Extortion Economics
Ransomware’s new business model

Cyber Signals
August 2022

80%
Ransomware
attacks exploiting
configuration errors

Over 80 percent of
ransomware attacks canbe traced to common
configuration errors insoftware and devices.1

Introduction
Cybercriminals
emboldened byundergroundransomware economy
While ransomware continues to bea headline-grabbing topic, there’s
ultimately a relatively small, connectedecosystem of players driving this
sector of the cybercrime economy.
The specialization and consolidationof the cybercrime economy has fueledransomware as a service (RaaS) tobecome a dominant business model,
enabling a wider range of criminals,
regardless of their technical expertise,to deploy ransomware.
We are all cybersecurity defenders.

Cyber Signals

1Security
SnapshotMicrosoft’s Digital Crimes Unit (DCU)
Directed the removal of more than 531,000 unique
phishing URLs and 5,400 phish kits between July
2021 and June 2022, leading to the identificationand closure of over 1,400 malicious email accounts
used to collect stolen customer credentials.1
Email Threats:Median time for an attacker to accessyour private data if you fall victim to aphishing email is one hour, 12 minutes.1
Endpoint Threats:Median time for an attacker to begin moving
laterally within your corporate network if a device
is compromised is one hour, 42 minutes.1

Cyber Signals

2

Threat briefing

New business model
offers fresh insights
for defenders

service, with varying tools, tradecraft,and objectives. Just as anyone with a carcan drive for a rideshare service, anyone
with a laptop and credit card willingto search the dark web for penetration
testing tools or out-of-the-box malware
can join this economy.

Just as many industries have shifted toward
gig workers for efficiency, cybercriminals
are renting or selling their ransomware
tools for a portion of the profits, rather thanperforming the attacks themselves.

This industrialization of cybercrime hascreated specialized roles, like accessbrokers who sell access to networks.
A single compromise often involves
multiple cybercriminals in different
stages of the intrusion.

The Ransomware as a Service economy
allows cybercriminals to purchase access toRansomware payloads and data leakage aswell as payment infrastructure. Ransomware”gangs” are in reality RaaS programs like
Conti or REvil, used by many different actors
who switch between RaaS programs andpayloads.
RaaS lowers the barrier to entry andobfuscates the identity of the attackers
behind the ransoming. Some programs have
50+“affiliates,” as they refer to users of theirRaaS kits are easy to find on the dark
web and are advertised in the sameway goods are advertised across theinternet.
A RaaS kit may include customer
service support, bundled offers, user

DEV-0237 ransomware payloads over timeRyuk

2020-Jun 2021

Conti

Jul-Oct 2021

Hive

Oct 2021-present

BlackCatMar-June 2022

Nokoyawa

May 2022-present

Agenda, etc.

June 2022 (experiment)

2021
JanFeb Mar Apr

Cyber Signals

May JunJul

2022

Aug Sep Oct Nov Dec JanSource: Microsoft 365 Defender Threat Intelligence Teamand Microsoft Threat Intelligence Center (MSTIC)

Feb Mar Apr

May Jun3Threat briefing
reviews, forums, and other features.
Cybercriminals can pay a set price fora RaaS kit while other groups selling
RaaS under the affiliate model take apercentage of the profits.
Ransomware attacks involve decisions
based on configurations of networks
and differ for each victim even if theransomware payload is the same.
Ransomware culminates an attack that
can include data exfiltration and otherimpact. Because of the interconnectednature of the cybercriminal economy,
seemingly unrelated intrusions can build
upon each other. Infostealer malware
that steals passwords and cookies
get treated with less severity, butcybercriminals sell these passwords toenable other attacks.
These attacks follow a template ofinitial access via malware infection orexploitation of a vulnerability thencredential theft to elevate privileges
and move laterally. Industrialization

allows prolific and impactful ransomware
attacks to be performed by attackers
without sophistication or advanced skills.
Since the shutdown of Conti we’ve
observed shifts in the ransomware
landscape. Some affiliates who weredeploying Conti moved to payloads fromestablished RaaS ecosystems like LockBit
and Hive, while others simultaneously
deploy payloads from multiple RaaS
ecosystems.
New RaaS like QuantumLocker andBlack Basta are filling the vacuum
left by Conti’s shutdown. Since mostRansomware coverage focuses on
payloads instead of actors, thispayload switching is likely to confuse
governments, law enforcement, media,
security researchers, and defenders about
who is behind the attacks.
Reporting on ransomware may seem likean endless scaling problem; however, thereality is a finite set of actors using theset of techniques.

Recommendations:
Build credential hygiene: Develop a logicalnetwork segmentation based on privilegesthat can be implemented alongside network
segmentation to limit lateral movement.
Audit credential exposure: Auditing credential
exposure is critical in preventing ransomware
attacks and cybercrime in general. IT security
teams and SOCs can work together to reduce
administrative privileges and understand thelevel at which their credentials are exposed.

Cyber Signals

Reduce the attack surface: Establish attack
surface reduction rules to prevent common
attack techniques used in ransomware
attacks. In observed attacks from several
ransomware associated activity groups,
organizations with clearly defined ruleshave been able to mitigate attacks in theirinitial stages while preventing hands on
keyboard activity.

4Cybercriminals add
double extortion toattack strategy
Ransomware exists to extort payment froma victim. Most current RaaS programs also
leak stolen data, known as double extortion.
As outages cause backlash and government
disruption of ransomware operators
increases, some groups forgo ransomware
and pursue data extortion.
Two extortion focused groups are DEV-0537(aka LAPSUS$) and DEV-0390 (a former
Conti affiliate). DEV-0390’s intrusions initiate
from malware but use legitimate tools toexfiltrate data and extort payment. They
deploy penetration testing tools like Cobalt

Problem

12
3
4

Stolen passwords and unprotected identities
More than malware, attackers need credentials
to succeed. In nearly all successful ransomware
deployments, attackers gain access to privileged,
administrator level accounts granting broad accessto an organizations’ network.

Missing or disabled security products
In almost every observed ransomware incident, at least one
system exploited in the attack had missing or misconfigured
security products that allowed intruders to tamper with or
disable certain protections.

Misconfigured or abused applications
You might use a popular app for one purpose, but that
doesn’t mean criminals can’t weaponize it for another goal.
Too often, “legacy” configurations mean an app is in its
default state, allowing any user wide access across entire
organizations. Don’t overlook this risk or hesitate to change
app settings for fear of disruption.

Slow patchingIt’s a cliché, like “Eat your vegetables!” – but it’s a critical
fact: The best way to harden software is to keep it
updated. While some cloud based apps update with nouser action, companies must apply other vendor patches
immediately. In 2022 Microsoft observes that older
vulnerabilities are still a primary driver in attacks.

Defendingagainst attacks
Strike, Brute Ratel C4, and the legitimate
Atera remote management utility tomaintain access to a victim. DEV-0390 will
escalate privileges by stealing credentials,
locate sensitive data (often on corporate
backup and file servers), and send thedata to a cloud file sharing site using a file
backup utility.
DEV-0537 uses a very different strategy
and tradecraft. Initial access is obtainedby purchasing credentials on the criminal
underground or from employees attargeted organizations.

Action12

34Authenticate Identities
Enforce multifactor authentication (MFA) on all accounts,prioritize administrator and other sensitive roles. Witha hybrid workforce, require MFA on all devices, in all
locations, at all times. Enable passwordless authentication
like FIDO keys or Microsoft Authenticator for apps that
support it.

Address Security Blind Spots
Like smoke alarms, security products must be installed in
the correct spaces and tested frequently. Verify that security
tools are operating in their most secure configuration, andthat no part of a network is unprotected.

Harden internet facing assets
Consider deleting duplicative or unused apps to eliminaterisky, unused services. Be mindful of where you permit
remote helpdesk apps like TeamViewer. These arenotoriously targeted by threat actors to gain express
access to laptops.

Keep systems up to date
Make software inventory a continuous process. Keep trackof what you are running and prioritize support for theseproducts. Use your ability to patch quickly and conclusively
to gage where transitioning to cloud based services isbeneficial.

5Defending
against attacks
Understanding the interconnectednature of identities and trust
relationships in modern
technology ecosystems, they target
telecommunications, technology, IT
services, and support companies toleverage access from one organization
to gain entry into partner or supplier
networks. Extortion only attacks
demonstrate that network defenders
must look beyond end stage
ransomware and keep a close eye on
data exfiltration and lateral movement.

an attack by a sophisticated attacker,
ransomware is an avoidable disaster.
Reliance on security weaknesses byattackers means that investments incyberhygiene go a long way.

If a threat actor is planning to extort
an organization to keep their data
private, a ransomware payload is theleast significant and least valuable partof the attack strategy. Ultimately, it’s anoperator’s choice what they choose to
deploy, and ransomware is not always
the big ticket payout every threat actor
is after.

