VOLUME 1
Issue 1Business Email Compromise Trends

Page 2

Issue 2

Ryuk Ransomware and Cyber Hygiene

Page 4

Issue 3

Boosting Your Insider Threat Program

Page 6Issue 1

The Monitor - Volume 1

Business Email Compromise Trends
and Mitigation

Kroll identified 25 business email compromise (BEC) incidents during the month of January 2019 alone, marking a
growing trend. Among the BEC incidents that Kroll reviewed, representative attacks led to unauthorized changes todirect deposit information, unauthorized mail forwarding and fraudulent wire transfers of up to $5 million.
BEC incidents most commonly involved an actor compromising an Office 365 Outlook account. For example, Krollreviewed an incident where a human resources employee complained to her payroll department that her banking
information had been changed. Payroll investigated and found an email record from the employee requesting thechange. Upon further investigation, the company discovered unauthorized logins to the employee’s Office 365
account from an external IP address. A malicious actor had likely obtained her Office 365 credentials and was able
to use her email account to request a change in banking information.
Corporate executives are under particular assault by BEC attackers. Managing Director Jonathan Fairtlough
explains, “Criminals are focusing their efforts on executives not only because of their access to high-value data, butalso their reach throughout the entire enterprise. Companies should back up executive training with technology thatprovides early detection of problems to reduce the opportunity for lateral movement once a hacker breaches theirsystems.”
Jonathan continues: “While senior executive accounts are commonly targeted, it is important to note that any
employee routinely accessing customer account data or treasury functions is at risk.”
BEC attacks also continue to be highly lucrative for cybercriminals in the form of wire transfer fraud. According to
the FBI, in 2018 nearly 21,000 victims lost close to $1.3 billion. “Wire fraud highlights a persistent security
weakness — our human nature. In the cases we’ve seen, when employees receive requests from senior executives,
the motivation to assist the person higher in rank outweighs the need to stop and validate that the request islegitimate” says Peter McFarlane, Managing Director and Toronto Office Head.
According to Peter, tone from the top is critical for combating this crime: “A company’s most senior managers needto make it absolutely clear to everyone involved in approving wire transfers that no one, no matter their rank, canoverride policies or proper procedures.”

Kroll, a division of Duff & Phelps

2The Monitor - Volume 1

Issue 1

Technically Speaking
The growing adoption of Microsoft Office 365 requires specialist skills insecuring and/or investigating the environment in the event of BEC andinsider threats. Check out these Kroll resources for insights to help you
better meet the challenges ahead:•“strategic marketing advice”) or referenced as aFirst presented at SANS DFIR Summit 2018, this talk by Managing(e.g., “confidential joint venture investment”).

Director Devon Ackerman discusses numerous forensic, incident

Instructions regarding recording of the transaction

response and evidentiary aspects of Office 365. Based on two years

are also vague (e.g., “corporate marketing”).

Office 365 investigations, primarily BEC and insider threat cases.
View now.

Unknown beneficiary and round-sum amounts.
The beneficiary is typically a person/entity unknown
to the organization and may reference a jurisdictionin which the organization typically does not

Penetration Testing for Active Directory Forests: Exploring Trust

conduct business. Round-sum amounts, such as

Relationships. Active Directory (AD) is a critical software for most“$200,000,” should raise suspicions, althoughorganizations in that it serves as the single centralized point for

many fraudsters are aware of this and often

handling authentication and authorization control access to all critical

avoid them.

resources within an organization. As Kroll’s security penetration testing
lead Carlos Garcia discusses in this article, compromise of just one
domain admin account in the AD forest could give an attacker
unrestricted access to all resources managed by all domains, users,
servers, workstations and data. Read more and download slides here.

Case Studies
As these recent Kroll cases demonstrate, BEC incidents are not goingaway and warrant ongoing vigilance.
Hackers sent a legitimate-looking phishing email from an accountbelonging to one large company’s Director of Corporate Services toapproximately 900 external recipients and 400 internal recipients atthat company. In this case, any of those emails could have been used•

The transaction is described in vague terms (e.g.,
confidential matter known to senior management

365 and Azure environment, it also encompasses more than a hundred•

Unusual or vague transaction details.

