Recent updates to the well-known Ransomware-as-a-Service – including the addition of RIPlace – make Thanos a formidable challenge for even well-secured organizations.
I’ve said it before and I’ll say it again: the bad guys operate just like the good guys. Cybercriminal organizations are just businesses with an evil go-to-market plan. And as such, they evolve and improve their software to have better features, to improve performance, and to produce a consistent and predictable result.
Recent developments to Thanos documented by security researchers at Sentinel Labs demonstrate this point exactly. Some of the improvements to Thanos include:
- RIPlace technique for avoiding detection
- Encryption speed enhancements
- Disabling of 3rd party backup solutions
- Ability to impersonate Windows SYSTEM via process hollowing
- FTP-based reporting
And this is just a fraction of the improvements seen in Thanos over the last 3 months!
Organizations need to realize ransomware (in general) isn’t just encryption software; Thanos demonstrates the effort put into ensuring each step of an attack – from delivery, to installation, to lateral movement, to encryption – is successful. Add to this the fact that Thanos is Ransomware-as-a-Service – it’s available to any person that wants to start their own Ransomware “business”, multiplying the frequency and distribution of this malware.
From the looks of the improvements, once it’s installed, it’s going to see plenty of successes. So, organizations need to take steps to stop it before it starts; and that begins with the user not engaging with phishing emails. And that requires continual Security Awareness Training to both teach and reinforce the need to always be mindful about suspicious content when interacting with email and the web.
