Volume 6

ISSUE 16Growing Threat of DDoS
Attacks by Extortionist
Threat Actors

ISSUE 17

Initial Access Brokers:
Fueling the Ransomware
ThreatISSUE 18

Deep Dive Into PYSA 
Ransomware

The Monitor / Volume 6

Issue 16 – DDoS Attacks

ISSUE 16Growing Threat of DDoS
Attacks by Extortionist
Threat Actors
Kroll experts have noticed an increase in distributed denial of service(DDoS) attacks by cybercriminals seeking to turn a profit in two distinct
incident types. First, many ransomware operators are now threatening
and conducting DDoS attacks as an additional pressure tactic during theransom negotiation process. Second, also known as ransom denial ofservice (RDoS), attackers threaten DDoS attacks that will take down
an organization’s public-facing services unless a ransom is paid.

What Is DDoS?

Attacker Insights and Motivations

DDoS attacks are designed to take advantage of
bottlenecks within an organization’s systems. If a
website or other internet-facing service is flooded
with more data, traffic or requests than it canhandle, the system may be unable to respond tolegitimate requests and ultimately crash. Attackers
often use this method as a means of causing
confusion within an organization’s systems toprevent regular business activity and distract
employees while data is exfiltrated.

Multiple ransomware gangs have added DDoS
attacks as another pressure tactic during theransom negotiation process. Figure 1 highlights a
DDoS threat posted to the Avaddon ransomware
group’s actor-controlled site. Such activity
frequently occurs when negotiation discussions
stall as a means for the ransomware gangs toforce the victim to resume discussions.

Figure 1 Avaddon DDoS Threats
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext

2

The Monitor / Volume 6

RDoS Attack Patterns
An RDoS attack adds an extortion element
to a standard DDoS attack. In these instances,a cybercriminal may threaten to perform a DDoS
attack against an organization unless a ransom ispaid. In these scenarios, the actors will perform
a “teaser” DDoS attack, sending anywhere from
50–100 gigabytes per second (Gbps) against an
IP address associated with the target to provetheir ability to perform the attack.
After the initial “teaser” attack, threat actors willoften threaten higher-volume attacks that may
cause more damage to public-facing services
unless the ransom is paid. In order to provide
legitimacy to this threat, actors may masquerade
as well-known advanced persistent threat (APT)groups. In reality, the groups sending the extortion
letters commonly lack the ability to actually carryout the DDoS attacks they threaten. These letters
typically come in waves following news reports ofmajor DDoS attacks or the discovery of a newvector for carrying out DDoS attacks. Sometimes,
the attacker may not carry out the follow-on attack,even if the target does not pay the ransom demand.
On occasion, an organization may not experience a“teaser” attack at all but rather just receive a letter
threatening such activity. Receiving an RDoS
extortion threat via letter does not mean that anorganization is under threat of an attack. In fact,
most legitimate RDoS attackers work under theradar and will not provide any warning before
carrying out their sample attack.

Issue 16 – DDoS Attacks

Some common features of attempted RDoS
attacks identified by Kroll analysts include:• Protocols: RDoS attackers use a variety ofdifferent network protocols to flood a target
system with traffic. These attacks can takeadvantage of DDoS amplification, where
spoofed traffic sent to a particular service
results in much larger responses being sent
to the target system.
• Volume: RDoS attacks can achieve highbandwidths of malicious traffic. The largest
attack observed by Kroll reached a peak of
approximately just under 200 Gbps.
• Targets: The IP addresses targeted in these
attacks are located in different places. Often,these are systems with a single public-facing
SSH, RDP, NetBIOS, or HTTP
port open to the internet.
• Botnets: DDoS attackers commonly use a
network of compromised computers to generate
the malicious traffic in their attacks. In general,many of these systems are internet of things(IoT) devices and other computers that arecompromised due to their use of weakusernames and passwords.
These RDoS attacks can easily take down underprotected public-facing services. However, a DDoS
mitigation solution with robust traffic scrubbing
capabilities can easily handle attacks of thisvolume.

