Inside the Ransomware War Room | Human Side of Cybercrime with Jon DiMaggio

So, you know, John, I want to interrupt here.

And, you know, you said one of the most important statement is we have to treat this advanced threat in a different way.

We have a lot of methodologies available.

We have a lot of standards are available to tackle the hackers or we call pen testers, ethical hackers and all that.

Now, when you said about advanced threats, are you talking about here using a cyber kill chain or APT or MITRE? What exactly when you said about we have to use different techniques? Can you just help me out to understand that?

Absolutely.

So the things you just named, the kill chain, these different techniques, MITRE ATT&CK framework, even the diamond model for attribution, all of those are tools to use and they're very valuable.

And those tools help you to not make these mistakes because they break it down into different layers and different categories for you to understand if this is a a low, medium, or high level threat.

And if it is high level or advanced, that's where it has to be treated differently.

The benefits of things like MITRE is it helps us, the biggest benefit is you identify tactics, but it's giving us a language now where we can quickly share with both humans and with automation and systems these tactics so it's easier to defend against.

But let me give you just an example so I'm not just saying it.

This was a couple of years back, maybe it was 2022.

We saw what is now a normal pattern, but at the time was a new technique where we saw an adversary or ransomware group, they would install a virtual machine in an environment and their binary installed the machine, And they ran their attack from it.

And by doing that, the system defenses at the time were blind to that.

They weren't running on that machine.

They weren't identifying that there was malware and tools and things like that on it.

Now, today, that's common practice, but it was not then, at least with ransomware.

So if you were defending against an attack and you didn't have MITRE to know that this is a technique that this group was using, You might be looking to defend it completely different ways and absolutely miss that, and that attack would likely be successful because of it.

So my point is when they're advanced, you have to understand that group.

You have to understand and remember there's a human behind it, and they have preferred tools that they want to use and that they like to use and that they've been successful with.

And knowing that human tendency of, okay, the pattern, that digital fingerprint here of this group is X, Y, and Z, and these are the tools they like, these are the scripts they like, you're going to have a much more efficient defense against that attacker, especially if they're already conducting the attack and you're starting to see signs and evidence of that.

but as you said about in 2022 you have discovered the attack profiles where uh where they have built up ems it is inside the intel network it mean they already have access to the intel network

yeah yes uh this this group was uh essentially their their mouth they had had a very uh small binary that allowed the installation of this virtual machine to run on the system.

And it used a lot of the system resources, but the actual hacking tools used to spread the malware and the malware executable, the binary itself, the builder, everything they needed to use and to spread it, was all within this tiny remote system, a virtual system rather.

And it made it, like I said, it allowed them to have these tools present without being identified.