A Planned Methodology for Forensically Sound IR in Office 365.

of forensics and incident response data collection in Microsoft’s Office•

BEC Red Flags for Wire Fraud

Absence of required supporting documents.
Normal wire transfer requests should be supported
by appropriate documentation available to boththose preparing and approving the transfer.
Fraudulent requests often state supporting
documents will be provided later or were provided
to the CEO or other senior executives.
Non-standard email format.
Any irregularity in email headers, footers andcontent such as John.Doe@acme.com rather than
the standard format jdoe@acme.com or use of an
atypical font or email footer suggest that it could bea fraudulent communication (in addition to a false

to initiate unauthorized BEC transactions.

email domain).

A supervisor at a financial services company received an email request

Requirement to circumvent normal protocols.

from a business associate at another financial institution. Despite

A pretext is often presented to justify the need andrecognizing the request was somewhat out of character, the supervisor

urgency to circumvent normal protocols. These– who routinely works with financial information – opened theinclude reasons such as the funds must be

attachment expecting an invoice. The document was in fact a

received before end of business the next day tomaliciously crafted document which triggered a chain of events on theclose a confidential transaction, avoid penalties or

endpoint that were invisible to the user.

avoid seizure of product.

Kroll, a division of Duff & Phelps

3The Monitor - Volume 1

Issue 1

Kroll Experts Corner:
Mitigating Business Email Compromise
Following are some insights from Kroll experts on how to prevent or mitigate the harms from business email compromise.

Implement Multifactor Authentication

Raise awareness of spoofed domains

Requiring that all users- especially senior and treasury staff use

Hackers will often buy a domain that is similar to a vendor

a multi factor authentication system to access email is the mostor client’s name but will change one letter or spell theeffective mitigation step to take. A phishing attempt or credential

name differently. Employees in payroll and other financetheft can be effective, but without the additional token or accessdepartments should receive training on how to recognize

method, the attacker cannot access the mailbox.

spoofed domains or emails; additionally, create protocols

Review Email system Configuration
Email systems need to be properly configured and regularly
reviewed. There are many modern security processes to securely

for double-checking domain names and email accounts
to ensure the accounts match up to the legitimate
company name and domain.

configure an email system like Office 365 to enforce trusted

Implement dual verification procedures for financial

relationships with common clients and partners, and to track andtransactions, including wire transfer requests

block misuse. A security professional needs to review email

Many BEC attempts rely on creating a sense of urgency

configurations, regularly log and review the use of forwarding

or presenting a business case that pressures the targeted

rules, domain trust settings, and external exchange access.

individual to quickly transfer funds or edit banking
information, so the attacker can swiftly carry out

Phishing Training

fraudulent activities. Ensure mechanisms are in place to

Implement regular phishing awareness training and consider

validate requests before action is taken, such as

implementing testing to review how many users within thepredefined escalation protocols. Also, build a corporate

organization are clicking on phishing links. Phishing emails canculture that stresses defined channels and protocols

be used to compromise network credentials and carry out BEC

cannot be circumvented by anyone, no matter how senior.

attacks against your organization.
Beware of social media links
Recent open source reporting highlights an increase in phishingemails designed to look like LinkedIn updates with titles like“profile views” and “InMail message”. These emails can be used toharvest credentials for use in BEC scams. Train employees to use
caution when opening these types of messages in their corporate
mail accounts.

Get the Latest Trends andInsights from Kroll In Your Inbox
Sign up for The Monitor newsletter and every month
you’ll gain access to exclusive cyber threat trends
derived from Kroll’s global case intake, along with
tailored recommendations and examples from ourthreat intelligence experts.
 Free subscription at kroll.com