Integrated threat protection acrossdevices, identities, apps, email, data, andthe cloud helps us identify attacks thatwould have been labeled as multiple
actors, when they’re in fact a single setof cybercriminals. Our Digital Crimes
Unit composed of technical, legal, andbusiness experts continues to work withlaw enforcement to disrupt cybercrime.

Microsoft’s unique visibility gives us alens into threat actor activity. Rather
than rely on forum posts or chat leaks,
our team of security experts studies new
ransomware tactics and develops threat
intelligence that informs our securitysolutions.

While ransomware or double extortion
can seem an inevitable outcome from

Recommendations:
Harden the cloud: As attackers movetoward cloud resources, it’s importantto secure these resources and identities
as well as on-premise accounts. Security
teams should focus on hardening security
identity infrastructure, enforcing multifactor
authentication (MFA) on all accounts, andtreating cloud admins/tenant admins withthe same level of security and credential
hygiene as domain admins.

Prevent initial access: Prevent code execution
by managing macros and scripts, and enabling
Attack Surface Reduction Rules.
Close security blind spots: Organizations
should verify that their security tools are
running in optimum configuration and perform
regular network scans to ensure a security
product protects all systems.
Microsoft has in-depth recommendations at
https://aka.ms/ransomware-as-a-service.

6

Expert Profile
Emily Hacker:

Threat intelligence analyst
Emily Hacker did not expect to become a threat
intelligence analyst at Microsoft after studying
journalism in college. Her first job in cybersecurity
was as a technical writer at an oil and gas firm.
“I was editing intelligence reports, intelligencepresentations, and helping with incident metrics.
Over the course of that first year, I became
absolutely enthralled with the work that intelligence
analysts do.”Emily’s work at Microsoft began in 2020 as ananalyst for Microsoft Defender for Endpoint andMicrosoft Defender for Office. One of the focus
areas for these teams is to protect customers fromthreats associated with ransomware. Emily is directly
involved in many of the investigations that built
Microsoft’s knowledge of the RaaS economy and theaccess broker/operator/affiliate relationship, actively
hunting for evidence of pre-ransomware signals.
“Following trends and techniques used by RaaS
operators and their affiliates in the pre-ransom
phase of an incident is critical to protecting
customers from these types of threats,” she said.
“My job is to spot these pre-ransomware actors
as early as possible. If you are only looking for theransomware payload, itself—you’re too late.”
To stay on top of the changing RaaS landscape,Emily and her team use a combination of automatedsystems and human analysis to analyze, escalate,
and act on logs, alerts, and other activity in realtime. Emily’s team helps anticipate, pre-empt, andrespond to different incidents on the front lines

Cyber Signalsof customers’ networks, while also contributing to
MSTIC’s ever growing assessment of ransomware
linked actor tools, motives, and strategies.
When it comes to a ransomware incident, the stakes
can be incredibly high. Ransomware operators
are known to target critically important networks
related to education, transportation, healthcare, ortelecommunications systems. When these networks
are affected, the results can be catastrophic.
“The work we do at Microsoft to track and prevent
ransomware incidents is important because
we’re protecting not just our customers, but theircustomers as well,” Hacker said. “Identifying thetools and techniques associated with ransomware
and pre-ransomware incidents as early as possible
is critical when these incidents have potentiallywide-reaching consequences for companies, theiremployees, and their customers.”“ My job

is to spot thranso
ese prmwar
e actsepossib
as early
le. If yas
ou arefor thonly le ransoomwa
oking
itself—re payyou’reload,
too late.”
ThreatEmily intelligence
Hackeanalystr

7lednuBderone frewot
segse
auy onpackB

1. Methodology: For snapshot data, Microsoft platforms, including Defender and Azure Active Directory,
and our Digital Crimes Unit provided anonymized data on threat activity, such as malicious email accounts,
phishing emails, and attacker movement within networks. Additional insights are from the 43 trillion daily
security signals gained across Microsoft, including the cloud, endpoints, the intelligent edge, and ourCompromise Security Recovery Practice and Detection and Response teams. Cover art is representative of
the affiliate business model. Percentages do not represent actual discounts. Cover stat is based on Microsoft
engagements over the past year.
© 2022 Microsoft Corporation. All rights reserved. Cyber Signals is for informational purposes only.
MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THISDOCUMENT. This document is provided “as is.” Information and views expressed in this document, including
URL and other Internet website references, may change without notice. You bear the risk of using it. This
document does not provide you with any legal rights to any intellectual property in any Microsoft product.