A new report focused on cyber espionage actors targeting government and critical infrastructure sectors highlights the strategic use of ransomware for distraction or misattribution.
It was inevitable: a threat group using a secondary attack type to cover their tracks – whether those “tracks” are the groups true intent, who’s responsible – or to simply make some additional money after they’re done with the initial attack.
A new report put out jointly by security vendor SentinelOne and Recorded Future follows Chinese APT group ChamelGang who are known to be responsible for attacks in East Asia, Brazil, and the Indian subcontinent. The report showcases a new attack tactic being added by threat groups – including ChamelGang – who are sponsored by nation-states, adding in data encryption, exfiltration, and extortion.
This additional tactic provides sponsoring countries to have plausible deniability, misdirects the response of targeted governments, and even can keep victim organizations from knowing they were the target of espionage in the first place. It also becomes a convenient way for threat groups to “make an extra buck” off the victim, since “they’re there already.”
This added tactic makes cyber attacks materially more dangerous; it’s not out of the realm of possibility to see ransomware threat actors building out a new business model that works – in essence – in reverse of a group like ChamelGang. Here’s what I mean: say a ransomware group has established their initial access and has quietly deployed their ransomware everywhere.
All it takes is some threat actor to setup an “espionage marketplace” where nation-states can look for access they’d like to take advantage of for espionage purposes, connect the sponsor and the ransomware group, and add in some data exfiltration specifically focused on espionage, selling the data to the sponsor – and then continuing with the ransomware attack.
Scary stuff.
All the more reason to work to stop attacks at their initial access step – which still primarily leverages phishing. This makes new school security awareness training critical as part of your organization’s defenses to keep from being a victim not just once, but from the looks of things… twice.
Here's how it works:
