SamSam: $6 million Ransomware

Extensive research by Sophos has uncovered a trove of new information on the notorious SamSam ransomware, revealing that it has affected far more victims than previously thought, and raised vastly more in ransom demands, almost $6 million.

Through original analysis, interviews and research, and by collaborating closely with industry partners and a specialist crypto-currency monitoring organisation, Sophos has uncovered new details about how the secretive and sophisticated SamSam ransomware is used, who’s been targeted, how it works and how it’s evolving.

A Different Breed of Malware

What sets SamSam apart from most other ransomware, and why detailed research about it is so important, is the way it’s used in stealthy, targeted attacks.

Most ransomware is spread in large, noisy and untargeted spam campaigns sent to thousands, or even hundreds of thousands, of people. They use simple techniques to infect victims and aim to raise money through large numbers of relatively small ransoms of perhaps a few hundred dollars each.

SamSam is very different, it’s used in targeted attacks by a skilled team or individual who breaks into a victim’s network, surveils it and then runs the malware manually. The attacks are tailored to cause maximum damage and ransom demands are measured in the tens of thousands of dollars.

Because the malware has been used so sparingly compared to other types of ransomware, details about how it works and how the attacks play out have been elusive since its first appearance in December 2015.

Although you are unlikely to be the target of a SamSam ransomware attack, attacks occur at a rate of about one per day, those who are can find the effects devastating.

New Insights

The research paper reveals a host of fresh technical insights including new details about how SamSam scans victims’ networks and builds up the list of machines it’s going to encrypt.

Perhaps most eye-catching though is new information about how it spreads: Unlike WannaCry, which exploited a software vulnerability to copy itself to new machines, SamSam is actually deployed to computers on the victim’s network in the same way, and with the same tools, as legitimate software applications.

Sophos’s investigation also sheds new light on the number of attacks, how often they occur and who has been targeted.

Based on the known victims, it’s been widely speculated until now that SamSam attacks are directed specifically at the healthcare, government and education sectors. Sophos can reveal that this is not the case.

Working with cryptocurrency monitoring organisation Neutrino, Sophos followed the money and identified many ransom payments and victims that were previously unknown.

Based on the much larger number of victims now known it seems that far from being unaffected, the private sector has actually borne the brunt of SamSam. Victims in that sector have simply been far more reluctant to come forward.

The money trail also revealed that SamSam has netted nearly $6 million in ransom payments, about six times more than the most recent best estimate.

From its new research, Sophos is also able to offer better protection and disaster recovery advice too. Thanks to an improved understanding of the way that SamSam targets files in the victim’s operating system, Sophos now recommends that backing up your business data is not enough.

To recover swiftly from a SamSam attack, organisations need more than a plan for restoring data, they need a comprehensive plan for rebuilding machines.

How Attacks Unfold

The SamSam attacker gains access to victims’ networks via RDP (Remote Desktop Protocol) by using software like nlbrute to successfully guess weak passwords.

Sophos has identified that the timing of attacks changes to reflect the victim’s time-zone. Whether the victim is on the west coast of the USA or in the UK, attacks happen at night time while the victims are asleep.

Unlike other well-known ransomware such as WannaCry or NotPetya, SamSam doesn’t have any worm-like or virus capabilities, so it can’t spread by itself. Instead, it relies on the human attacker to spread it, an attacker who can adapt their tactics according to the environment and defences they discover as they surveil the target.

By working in this way, the attacker can try over and over again to work around defences and gain the access they want. If the SamSam attacker is on your network they will likely stay on it until they succeed, unless they’re kicked off.

Having gained access to a network, the SamSam operator uses a variety of tools to escalate their privileges to the level of Domain Admin. Then they scan the network for valuable targets and deploy and execute the malware as any self-respecting sysadmin might, using utilities such as PsExec or PaExec.

Once it has been spread far and wide, the many copies of the ransomware are triggered centrally, starting within seconds of each other. On each infected machine, files are encrypted in a way that’s designed to cause the most damage in the shortest time.

