Threat actors are increasingly employing social engineering tactics to circumvent standard security controls, enabling unauthorized data exfiltration for ransom and extortion. Conventional security configurations, including antivirus and endpoint detection and response (EDR) systems, often fail to detect or prevent these attacks due to their reliance on legitimate tools and human interaction. The primary methods observed are phishing emails and pretext phone calls impersonating technical support.
Tactics, Techniques, and Procedures (TTPs)
- Initial Contact
- Phishing Email Variant: An email is sent to an executive or staff member’s work or personal account, claiming a significant unauthorized charge to their bank account or credit card. It includes a phone number to dispute the charge.
- Phone Call Variant: A threat actor cold-calls the target, posing as technical support personnel addressing a fabricated issue.
- Engagement
- When the target calls the provided number or answers the call, the threat actor impersonates a legitimate representative (e.g., bank support or IT staff). They offer to resolve the issue by requesting remote access to the target’s computer under the guise of “fixing” a nonexistent problem.
- Remote Access Execution
- The threat actor directs the victim to a legitimate remote assistance website (e.g., hosting tools like AnyDesk or TeamViewer).
- The victim initiates a remote support session, granting the threat actor control over the system. While the victim can observe overt actions, background processes remain hidden.
- Reconnaissance and Tool Deployment
- The threat actor identifies mapped drives or file storage locations on the system.
- Self-contained, non-malicious executables (e.g., WinSCP, FileZilla) are downloaded. These open-source tools require no elevated privileges and typically evade detection by standard security controls.
- Data Exfiltration
- Using the deployed tools, the threat actor transfers files from identified locations to an external server.
- Transfer rates depend on bandwidth; a 1 Gbps connection can exfiltrate approximately 450 GiB per hour. Prolonged sessions maximize data theft.
- Post-Exfiltration Actions
- The threat actor analyzes exfiltrated data for sensitive or regulated content (e.g., case files, SSNs, financial records).
- Within 1–2 weeks, multiple staff recipients receive a ransomware demand email containing proof of compromise (e.g., file snippets, directory trees) and a negotiation request.
#### Example Ransomware Demand ####
Below is an anonymized excerpt from a recent demand email:
Subject: Data Breach Notification – Immediate Action Required
Greetings,
We have compromised the [ORGANIZATION NAME] database, exfiltrating over 10 GB of proprietary and confidential data, including case files, client SSNs, passports, immigration documents, and tax forms (W-9, W-4, 8879). Attached screenshots and a file tree substantiate our claims.
We are a sophisticated threat group with established platforms for data exposure. However, we propose returning your data upon reaching a financial agreement. In return, we offer:
– Complete data deletion from our servers with video evidence.
– Confidentiality of communications.
– Security recommendations to remediate exploited vulnerabilities.
Respond to this email to negotiate. Failure to engage within 3 days will result in:
- Notification of your clients with evidence of the breach.
- Public disclosure on our website and affiliated media channels.
- Encouragement of client litigation against [ORGANIZATION NAME] for data loss.
Law enforcement cannot assist; we operate beyond their jurisdiction. Reply promptly to review the full scope of exfiltrated data and initiate resolution.
[Attached: Screenshots, File Tree]
#### End of Example ####
Prevention Measures
This attack vector requires full human cooperation, making user awareness the primary defense:
- Education Initiatives
- Social Engineering Awareness: Train staff to recognize panic-inducing tactics and verify claims independently before acting.
- Technical Support Protocols: Establish and enforce procedures for validating IT support requests through internal channels.
- Billing Dispute Handling: Instruct staff to contact financial institutions directly for charge disputes, avoiding unsolicited contacts.
- Incident Reporting: Define clear reporting pathways for suspicious interactions.
- Technical Controls
- Least Privilege Access: Restrict file access to job-essential data, minimizing exposure despite challenges in law firm environments.
- Session Timeouts: Implement timeouts for remote access sessions (active/inactive) to disrupt prolonged file transfers.
- Application Control: Limit the applications that can run on your systems to only those that are necessary for business functions.
- We recommend a two-phased approach to application control: starting with the easier lift of Blocklisting via EDR, then moving to the more comprehensive Allowlisting via Microsoft GPO or dedicated software when resources allow.
- DNS Filtering: Block all DNS domains related to any non-approved Remote Monitoring and Management tools.
𝗟𝗲𝗮𝗿𝗻 𝗺𝗼𝗿𝗲 𝗮𝗻𝗱 𝘁𝗮𝗸𝗲 𝗮𝗰𝘁𝗶𝗼𝗻:
✔️Download our “𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝗶𝘁𝗶𝗮𝘁𝗶𝘃𝗲𝘀: 𝗬𝗼𝘂𝗿 𝗕𝗹𝘂𝗲𝗽𝗿𝗶𝗻𝘁 𝘁𝗼 𝗗𝗲𝗳𝗲𝗻𝘀𝗲-𝗜𝗻-𝗗𝗲𝗽𝘁𝗵” guide and enhance your security posture today:
Detection Strategies
Standard security tools (e.g., antivirus, EDR) are ineffective against this attack due to their use of legitimate software. For organizations with mature security operations:
- Maintain an updated software inventory.
- Implement continuous monitoring to detect and respond to unauthorized activities promptly.
- Managed Detection and Response services can provide greater visibility over stand-alone antivirus or even EDR products by themselves
- These services can also help you implement Application Blocklisting through EDR, specifically targeting Living off the Land Binaries and Remote Monitoring and Management tools that are known to be associated with published Threat Actor activity.
Incident Response Preparation
- Pre-Incident Planning: Conduct regular incident response tabletop exercises with stakeholders (e.g., IT, legal, management) to define roles and strategies.
- External Coordination: Engage breach counsel, incident response teams, and cyber insurance providers in advance to streamline response efforts.
- Ransomware Payment Considerations: For guidance on ransom payment decisions, refer to expert analyses (e.g., “Do I Pay the Ransom?” by SecurIT360).
Conclusion
This attack exploits human vulnerabilities and legitimate tools to bypass technical defenses, targeting an organization’s sensitive data. Combining robust user education, access controls, and proactive detection can mitigate risk. Preemptive response planning is critical to managing incidents effectively.