3Issue 16 – DDoS Attacks

ILLUSTRATIVE CASE STUDY
In a recent Kroll engagement, a victim was the target of an RDoS attack performed by agroup claiming to be an advanced persistent threat (APT) group. The DDoS attack took
down the company’s internet-facing assets.
A few employees received a ransom note via email that had supposedly come from thecriminals, with instructions on when and how the company could make payments toprevent a future attack from occurring.
The organization reached out to Kroll to help with managing the incident. Kroll analysts
took several steps to improve the company’s security posture and protection against
DDoS attacks:• Compromise assessment: DDoS attacks commonly originate from outside the victim’s
network and may not indicate the organization had been compromised, but it’s important
to confirm whether the criminals had established any sort of foothold within the impactedorganization.
• Gap analysis: Kroll analysts began with an analysis of the organization’s defenses
against different types of DDoS events. This included evaluating the current protective
technologies that were in place, reviewing the company’s overall network architecture,and identifying vulnerabilities that could be exploited by a DDoS attacker.
• Risk management recommendations: Basedon the results of the gap analysis, Kroll analysts provided recommendations on steps
that the organization should take to both mitigate the short-term threat of the RDoS
attack and manage their cyber security risks in general.
• Threat intelligence research: Kroll’s threat intelligence research helped theorganization better understand the common tactics, techniques and procedures usedby the criminal group and assess which other threats posed the highest risk, based on
the organization’s footprint.

4

The Monitor / Volume 6

The Monitor / Volume 6

Issue 16 – DDoS Attacks

KROLL EXPERTS CORNERJames McLeary
Managing Director
Cyber Risk

Protecting Against DDoS Attacks
The following recommendations, provided by Kroll
expert James McLeary, should be taken into
consideration to protect against the threat of
DDoS attacks:• Consider implementation of DDoS scrubbing(cloud-based DDoS mitigation) solutions togive additional protection but ensure multilayered overall approach across cloudprotection, CDN, DNS and application-based
appliances• Contact your incident response partners andconsider methods such as rate limiting, port
blocking and blocking specific servers, if undersuch an attack• Provide indicators of compromise to yourinternet service providers (ISPs) so they canalso action responsive measures• Ensure good cyber hygiene in yourenvironment—identify prioritized assets that
require extra protection and ensure yourvulnerability and patch management is up
to date• Develop a DDOS incident response playbook
and test it to solidify what to do during
detection, response and recovery• Consider the use of out-of-bandcommunication channels for crisis handlingthat do not rely on ordinary corporate
infrastructure. For example, if your corporate
email, messaging and Active Directory services
are affected by DDoS, the team can quickly
switch to using temporary webmail, instantmessaging or group chat applications, whilst
being aware of the risks that this may pose

To adequately protect your organization from a DDoS attack, it is important to implement
good cyber hygiene to ensure you’re covered. In the event of an attack, Kroll experts canhelp respond. For further guidance, contact a Kroll expert at one of our 24x7 cyber incident
response hotlines or connect with us through our Contact Us page.

5

The Monitor / Volume 6

Issue 17 – Initial Access Brokers

ISSUE 17

Initial Access Brokers:
Fueling the Ransomware Threat
Kroll has observed an uptick in actors offering network access on the dark
web, particularly in the wake of recent disruptions to the ransomware-asa-service (RAAS) ecosphere such as the ban on ransomware discussions
in notorious underground criminal forums.

Understanding the Initial Access
Broker Process
Threat actors who offer network access, known
as initial access brokers, operate at the beginningof the intrusion lifecycle by conducting
reconnaissance to identify networks withvulnerable applications or devices, including
Virtual Private Network (VPN) appliances, servers
with exposed software vulnerabilities or open
Remote Desktop Protocol (RDP). During the lastyear, multiple VPN providers have announced
critical vulnerabilities, many of which could be
exploited by attackers to access sensitive datasuch as login credentials. Open RDP instances areoften exploited by actors testing credentials via
brute-force attacks such as password spraying orby actors testing credentials related to the target
network which are publicly exposed in credential
dumps on the dark web.

6

Once access is achieved, access brokers advertise
their network access on dark web forums, seeking
to sell the validated credentials to ransomware
operators, affiliates or other criminals wholeverage the initial access to conduct a number ofdifferent cyber attacks such as data theft or
encryption. In particular, ransomware operators
are known to purchase such listings and provide
them to their affiliate distributors who thenengage in the intrusion lifecycle to execute codeon the target network for lateral movement,
conduct privilege escalation and ultimately,
mission execution in the form of data theft, data
destruction or ransomware deployment.
This segmented approach of RAAS operators
creates more layers of intermediaries between theoperators and the actors on the ground who carryout the attack, decreasing the risk of exposure andlaw enforcement apprehension.

The Monitor / Volume 6

Issue 17 – Initial Access Brokers

Figure 1 illustrates an auction page in a dark web marketplace advertising RDP/VPN credentials.

