JBS Ransomware attack highlights need for early detection and rapid response

Over the past couple of months cyber-criminals have targeted organizations critical to our supply chain. The most recent of these attacks was against JBS, the…

Anthony Di Bello profile picture
Anthony Di Bello

June 9, 20214 minute read

Over the past couple of months cyber-criminals have targeted organizations critical to our supply chain. The most recent of these attacks was against JBS, the largest meat processing company in the world.

The attack on JBS was caused by the execution of ransomware in their network environment, and has been attributed to the REvil, aka Sodinokibi family of malware. The REvil ransomware has the capability to do more than just encrypt files, it can also disable Anti-Virus, delete backups of machines, and monitor for and kill other processes that may attempt to stop it. This ransomware has historically been delivered by spear phishing emails—exploiting Remote Desktop Protocol (RDP) exposed to the internet—using stolen credentials, or taking advantage of old vulnerabilities exposed to the internet.

Modern ransomware campaigns, like those that affected JBS and Colonial Pipeline, are inside the target network long before the actual ransomware is deployed. Typically, attackers are in the network moving laterally, stealing data and credentials, deploying additional tools, and then execute Ransomware as the final stage in the attack.

A window of opportunity: How OpenText MDR prevented a ransomware attack

The OpenText™ Managed Detection & Response (MDR) team stopped a similar attack in its’ tracks on a recent client engagement. The attack was detected early in the cyber kill-chain before the attackers had the chance to execute the Ransomware component of the attack.

OpenText MDR uses proprietary filters, based on attackers’ tactics, techniques, and procedures (TTPs) our consultants have seen across thousands of engagements. A detection triggered on anomalous user account behavior within an hour of deployment. Immediately, OpenText MDR analysts directed the client to disable the account while they began to remotely investigate the intrusion.

Our investigation quickly determined the account was being used to establish the command-and-control access required to launch a ransomware attack.

With the compromised account disabled, and the attacker ‘hooks’ remediated from affected endpoints, OpenText MDR was able to prevent the attackers from gaining the foothold needed to launch a ransomware attack.

While our MDR analysts caught this attack very early in the cyber kill-chain, OpenText MDR would have alerted on multiple phases on the attack including:

  • The initial infection vector (IIV) – exploitation or poor security practices (not patching systems, RDP exposed to the internet), phishing email, etc.
  • Abnormal behavior associated with legitimate user accounts, such as in the Colonial Pipeline attack where a legitimate username and password was used to access the VPN.
  • Persistence techniques
  • Account privilege escalation
  • Lateral movement
  • Data Exfiltration

Managed Services or Do-It-Yourself, we’re here to help

For organizations that have detection & response expertise on their team, EnCase Endpoint Security can provide the same benefits as our MDR service. EnCase Endpoint Security includes over 250 TTP-based rules, with more being added every quarter.

EnCase Endpoint Security allows for monitoring of suspicious activity at the endpoint and can be configured to isolate a machine from the network at the first sign of an attacker gaining access to it — before the execution of the malware.  EnCase Endpoint Security TTPs would have detected the execution of malicious macros within an office document, C2 communications, suspicious command line and PowerShell activity, suspicious WMI activity, and more.

Mitigating the risk of ransomware attacks

Past implementing an MDR or EDR solutions, there are several steps organizations should take to mitigate the risk of a successful ransomware attack. Examples include:

  • Ensure all systems and applications are patched and up to date
  • Perform regular internal and external vulnerability scans to mitigate risks to the network
  • Monitor incoming emails for suspicious attachments
  • Evaluate the effectiveness of your backup and recovery program, including all critical systems and data
  • Disallow execution of macros on user machines unless there is a very specific and approved need for them
  • Mandate Security Awareness Training for all employees annually

To learn more about how OpenText can help you prepare for and detect the next ransomware attack before it strikes, please contact us at https://www.opentext.com/products-and-solutions/products/security#form.

Share this post

Share this post to x. Share to linkedin. Mail to
Anthony Di Bello avatar image

Anthony Di Bello

Anthony Di Bello serves as VP, Strategic Development for OpenText. A 13-year veteran of the cybersecurity and digital forensic incident response sector, he leads strategic planning and direction for cybersecurity solutions. Anthony joined OpenText with the Acquisition of Guidance software where he spent the previous 12 years, as Sr. Director of Products responsible for the voice of the customer, product roadmaps and go-to-market strategy across Guidance Software forensic security, data risk management and digital investigations products.

See all posts

More from the author

How to optimize EnCase for a work-from-home workforce

How to optimize EnCase for a work-from-home workforce

The current global situation has necessitated home-working by many millions of employees, but in the legal and law-enforcement world, there is still a requirement to…

4 minute read

The three problems OpenText Security will be talking about at RSA

The three problems OpenText Security will be talking about at RSA

RSA 2019 is right around the corner. The most exciting security conference of the year – apart from OpenText™ Enfuse of course – RSA is a…

4 minute read

Continuous monitoring and advanced threat detection for the global enterprise

Continuous monitoring and advanced threat detection for the global enterprise

Information Security Continuous Monitoring (ISCM) projects can be expensive, data and network intensive implementations which often end in frustration for global organizations. Common approaches to…

3 minute read

Stay in the loop!

Get our most popular content delivered monthly to your inbox.