Kroll, a division of Duff & Phelps4Issue 2

The Monitor - Volume 1

Ryuk and the Resurgenceof Ransomware

Kroll identified 15 ransomware cases in the month of February 2019, with a particular presence of the Ryuk variant
in the majority of investigations. we noted the highly opportunistic Ryuk variant seizing on vulnerable networks, with
attacks across industry sectors, including manufacturing, government, education, professional services andhealthcare.
Kroll reviewed Ryuk ransom notes that directed victims to contact a Swiss-based ProtonMail email address. Thenthe attackers followed up with varying demands for payment in bitcoin. Based on our experience and other reports,
most Ryuk ransomware attacks follow this pattern.
However, Ryuk mainly differs from other ransomware families based on its delivery mechanism. Most types ofransomware rely on phishing attacks or open Remote Desktop Protocol (RDP) connections. Ryuk most often
leverages established command and control servers associated with Trickbot and Emotet banking trojans. This
allows the Ryuk attackers to access a large swath of victims and “cash in” on high-value Trickbot and Emotet
victims; they then tailor ransom demands to each organization. (See the Technically Speaking section in thisnewsletter for a representative attack sequence.)
While Ryuk attackers profit from their ties with these trojans, the connection also provides a tripwire that can alert
victims to a potential ransomware attack following a trojan infection. “Ransomware in 2019 is significantly different
than ransomware in 2017, with attackers leveraging the access gained with Trickbot and Emotet, which usually
includes domain administrator access. Attackers now spend far more time performing reconnaissance on an
impacted network, which allows them to have a high level of confidence that an organization will have to pay theransom. We have identified attackers deleting backups to make recovery increasingly difficult,” says AssociateManaging Director Pierson Clair.
Pierson continues, “Most trojans are introduced via methods such as social engineering attacks, specificallyinfected email attachments. Emotet and Trickbot are families of polymorphic malware, which makes them very
difficult for anti-virus to identify. However, we know these attack vectors can be addressed effectively with several
other proven measures. These range from human-focused efforts, such as educating employees and making social
engineering exercises part of broader technical penetration testing programs, to implementing layers oftechnological solutions, including threat intelligence and endpoint detection and response applications. So,
organizations can virtually head off Ryuk at the pass by implementing best practices that prevent Trickbot/Emotet
from getting a foothold in the first place.”

Kroll, a division of Duff & Phelps

5The Monitor - Volume 1

Issue 2

Technically Speaking
Following is a typical sequence of events that Kroll’s investigations have identified in the evolution of Emotet/Trickbot/Ryuk attack.

According to an FBI Flash, the Ryuk ransomware variant is marked•

by these characteristics:•

be downloaded, including PowerShell Empire, the Microsoft
Sysinternals tool psexec, or the penetration testing tool Cobalt

First appeared as a derivative of Hermes 2.1 ransomware andStrikebecame available on the open market as of August 2018•

Retains some aspects of Hermes code; all of Ryuk’s files•

systems, and begins encrypting files

added to the filename, while others do not
In other parts of the ransomware code, Ryuk has removed or•

Ryuk deletes all files related to the dropper used to deploy themalware•Ryuk has been deployed secondary to Trickbot and/or

Ryuk utilizes AES-256 to encrypt files and uses an RSA public
key to encrypt the AES key.

replaced features of its predecessor•

Once executed, Ryuk establishes persistence in the registry,
injects into running processes, looks for network connected filecontain the “HERMES” tag, but some of the files have .ryk•

After the initial attack, additional network exploitation tools may•

The Ryuk dropper drops a .bat file which tries to delete all
backup files and Volume Shadow Copies (automatic backup
snapshots made by Windows), preventing the victim fromrecovering encrypted files without the decryption program

Emotet banking Trojans, which use Server Message Block(SMB) protocols to propagate through the network and canbe used to steal credentials

Kroll, a division of Duff & Phelps

6The Monitor - Volume 1

Issue 2

Kroll Experts Corner:
Mitigating Ransomware
Following are some insights from Kroll experts on how to prevent or mitigate the harms from a ransomware attack, including the Ryuk variant.
Backups, backups, backups

Implement endpoint monitoring, detection and response

If ransomware does strike, and backups are valid and intact, thenSolutions such as Kroll’s CyberDetectER® Endpoint prevent therecovery is significantly easier. However, Managing Director Devon

spread of the attack by halting the execution of the code thatAckerman cautions that organizations might be operating under alaunches the encryption processes before it damages and cripples

false sense of security in their backups. “While many organizations

systems.

have robust processes for creating backups, a similar rigor often
doesn’t extend to validating the security controls around the
backups. For example, is the backup on an open network? Could abreached domain admin credential access the backup? Theseissues and more all leave open the possibility that an attacker could
destroy the backup repository.”
Conduct routine security risk assessments, including
vulnerability and penetration testing
Preventing trojans from entering and taking hold in your organization
will go a long way toward neutralizing the Ryuk ransomware threat.
Addressing fundamental cyber risks through expert assessments
and targeted testing can help prevent your organization from being

