Researchers Detailed New Exfiltration Techniques Used By Ransomware Groups

Ransomware groups and state-sponsored actors increasingly exploit data exfiltration to maximize extortion and intelligence gains by leveraging a mix of custom and legitimate tools to steal sensitive data, including financial, personal, and classified information. 

To mitigate risks, organizations must implement robust security measures, such as network monitoring, file integrity checks, and endpoint detection and response, to detect and thwart data exfiltration attempts early on.

Attacks are increasingly leveraging data exfiltration as a primary extortion tactic, where cybercriminals are shifting away from traditional encryption-based attacks due to their resource-intensive nature and the growing ability of organizations to recover from them. 

Data exfiltration, on the other hand, is less resource-intensive and harder to detect, making it a more attractive option.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

By stealing sensitive data, attackers can extort victims with threats of public exposure or private sale, highlighting the evolving threat landscape and the need for organizations to prioritize data protection and incident response strategies.

Groups are collaborating with state-sponsored actors to enhance their capabilities and achieve mutual objectives, where state-sponsored groups leverage ransomware to disguise intelligence gathering operations, while ransomware groups benefit from advanced techniques and access to sensitive information. 

Both actors target high-value data, including financial and insurance-related information, to maximize extortion potential and gain strategic advantages, which poses significant cybersecurity risks as it blurs the lines between criminal and state-sponsored activities, making threat attribution and mitigation more challenging.

It exfiltrates highly sensitive data, including confidential documents, government data, personal information, and medical records, by targeting IT infrastructure data, such as password management software, network architecture, and source code. 

Recently edited files are also prioritized to gain insights into ongoing projects and sensitive information, which is used for extortion, resale, and future attacks, causing significant reputational and financial damage to victims.

By employing a multi-stage exfiltration process, they leverage both custom and publicly available tools, which offer tailored functionality, improved stealth, and reduced dwell time, primarily used by advanced groups. 

Scripts automate exfiltration and payload delivery, while enumeration tools aid in data discovery.

Exfiltration tools like ExByte, ExMatter, and StealBit directly transfer stolen data to threat actor-controlled servers or cloud storage, often employing techniques to evade detection and hinder recovery efforts.

They are increasingly employing commodity malware and legitimate tools to exfiltrate sensitive data, where infostealers like Meduza and CSharp Streamer are used to collect data, while tools like WizTree, WinRAR, 7-Zip, Rclone, and Mega facilitate exfiltration. 

Attackers often leverage cloud storage solutions and file-sharing platforms to host stolen data, while detecting exfiltration attempts involves monitoring for suspicious file movements, tool usage, and network traffic anomalies. 

According to Sekoia, for the purpose of identifying and mitigating risks associated with ransomware-related data exfiltration, proactive monitoring, anomaly detection, and correlation rules are fundamental.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar