SamSam: $6 million Ransomware

Extensive research by Sophos has uncovered a trove of new information on the notorious SamSam ransomware, revealing that it has affected far more victims than previously thought, and raised vastly more in ransom demands, almost $6 million.

Through original analysis, interviews and research, and by collaborating closely with industry partners and a specialist crypto-currency monitoring organisation, Sophos has uncovered new details about how the secretive and sophisticated SamSam ransomware is used, who’s been targeted, how it works and how it’s evolving.

A Different Breed of Malware

What sets SamSam apart from most other ransomware, and why detailed research about it is so important, is the way it’s used in stealthy, targeted attacks.

Most ransomware is spread in large, noisy and untargeted spam campaigns sent to thousands, or even hundreds of thousands, of people. They use simple techniques to infect victims and aim to raise money through large numbers of relatively small ransoms of perhaps a few hundred dollars each.

SamSam is very different, it’s used in targeted attacks by a skilled team or individual who breaks into a victim’s network, surveils it and then runs the malware manually. The attacks are tailored to cause maximum damage and ransom demands are measured in the tens of thousands of dollars.

Because the malware has been used so sparingly compared to other types of ransomware, details about how it works and how the attacks play out have been elusive since its first appearance in December 2015.

Although you are unlikely to be the target of a SamSam ransomware attack, attacks occur at a rate of about one per day, those who are can find the effects devastating.

New Insights

The research paper reveals a host of fresh technical insights including new details about how SamSam scans victims’ networks and builds up the list of machines it’s going to encrypt.

Perhaps most eye-catching though is new information about how it spreads: Unlike WannaCry, which exploited a software vulnerability to copy itself to new machines, SamSam is actually deployed to computers on the victim’s network in the same way, and with the same tools, as legitimate software applications.

Sophos’s investigation also sheds new light on the number of attacks, how often they occur and who has been targeted.

Based on the known victims, it’s been widely speculated until now that SamSam attacks are directed specifically at the healthcare, government and education sectors. Sophos can reveal that this is not the case.

Working with cryptocurrency monitoring organisation Neutrino, Sophos followed the money and identified many ransom payments and victims that were previously unknown.

Based on the much larger number of victims now known it seems that far from being unaffected, the private sector has actually borne the brunt of SamSam. Victims in that sector have simply been far more reluctant to come forward.

The money trail also revealed that SamSam has netted nearly $6 million in ransom payments, about six times more than the most recent best estimate.

From its new research, Sophos is also able to offer better protection and disaster recovery advice too. Thanks to an improved understanding of the way that SamSam targets files in the victim’s operating system, Sophos now recommends that backing up your business data is not enough.

To recover swiftly from a SamSam attack, organisations need more than a plan for restoring data, they need a comprehensive plan for rebuilding machines.

How Attacks Unfold

The SamSam attacker gains access to victims’ networks via RDP (Remote Desktop Protocol) by using software like nlbrute to successfully guess weak passwords.

Sophos has identified that the timing of attacks changes to reflect the victim’s time-zone. Whether the victim is on the west coast of the USA or in the UK, attacks happen at night time while the victims are asleep.

Unlike other well-known ransomware such as WannaCry or NotPetya, SamSam doesn’t have any worm-like or virus capabilities, so it can’t spread by itself. Instead, it relies on the human attacker to spread it, an attacker who can adapt their tactics according to the environment and defences they discover as they surveil the target.

By working in this way, the attacker can try over and over again to work around defences and gain the access they want. If the SamSam attacker is on your network they will likely stay on it until they succeed, unless they’re kicked off.

Having gained access to a network, the SamSam operator uses a variety of tools to escalate their privileges to the level of Domain Admin. Then they scan the network for valuable targets and deploy and execute the malware as any self-respecting sysadmin might, using utilities such as PsExec or PaExec.