Kroll Observations
In incident response investigations, our digital forensic examiners often identify a single
suspicious VPN or RDP log-in that predates the ransomware activity by several days, weeks
or, at times, months. That first suspicious log-in is likely to be the initial access broker testing
credentials and identifying a “match” for a username and password combination. The user
account or internal user’s computer that the unauthorized actor first lands on as a result of
the log in success is what investigators associate with “patient zero” for the incident
investigation. Subsequent analysis of the target organization domain has frequently
identified that the credentials related to “patient zero” were readily available in various
credentials dumps posted to the dark web.

EXAMPLE ENGAGEMENT
Multiple times in the past year, Kroll has observed threat actors in dark web forums sharing
large datasets related to confirmed credentials for various VPN applications. In August
2020, a technology company experienced a ransomware attack. That same month, a large
dataset of VPN credentials was briefly posted on a dark web forum. Kroll’s identification
and review of that dataset identified multiple account credentials available from theorganization’s employees, matching up nearly 100% with the accounts that the threat
actors had accessed during the attack. This illustrated the likelihood that actors conducting
ransomware attacks have access to initial lists of legitimate credentials, highlighting how
dark web postings assist ransomware threat actor groups and organized crime affiliates torepeat their intrusion lifecycles against victims.

7

The Monitor / Volume 6

Issue 17 – Initial Access Brokers

KROLL EXPERTS CORNER

Keith Novak
Managing Director,
Cyber Risk

Keith Novak provides best practices to mitigate against the effectiveness of initial access brokers:

1 Awareness Training

3 Vulnerability Management

Training employees to identify and reportphishing emails remains a critical component of
every organization’s security defenses. An
organization should build on employee training
with technical response procedures that guidethe IT or InfoSec teams on the investigation andresponse to phishing attempts.

Actor groups don’t always rely on phishing toobtain their access. In fact, many threat actor
groups exploit unpatched public facing systems
and services to gain their initial foothold andexfiltrate usernames and passwords frominternal systems that have been compromised.
A mature vulnerability management program
should include routine scanning of all external
and internal systems, devices, and applications
for vulnerable software and the timely
application of patches from the vendors toremediate them.

2 Multi-Factor Authentication (MFA)
MFA pairs a username and password with aunique second factor which can include a PIN or
biometric that prevents an attacker who
obtained user credentials from logging in as alegitimate employee. MFA should be required
for all remote access, cloud services, andprivileged access accounts and remains one of
the top recommendations for any organization.

8

4 Public Facing Systems
Reducing an organization’s public facing
systems and services is a great way to reduce
the risk of initial compromise. For example,
attackers routinely target Microsoft RDP
services for both vulnerabilities as an entry
point using phished user credentials. Moving all
remote access services behind a corporate
remote access VPN connection, requiring MFA,
and posture-checking the users’ device can bevery effective at defending against
unauthorized access.

The Monitor / Volume 6

Issue 17 – Initial Access Brokers

5 Passwords

6 Digital Risk Protection (DRP)

When it comes to password best practices,a few concepts continue to be proven true
including: requiring the use of MFA, the longer
the password the better, utilizing password
managers, preventing the caching of passwords
on user systems and browsers, and not sharing
credentials with others.

Proactive monitoring of dark web forums andother remote corners of the internet can help
spot when corporate credentials are exposed ina new auction, or if attackers are impersonating
your domains for phishing campaigns. Consider
incorporating DRP in your security program.

To protect your access credentials and prevent them from possibly appearing on thedark web for auction, it is important to set up proper precautions including ensuring
good password hygiene and enabling MFA. Kroll’s Digital Risk Protection services canbe used to monitor the deep and dark web for any exposures including any accesscredentials from your organization. Our experts will monitor for any threats, andprovide assessments of exposure and vulnerabilities, delivered with actionable advice
for how to protect your organization. For further guidance, contact one of our Kroll
experts at one of our 24x7 cyber incident response hotlines or connect with us throughour Contact Us page.

9

The Monitor / Volume 6

Issue 18 – PYSAISSUE 18

Deep Dive Into PYSA Ransomware
PYSA is the most recent ransomware variant known distributed by the
Mespinoza Ransomware as a Service (RaaS) gang, which has been infecting
victims since 2019. Kroll has consistently observed PYSA in our incident
response engagements since 2020 and has noted an increase in frequencyof this variant since the second quarter of 2021.
Our analysis shows PYSA is opportunistic and not restricted to one sector or geographicalarea. PYSA primarily leverages exposed Remote Desktop Protocol (RDP) to gain a foothold
into a network. Once inside a network, PYSA deploys several tools, including custom-built
scripts written in GO language to maintain persistence. During their time in a network, thegroup focuses on exfiltration of data followed by encryption. Victims are then extorted fordecryption services and to ensure that confidential information is not leaked.