Use a firewall to prevent all public access to the Service
Message Block (SMB/port 445) and the Remote Desktop
Protocol (RDP/port 3389).
Remote access should be restricted to a dedicated server that
requires multi-factor authentication (MFA), which ensures sufficientprivilege access restriction and logging capability.
Configure file integrity monitoring
File integrity monitoring should also be configured to monitor filecreations in trusted locations, like the System32 directory. This canalso be used to monitor deletes, with an alert configured to fire on
excessive deletes in a row.

victimized twice. Tabletop exercises can also be instructive; practiceincident response scenarios that include complex attacks
combining disruption through ransomware, DDoS, network
downtime, etc.

Get the Latest Trends andInsights from Kroll In Your Inbox
Sign up for The Monitor newsletter and every month
you’ll gain access to exclusive cyber threat trends
derived from Kroll’s global case intake, along with
tailored recommendations and examples from ourthreat intelligence experts.
 Free subscription at kroll.com

Kroll, a division of Duff & Phelps

7Issue 3

The Monitor - Volume 1

Boosting Your Insider Threat Program:
Examples, Indicators, and Mitigation StepsIn March, nearly one in five of all Kroll’s Cyber Risk engagements were insider threat incidents, most commonly
affecting the healthcare and financial service industries. Kroll reviewed cases that involved former employees
gaining unauthorized access to data, as well as current employees inadvertently exposing confidential data.
According to the New Jersey Cybercrime Communications and Integration Cell (NJCCIC), “Insider threats can
include current or departing employees, contractors, third party vendors, technicians, business partners, andanyone granted administrator privileges. If organizations do not have the right preventative measures in place andmanagement is not cognizant of the indicators of an insider threat, they are putting themselves at great risk.”
Insider threat incidents involving former employees are increasing as companies move proprietary information to
cloud-based services. Departing employees with active credentials (their own or those of a co-worker) pose a threat
to even the most secure networks, as the examples below highlight:•

In a recent incident covered in open source news reports, a disgruntled former employee at a UK-based firmstole a coworker’s credentials and deleted 23 of his former company’s cloud servers.

•

A New Jersey woman stole trade secrets from her employer, posting the stolen material on the website of a
Chinese subsidiary company, of which she was part owner. She admitted to accessing an internal company
database and downloading information related to chemical compounds onto her employer-issued laptop. She
then transferred the information to her personal home computer by sending it to her personal e-mail address or
via a USB thumb drive.

Cases like these demonstrate the high-impact nature of some insider threat investigations. It is imperative thatorganizations deploy procedures to make it as difficult as possible for departing or disgruntled employees to haveaccess to active credentials which can be used to exfiltrate sensitive data or access key internal systems.

Kroll, a division of Duff & Phelps

8The Monitor - Volume 1

Issue 3

Monetizing Insider Threats on the Dark Web
The screenshot below shows a possible insider threat actor advertising accessto checks on hacker forum prtship.com, which could be evidence of a checkfraud scheme involving a potential employee of the bank.

Kroll Experts Corner:
Mitigating Insider Threats
Following are some insights from Kroll experts on how to prevent or more quickly detect data exposure caused by insiders

Don’t let your business outgrow your security

Make security part of workflows to promote sustainability

Businesses of all sizes need to carefully weigh their exposure, but

Assess how your employees really work and then use thatquick-growing or complex enterprises can particularly find the teamknowledge to put in place the right rules, tools and complianceoverdriving technology, leaving some gaping security holes. If yourmechanisms. For example, in Kroll’s latest Global Fraud & Risk

business is expanding or in the midst of other organizational changes,

Report, security experts Alan Brill, John Friedlander, andconsider deploying technical resources (e.g., endpoint threat

Jonathan Fairtlough described how an organization could

monitoring or third-party cyber risk management solutions) andprovide each outside salesperson with a tablet complete withdedicated in-house staff or contract with outside resources (such as

paid cellular access. Customer data and forms are stored in aa virtual CISO) to help keep your business safe. Significant changes

document management system in the cloud, and the tablet has

in size, through organic growth or acquisition should be seen as amobile device management software that blocks all browsing. If

trigger to update your risk assessment.

lost, the device is encrypted and can be remotely wiped. No
local storage, no vampire data or data hoarding.