Once it has been spread far and wide, the many copies of the ransomware are triggered centrally, starting within seconds of each other. On each infected machine, files are encrypted in a way that’s designed to cause the most damage in the shortest time.

Once the attack has been launched, the attacker waits to see if the victim makes contact via a Dark Web payment site referenced in the ransom note.

Ransom demands have increased over time to about $50,000, vastly more than the three figure sums typical of untargeted ransomware attacks.

What to Do?

To avoid becoming a victim, the best defence against SamSam or any other form of malware is to adopt a layered, defence in depth approach to security.

SamSam targets appear to be chosen on the basis of their vulnerability. Earlier attacks established a foothold on victims’ networks by exploiting known software vulnerabilities. More recently the attacks have begun with the brute forcing of RDP credentials.

Staying on top of your patching and maintaining good password discipline will therefore provide a formidable barrier to SamSam attacks.
That barrier can then be strengthened significantly with these simple steps:

  1. Restrict RDP access to staff connecting over a VPN.
  2. Use multi-factor authentication for VPN access and sensitive internal systems.
  3. Complete regular vulnerability scans and penetration tests.
  4. Keep backups offline and offsite.

Of course SamSam is just one of millions of cyber-threats and this detailed examination of SamSam is just part of the constant, ongoing malware research undertaken by Sophos to improve and adapt its ability to protect against all forms of malware.

Naked Security:

You Might Also Read: 

13 Ways Cyber Criminals Spread Malware:

Malware – The Hateful Eight:

 

 

« Digital Resilience Is A Step Up From Cybersecurity
Facebook Fakers Get Better At Covering Tracks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

HackRead

HackRead

HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance and Hacking News with full-scale reviews on Social Media Platforms & Technology trends.

ClearedJobs.Net

ClearedJobs.Net

ClearedJobs.Net is a career site and job fair company for professionals seeking careers in the defense, intelligence and cyber security communities.

Perkins Coie LLP

Perkins Coie LLP

Perkins Coie LLP is an internationalk law firm with offices across the USA and Asia. Practice areas include Privacy and Data Security.

Cyber adAPT

Cyber adAPT

Cyber adAPT offers a leading network threat detection platform (NTD) to the enterprise and ODM/OEM markets.

Indium Software

Indium Software

Indium Software is an Independent Software Testing Company offering software testing services (including security testing) and offshore Quality Assurance solutions.

Avanan

Avanan

Avanan is The Cloud Security Platform. Protect all your SaaS applications using tools from over 60 industry-leading vendors in just one click.

National Cyber Security Agency (NACSA) Malaysia

National Cyber Security Agency (NACSA) Malaysia

NACSA is the leading government agency in Malaysia responsible for the development and implementation of national cyber security management policie and strategies.

IoT M2M Council (IMC)

IoT M2M Council (IMC)

The IMC is the largest and fastest-growing trade organisation in the IoT/M2M sector.

Civic Technologies

Civic Technologies

Civic’s Secure Identity Platform (SIP) uses a verified identity for multi-factor authentication on web and mobile apps without the need for usernames or passwords.

Strike Graph

Strike Graph

The Strike Graph GRC platform enables Security Audits & Certifications.

JFrog

JFrog

JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime.

OpsHelm

OpsHelm

OpsHelm provides a Software-as-a-Service solution to help businesses ensure that all of their cloud environments have their security bases covered.

Department of Homeland Security (DHS)

Department of Homeland Security (DHS)

The Department of Homeland Security has a vital mission: to secure the nation from the many threats we face. Our duties are wide-ranging, but our goal is clear - keeping America safe.

Descope

Descope

Descope is a service that helps every developer build secure, frictionless authentication and user journeys for any application.

Emerge Digital

Emerge Digital

Emerge Digital is a technology and digital innovation business and Managed Services Provider providing solutions to SMEs.

Yarix

Yarix

Yarix is the leading company in Var Group’s Digital Security division and one of the most recognised, innovative and authoritative Italian companies in the IT security sector.