Initial Access
Similarities across PYSA investigations such as
tactics, infrastructure and the steady developmentof capabilities, suggests that the group is operated
manually by a single group of actors. Initial accessis usually gained through internet exposed RDP byusing active, valid accounts. These accounts areaccessed by brute force or previously exposed
credentials from other breaches.
Once they have accessed a network, PYSA threat
actors use discovery tactics to identify admins andother systems on the network. Tools such as
AdvancedIPScanner and AdvancedPortScannerare commonly used during this process. PYSA will
dump Local Security Authority Subsystem Service(LSASS) in order to gain enhanced privileges orfurther access to other privileged accounts before

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext

10

using Mimikatz to extract account information andpasswords. Precursor PowerShell scripts are often
run to disable anti-virus and other security
mechanisms, the deletion of volume shadow
copies, disable services and to identify documents
of interest prior to encryption.
In our observation, loiter time for PYSA is longer
than the average ransomware event, likely due
to the manual nature of the attack. Earlier activity
relied on maintaining access to valid accounts,
however the group has recently been observed
using a Golang tool known as Chisel to maintaincommand and control. The tool operates a tunnel
over HTTP secured by Secure Shell (SSH)to passthrough firewalls, allowing “hands-on” access tothe target environment.

The Monitor / Volume 6

Issue 18 – PYSA

The main goal of a PYSA attack is extortion for data encryption and data leakage. They typicallyoffer to decrypt and not leak stolen information if the victims pays the requested ransom. Oncea network is encrypted, PYSA drops a ransom note (Readme.Read) and locks files with theextension .<domain> or .pysa. The ransomware binary writes the note to the registry key below,
which displays the ransom note on logon.
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext

PYSA Exfiltration Tactics, Techniques and Procedures
To locate documents for exfiltration, PYSA uses automated scanning of systems with
PowerShell by using a script that searches 123 keywords. Files can contain personal
identifiable information (PII), tax and financial information, login credentials, legal documents,
incriminating evidence and other sensitive information. Exfiltration has been achieved throughthe mounting of file shares on adversary infrastructure and the use of tools such as WinSCP.
PSYA will post these files on their actor-controlled site, the home page of which advertises theslogan “Protect Your System Amigo.” (Figure 1) PYSA typically adds new victims 1-2 times permonth with each “update” possibly including 5 to 20+ victims. Recently, the threat actors have
implemented CAPTCHAs to the shaming site in order to view published exfiltrated data.
We have observed that the time lag between encryption and data publication is longer for
PYSA than other ransomware variants. In some instances, Kroll has identified victims posted
to the actor-controlled site upwards of three months past the date of encryption.

Figure 1 - PYSA Actor-Controlled Site Home Page (SOURCE: Kroll)

11The Monitor / Volume 6

Issue 18 – PYSA

Victim Trends
Although the most common sector targeted is education, PYSA targeting includes a wide
spectrum of sectors such as medical, manufacturing, construction, local government,
transport and retail. This is not an all-inclusive list.

Mespinoza (PYSA) Doxxing Victims by Sector

0

5

10

15

20

Figure 2 - PYSA Victims by Sector (Data Source: Intel471)

55% of victims are located within the United States. However, companies in other countries
such as the United Kingdom, Brazil, Italy, Canada, and France have all faced numerous attacks.

1225

The Monitor / Volume 6

Issue 18 – PYSA

Mespinoza (PYSA) Doxxing Victims by Region

0

10

20

30

40

50

60

70

80

Figure 3 - PYSA Victims by Region (Data Source: Intel471)

EXAMPLE ENGAGEMENT
In a recent Kroll engagement, a multinational company in the food and beverage industry
was targeted by PYSA and had their data exfiltrated and a ransom demanded. The initialaccess point for the threat actors was the organizations’ exposed RDP. One month after the
initial access, ransomware was executed. Data exfiltration was conducted via a Server
Message Block (SMB) protocol-based share to an internally hosted web server, where theadversary left the remote share over-exposed. This allowed the exfiltrated files to beviewed on PYSA’s server for a short while.

