by Vedere Labs

Over the past few years’ ransomware has been evolving because of two ongoing trends: 

1. digital transformation driving rapid growth in the number of IoT devices in organizations

2. the convergence of IT and OT networks. 

Ransomware actors have been evolving quickly and have moved from purely encrypting data until circa 2019 to exfiltrating data before encryption in 2020 to large extortion campaigns with several phases in 2021. The trend continued in early 2022 with the emergence of new and very sophisticated ransomware families such as ALPHV and more attacks by ransomware-as-a-service gangs such as Conti. This evolution in attacker methods means that ransomware gangs could now cripple the operations of virtually any organization. 

Today, Forescout’s Vedere Labs is releasing an information report that includes a detailed playbook describing how organizations can protect themselves against a new type of ransomware attack that leverages IoT devices, such as video cameras, to deploy ransomware. The report includes a comprehensive, proof-of-concept demonstration of this new attack vector which Vedere Labs predicts will be the next step in ransomware evolution – we call this new attack approach “Ransomware for IoT” or R4IoT. The R4IoT report describes how IoT devices can be exploited for initial access and lateral movement to IT and OT devices, with the objective of causing physical disruption of business operations. 

The proof-of-concept ransomware described in the R4IoT report exploits the first trend by using exposed vulnerable devices, such as an IP video camera or a network-attached storage (NAS) device, as the initial access point to the network, and the second trend to hold OT devices hostage, thus adding another layer of extortion to an attack campaign. 

This research is the first of its kind because:

• We implemented and describe in detail detection & response actions for an R4IoT attack that serve as a playbook for organizations looking to defend against both current and future threats.
• This is the first work to combine the worlds of IT, OT and IoT ransomware and to have a full proof-of-concept from initial access via IoT to lateral movement in the IT network and then impact in the OT network. Beyond just encryption, the proof-of-concept on IT equipment includes deployment of crypto miner software and data exfiltration.
• The impact on OT is not limited to standard operating systems (e.g., Linux) or device types (e.g., building automation), does not require persistence or firmware modification on the targeted devices, and works at large-scale on a wide variety of devices impacted by TCP/IP stack vulnerabilities.

This proof-of-concept, shown in the video and detailed in the technical report, is a clear demonstration of how IoT and OT exploits can be combined with a traditional attack campaign. It also shows that to mitigate this type of attack, organizations need solutions that allow for extensive visibility and enhanced control of all the assets in a network.

Ransomware Mitigation

Beyond demonstrating how an R4IoT attack works, the report shows that there are ways to mitigate both the likelihood and the impact of this type of incident on organizations, thus decreasing the overall risk that organizations face. Three important observations from our study of the ransomware threat landscape make mitigation of this threat possible across the NIST Cybersecurity Framework functions:

• Identification and Protection are possible because hundreds of very similar attacks happen simultaneously. For instance, Conti had more than 400 successful attacks on US and international organizations in 2021. That means it is possible to identify devices and vulnerabilities being actively exploited so their protection can be prioritized.
• Detection is possible because most tools and techniques these actors use are well-known. We present the top Tactics, Techniques and Procedures (TTPs) used by malware in 2021.
• Response and Recovery are possible because attacks are not immediate and fully automated. The average dwell time of ransomware attackers was 5 days in 2021. 

Implementing this mitigation requires extensive visibility and enhanced control of all assets in a network. TheForescout Continuum platform helps to achieve that via:

• Unparalleled insight across your entire asset landscape without disrupting critical business processes. After discovering connected devices, Forescout auto-classifies and assesses those devices against company policies. The powerful combination of these three capabilities—discovery, classification and assessment—delivers the asset visibility to drive appropriate policies and action.
• In-depth visibility and cyber resilience with both asset and communications inventory based on DPI. This allows for network monitoring and threat hunting capabilities, such as threat and vulnerability indicators.
• Accelerated design, planning and deployment of dynamic network segmentation across the extended enterprise to reduce your attack surface and regulatory risk. It simplifies the process of creating context-aware segmentation policies and allows visualization and simulation of policies prior to enforcement for proactive fine-tuning and validation.
• Sharing device context between the Forescout Continuum platform and other IT and security products to automate policy enforcement across disparate solutions and accelerate system-wide response to mitigate risks.