There continues to be a lot of pressure on security leaders to do more with less, but today's sophisticated and frequent cyberattacks only exacerbate the situation. And the bad news is these cyber incidents, particularly ransomware attacks, are not going away any time soon. In fact, they are becoming more prevalent in areas like critical infrastructure, supply chain, and financial institutions. For example, the Cybersecurity and Infrastructure Security Agency (CISA) observed ransomware incidents against 14 of the 16 US critical infrastructure sectors in 2021.
As one of the fastest-growing types of cybercrime, the financial implications of ransomware have become more pronounced in recent years. These attacks cause more widespread damage than other single-target attacks, so it makes sense that we are seeing an increased response from government and technology vendors to fight off ransomware events. Is it enough?
RVWP: An Important First Step
In March 2022, CISA launched the Ransomware Vulnerability Warning Pilot (RVWP) program aimed at helping critical infrastructure organizations protect their systems against ransomware attacks by fixing vulnerabilities. While a good first step, to fully protect against ransomware and other cyberattacks, organizations need a security plan with multiple layers that includes technology measures, employee training, and well-defined and enforced security policies. However, it's clear that not all critical infrastructure providers employ best security practices, which is why the RVWP was initiated. But it doesn't go far enough.
While ransomware operators will absolutely take advantage of newly discovered vulnerabilities to infect targets, these are attacks of opportunity. Widespread network exploitation events impacting critical infrastructure are relatively infrequent these days, although smaller-scale attacks against well-known vulnerabilities persist and still have some level of success.
It's important to note that in the downtime between major vulnerability discoveries, ransomware operators most often use watering-hole attacks, spear phishing, malicious advertising, and other social-engineering tactics that exploit humans to gain a foothold in network environments. No amount of network scanning and reporting will mitigate these risks, so critical infrastructure will continue to be impacted by ransomware.
GootLoader: An Example of Malware's Spread
To better understand the potential impact, take a look at GootLoader, a popular malware that gives threat actors initial access to the victim's IT environment. GootLoader is a prime example of a ransomware tactic that can infiltrate an organization's network, and no amount of preventative scanning can stop it. At a high level, GootLoader uses search engine optimization (SEO) poisoning to lure and infect victims and compromise legitimate WordPress websites. If a user clicks on one of these websites and deploys the malware, it gives the threat actors a foothold on the network.
GootLoader does not seem to specifically target critical infrastructure entities, but they should still be concerned. In monitoring GootLoader, we have tracked over 700,000 URLs injected with the malware, and those contain around 3.5 million phrases that someone might use in a keyword search. I did a quick search, and here is a partial list of terms seen in the GootLoader landing pages that someone working in critical infrastructure might search for:
Next Steps to Mitigate Risks
While protecting critical infrastructure may seem daunting, there are some critical first steps the industry can take now to become more cyber resilient and mitigate risks:
- Training
In an ideal world, CISA would expand on the RVWP to provide free end-user training and phishing simulations to critical infrastructure providers through third-party security providers.
- Improving search engines
The industry needs to encourage search engine companies to proactively search for and remove malicious ads and search results from their platforms. CISA could also implement a program to scan for and report malicious ads and search results directly to the responsible teams at the major search engines for rapid mitigation.
- Understanding malware
Security teams need better insight into ransomware operations' kill chain. For example, remapping dangerous file extensions to open in Notepad instead of executing an application can break the chain so that many types of malware cannot gain a foothold on the network.
Adding these measures could have a far greater impact on stopping the proliferation of ransomware than the current program alone.
Originally published on darkreading.com