13

The Monitor / Volume 6

Issue 18 – PYSAKROLL EXPERTS CORNERPaul Wells
Vice President, Cyber Risk

James Thoburn
Senior Vice President, Cyber Risk

Paul Wells and James Thoburn in our practiceprovide recommendations to keep yournetwork secure and prevent PYSA from being
able to access your data.

can be an effective method of identifying
whether your exposure has changed. Ideallythis should be conducted by an independent
third party to ensure a thorough check.

We observed PYSA exploiting exposed RDP
services. This is not a tactic unique to thisgroup and is used by many threat actors as aquick method to get an easy foothold into an
environment. Securing RDP connections isimportant for all organizations, but it can bechallenging for geographically dispersed andcomplex IT infrastructures.

• Secure RDP connections. RDP systems
exposed to the internet will be vulnerable
to brute force attacks, credential stuffing
and potential vulnerabilities within theservice. Best practice is to ensure all RDP
services run within a virtual private network(VPN) solution to restrict external access.

• Understand your internet footprint.
External RDP services are often enabled tosolve short term issues or for a development
environment. These can fly under the radarof the usual security controls and may
present an unexpected weak spot attractive
to attackers. Conducting regular assessmentsof what services are exposed to the internet• Enable Network Level Authentication(NLA) for RDP. NLA requires
authentication prior to a session being
established. If NLA is not enabled, threat
actors may be able to enumerate user
accounts and fingerprint the Windows
version. Vital intelligence for any motivatedadversary.

PYSA is dependent on PowerShell scripts for reconnaissance, disruption and in somecases even encryption. Modern Windows operating systems include the Anti-Malware
Scan Interface (AMSI) to enable anti-virus agents to detect and block malicious scripts.
However, older operating systems, such as Windows 2012, do not include AMSI, so
malicious scripts are unlikely to be detected and blocked. Therefore, it is important toassess the operating systems deployed within your environment and to make suremitigation strategies are in place for any machines that do not conform to the hardening
policy. Restricting the number of accounts that can run PowerShell may also reduce theability of PYSA to operate as effectively within the network during their intrusion lifecycle.

14

The Monitor / Volume 6

Contacts
Keith Wojcieszek
Managing Director, Cyber Risk
+1 443 295 5082
keith.wojcieszek@kroll.com
Based in Washington, D.C., Keith joined Kroll from the United States Secret Service, where
he served with distinction for 15 years. Most recently, Keith led the USSS Cyber Intelligence
Section, Criminal Investigation Division, where he managed the agency’s national response to
cyber investigative initiatives focused on protecting the financial infrastructure of the UnitedStates. In this role, Keith also coordinated complex international investigations that targeted
transnational organized crime networks with an emphasis on cyber and information security.

Nicole Sette
Senior Vice President, Cyber Risk
+1 609 514 8225
nicole.sette@kroll.com
Based in the Secaucus office. Nicole is a highly accomplished security professional, whobrings unique insight to the multiple dimensions inherent in client challenges from her yearsof federal law enforcement and military experience. Nicole served as a Cyber Intelligence
Analyst with the Federal Bureau of Investigation for nearly 10 years, and was an IntelligenceSpecialist with the U.S. Army Communications-Electronics Command for four years.

Laurie Iacono
Senior Vice President, Cyber Risk
+1 412 588 4337
laurie.iacono@kroll.com
Based in the Secaucus office, Laurie is an experienced cyber intelligence professional witha focus on tracking threat actor groups affiliated with ransomware-as-a-service operations.
Laurie joined Kroll from the NCFTA where she led a team of intelligence analysts focusing
on cybercrime and dark web investigations across multiple industries.

15

Browse the latest editions of The Monitor
and subscribe free at kroll.com/themonitor
About Kroll
Kroll is the world’s premier provider of services and digital products related to valuation, governance, risk and transparency. We work with clients across diverse sectors in
the areas of valuation, expert services, investigations, cyber security, corporate finance, restructuring, legal and business solutions, data analytics and regulatory compliance.
Our firm has nearly 5,000 professionals in 30 countries and territories around the world. For more information, visit www.kroll.com.
M&A advisory, capital raising and secondary market advisory services in the United States are provided by Duff & Phelps Securities, LLC. Member FINRA/SIPC.
Pagemill Partners is a Division of Duff & Phelps Securities, LLC. M&A advisory, capital raising and secondary market advisory services in the United Kingdom areprovided by Duff & Phelps Securities Ltd. (DPSL), which is authorized and regulated by the Financial Conduct Authority. Valuation Advisory Services in India
are provided by Duff & Phelps India Private Limited under a category 1 merchant banker license issued by the Securities and Exchange Board of India.
© 2022 Kroll, LLC. All rights reserved. KR21221627