multiple places.
Falcon protects customers from ransomware including new or unknown REvil samples, as well as accurately identifies and blocks malicious behavior indicative of ransomware.
(Click to enlarge)This prevents REvil being dropped to disk and sideloaded into MsMpeng.exe, an older but legitimate version of a Windows Defender binary. Such coverage is the result of intelligence derived from our continuous monitoring of the tactics, techniques and procedures (TTPs) associated with malware and threat actors’ behavior. The Falcon platform also has the ability to identify the proxying execution of malicious commands, even if the parent is a trusted process with signed binaries — effectively detecting and preventing adversaries from abusing the VSA vulnerability and delivering the malicious payload. This ability is demonstrated in the image below.
(Click to enlarge)Recommendations
- Use leading security technologies. Organizations need to use the right security technologies to protect their infrastructure and most valuable assets from ransomware.
- Use an endpoint security solution that takes a layered approach to preventing, identifying and protecting customers from ransomware.
- Do not give in to ransomware demands. The U.S government, law enforcement and security companies recommend that organizations faced with ransomware demands should not give in to extortion.
- You are not alone — seek help and advice from experts. Companies experiencing security incidents may have a difficult time or not have the resources for investigating and recovering on their own.
Additional Resources
- Learn more about PINCHY SPIDER, CARBON SPIDER and other ransomware adversaries in the CrowdStrike Adversary Universe.
- Download the CrowdStrike 2021 Global Threat Report for more information about adversaries tracked by CrowdStrike Intelligence in 2020.
- See how the powerful, cloud-native CrowdStrike Falcon platform protects customers from DarkSide ransomware in this blog: DarkSide Goes Dark: How CrowdStrike Falcon Customers Were Protected.
- Get a full-featured free trial of CrowdStrike Falcon Prevent and learn how true next-gen AV performs against today’s most sophisticated threats.