Kroll, a division of Duff & Phelps

9The Monitor - Volume 1

Issue 3More best practices toaddress insider threats,by Senior Managing
Director, Alan Brill:

Establish and maintain defensible data access policies
For example, an “Acceptable Use of Information Technology
Policy” should reflect and communicate rigorous controls theorganization has established for employees and third parties
regarding the proper use of its systems, data and resources.
These can include practices such as requiring employees to use
only company-approved devices and systems as well as•

corporate culture where “cybersecurity is

restrictions on using social networking sites and non-corporate

everyone’s responsibility.”

email on company devices. Of course, in setting these rules, youmust be serious about compliance, as the rules represent what is

Set the tone from the top and promote a•

Apply the principle of least privilege: Limitin effect a promise of what you’re going to do to protect

network access to those who need it for theirinformation.

jobs.

When employees depart, immediately restrict physical•Restrict the use of removable media.

•

Integrate checks of cybersecurity programand electronic accessPreferably before an employee permanently leaves the premises,

elements into your internal audit andmake sure to deactivate, disable or delete network accountcompliance programs to assure that they areaccess (both local and remote), ID authentication tokens,

working as intended.

security codes, email accounts and access cards. Because
malicious insiders can leverage “forgotten access” to enterprise•

Consider data loss prevention (DLP) processes

applications, the use of a single sign-on (SSO) solution can help

designed to prevent data loss holistically,close this gap. Also, try to determine if the individual would haveincluding DLP products, company policies, user

access to the credentials of other employees and if so, re-set

training, internal reviews, and more.

those as well.

•

Watch for early warning indicators that include

Employ technology that can “look beyond your borders”

remote access during off-hours, unexplained

for at-risk data

exporting of large amounts of data and nevertaking a vacation.

In professional circles, it is common knowledge that for someindustries, engineers and others are using chat rooms on the•Regularly scan your network and generate an

dark web to specifically sell and buy intellectual property andautomated inventory of all IoT devices that aretrade secrets. Sophisticated solutions such as Kroll’sconnected. Investigate any entries that cannot

CyberDetectER® DarkWeb continuously monitors this activity

be accounted for to ensure no “mystery”

and acts as an early warning system that sensitive proprietarydevices are attached to your network

data could be compromised.

Kroll, a division of Duff & Phelps

10The Monitor - Volume 1

Contact Us

Keith Wojcieszek
Associate Managing Director, Cyber Risk
keith.wojcieszek@kroll.com | +1 443 295 5082
Based in Washington, D.C., Keith joined Kroll from the United States Secret Service, where he served with distinction
for 15 years. Most recently, Keith led the USSS Cyber Intelligence Section, Criminal Investigation Division, where
he managed the agency’s national response to cyber investigative initiatives focused on protecting the financial
infrastructure of the United States. In this role, Keith also coordinated complex international investigations that targeted
transnational organized crime networks with an emphasis on cyber and information security.

Nicole Sette
Director, Cyber Risk
nicole.sette@kroll.com | +1 609 514 8225
Based in the Secaucus office. Nicole is a highly accomplished security professional, who brings unique insightto the multiple dimensions inherent in client challenges from her years of federal law enforcement and military
experience. Nicole served as a Cyber Intelligence Analyst with the Federal Bureau of Investigation for nearly
10 years, and was an Intelligence Specialist with the U.S. Army Communications-Electronics Command for
four years.

Kroll, a division of Duff & Phelps

11

Browse the latest editions of The Monitor and subscribe free at kroll.com

About Kroll

About Duff & Phelps

Kroll is the leading global provider of risk solutions. For more than 45 years, Kroll has

Kroll is a division of Duff & Phelps, a global advisor with nearly 3,500 professionals in

helped clients make confident risk management decisions about people, assets,

28 countries around the world. Our clients include publicly traded and privately held

operations and security through a wide range of investigations, cyber security, due

companies, law firms, government entities and investment organizations such as private

diligence and compliance, physical and operational security and data and information

equity firms and hedge funds. We also advise the world’s leading standard-setting

management services. For more information, visit www.kroll.com.

bodies on valuation and governance best practices.

© 2019 Duff & Phelps, LLC. All rights reserved. KR191200

For more information, visit www.duffandphelps.com.