Once the attack has been launched, the attacker waits to see if the victim makes contact via a Dark Web payment site referenced in the ransom note.

Ransom demands have increased over time to about $50,000, vastly more than the three figure sums typical of untargeted ransomware attacks.

What to Do?

To avoid becoming a victim, the best defence against SamSam or any other form of malware is to adopt a layered, defence in depth approach to security.

SamSam targets appear to be chosen on the basis of their vulnerability. Earlier attacks established a foothold on victims’ networks by exploiting known software vulnerabilities. More recently the attacks have begun with the brute forcing of RDP credentials.

Staying on top of your patching and maintaining good password discipline will therefore provide a formidable barrier to SamSam attacks.
That barrier can then be strengthened significantly with these simple steps:

  1. Restrict RDP access to staff connecting over a VPN.
  2. Use multi-factor authentication for VPN access and sensitive internal systems.
  3. Complete regular vulnerability scans and penetration tests.
  4. Keep backups offline and offsite.

Of course SamSam is just one of millions of cyber-threats and this detailed examination of SamSam is just part of the constant, ongoing malware research undertaken by Sophos to improve and adapt its ability to protect against all forms of malware.

Naked Security:

You Might Also Read: 

13 Ways Cyber Criminals Spread Malware:

Malware – The Hateful Eight:

 

 

« Digital Resilience Is A Step Up From Cybersecurity
Facebook Fakers Get Better At Covering Tracks »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

StickyMinds

StickyMinds

StickyMinds is the web's first interactive testing community exclusively engaged in improving software quality throughout the software development lifecycle.

IBackup

IBackup

IBackup is a Web Based Online Backup service provider.

Centre for the Protection of National Infrastructure (CPNI)

Centre for the Protection of National Infrastructure (CPNI)

CPNI works with the National Cyber Security Centre (NCSC), Cabinet Office and lead Government departments and agencies to drive forward the UK's cyber security programme to counter cyber threats.

VerSprite

VerSprite

VerSprite is a specialist information security consulting firm. We provide organizations with detection across all their attack surfaces and deliver critical insight into all possible attack methods.

KOVRR

KOVRR

Kovrr financially quantifies cyber risk on demand. Our technology enables decision makers to seamlessly drive actionable cyber risk management decisions.

Zamna

Zamna

Zamna (formerly VChain Technology) is an award-winning software company building GDPR compliant identity platforms for the aviation industry.

SafeHouse Technologies

SafeHouse Technologies

SafeHouse is a cloud-based, high-end cybersecurity platform that can secure and insure any device that is connected to it.

Network Intelligence

Network Intelligence

Network Intelligence delivers a comprehensive suite of AI-powered cybersecurity solutions built on the ADVISE framework.

Cirosec

Cirosec

Cirosec is a specialized company with a focus on information security. We carry out pentests & audits and advise our customers in the German-speaking countries on information and IT security issues.

Involta

Involta

Involta orchestrates IT transformation journeys using well-defined and rigorous processes to deliver hybrid cloud solutions, consulting and data center services tailored to our clients’ needs.

SkillsDA

SkillsDA

SkillsDA is pureplay company in cyber security involved in capacity building towards National Security.

Jot Digital

Jot Digital

Jot Digital is a full-service technology company specializing in digital engineering, application modernization and business transformation.

Liberty Technology

Liberty Technology

Liberty Technology has a host of highly trained, certified experts who assist our clients with immediate remote support as well as on-site service.

Disecto Technologies

Disecto Technologies

At Disecto, we provide SaaS based Data Discovery, Classification and a remediation solution for data privacy compliance.

When Group

When Group

World Health Energy Holdings, Inc. (d/b/a WHEN Group) is a High Tech Holding Company that specializes in the Cyber, Security and Telecom area.

Maltiverse

Maltiverse

Maltiverse is a threat intelligence platform that provides security teams with high-fidelity threat data and malicious IOCs to enhance detection and response.