Ransomware and Cyber Extortion

Sherri Davidoff, CEO of LMG Security and author of Data Breaches, has been called a "security badass" by the New York Times. An instructor at the renowned Black Hat cybersecurity trainings, she is a GIAC-certified forensic analyst (GCFA) and penetration tester (GPEN). She holds a degree in computer science and electrical engineering from MIT. Matt Durrin, the Director of Training and Research at LMG Security, is a popular speaker at national conferences and training venues. His malware research has been featured on the NBC Nightly News. Karen Sprenger, LMG Security's COO and chief ransomware negotiator, is a noted industry expert, speaker, trainer, and course developer with 25+ years of security/IT experience. She is a GIAC-certified forensic examiner (GCFE) and Certified Information Systems Security Professional (CISSP).

"Ransomware and Cyber Extortion is a masterstroke that will lead both technical and non-technical readers alike on a journey through the complex and sometimes dark world of cyber extortion. The encore of practical advice and guidance on preventing ransomware can help organizations of all sizes."--Russ Cohen, Head of Cyber Services US, Beazley Group"Davidoff and team have built a magisterial and yet still approachable guide to ransomware. This just became the definitive and classic text. I've been writing about some of these attacks for years and still was blown away by how much more they taught me. I'll hand this to every infosec newcomer and senior consultant from now on."--Tarah Wheeler, CEO, Red Queen Dynamics"Ransomware attacks are no longer encrypt-and-export incidents; they have evolved into sophisticated, multipronged attacks that require a multidisciplinary response of forensic, technical, and compliance expertise and savvy cybercrime negotiation skills. Sherri Davidoff, Matt Durrin, and Karen Sprenger are that 'Dream Team' and concisely help the reader understand how to prepare for and respond to ransomware attacks. This book is a must-read for every member of an internal or external incident response team."--Jody R. Westby, CEO, Global Cyber Risk LLC, Chair, ABA Privacy & Computer Crime Committee (Section of Science & Technology Law)"A thoroughly delightful read, Ransomware and Cyber Extortion takes the topic everyone is talking about and deconstructs it with history and actionable guidance. A must-read before you next brief your board or peers on your own incident response plans."--Andy Ellis, CSO Hall of Fame '21

• Preface xxiAcknowledgments xxviiAbout the Authors xxixChapter 1: Impact 11.1 A Cyber Epidemic 31.2 What Is Cyber Extortion? 41.3 Impacts of Modern Cyber Extortion 71.4 Victim Selection 151.5 Scaling Up 181.6 Conclusion 241.7 Your Turn! 24Chapter 2: Evolution 272.1 Origin Story 282.2 Cryptoviral Extortion 292.3 Early Extortion Malware 302.4 Key Technological Advancements 312.5 Ransomware Goes Mainstream 382.6 Ransomware-as-a-Service 392.7 Exposure Extortion 402.8 Double Extortion 432.9 An Industrial Revolution 452.10 Conclusion 602.11 Your Turn! 61Chapter 3: Anatomy of an Attack 633.1 Anatomy Overview 633.2 Entry 653.3 Expansion 723.4 Appraisal 763.5 Priming 773.6 Leverage 803.7 Extortion 853.8 Conclusion 883.9 Your Turn! 88Chapter 4: The Crisis Begins! 914.1 Cyber Extortion Is a Crisis 924.2 Detection 934.3 Who Should Be Involved? 944.4 Conduct Triage 984.5 Assess Your Resources 1024.6 Develop the Initial Response Strategy 1054.7 Communicate 1074.8 Conclusion 1124.9 Your Turn! 112Chapter 5: Containment 1155.1 The Need for Speed 1165.2 Gain Access to the Environment 1175.3 Halting Encryption/Deletion 1185.4 Disable Persistence Mechanisms 1215.5 Halting Data Exfiltration 1235.6 Resolve Denial-of-Service Attacks 1245.7 Lock Out the Hackers 1255.8 Hunt for Threats 1295.9 Taking Stock 1335.10 Conclusion 1345.11 Your Turn! 134Chapter 6: Investigation 1376.1 Research the Adversary 1386.2 Scoping 1466.3 Breach Investigation or Not? 1506.4 Evidence Preservation 1526.5 Conclusion 1606.6 Your Turn! 161Chapter 7: Negotiation 1637.1 It's a Business 1647.2 Establish Negotiation Goals 1657.3 Outcomes 1697.4 Communication Methods 1717.5 Pressure Tactics 1737.6 Tone, Timeliness, and Trust 1767.7 First Contact 1787.8 Sharing Information 1797.9 Common Mistakes 1827.10 Proof of Life 1837.11 Haggling 1867.12 Closing the Deal 1897.13 Conclusion 1907.14 Your Turn! 191Chapter 8: Payment 1938.1 To Pay or Not to Pay? 1948.2 Forms of Payment 1978.3 Prohibited Payments 1988.4 Payment Intermediaries 2018.5 Timing Issues 2028.6 After Payment 2048.7 Conclusion 2058.8 Your Turn! 206Chapter 9: Recovery 2099.1 Back up Your Important Data 2109.2 Build Your Recovery Environment 2119.3 Set up Monitoring and Logging 2149.4 Establish Your Process for Restoring Individual Computers 2179.5 Restore Based on an Order of Operations 2199.6 Restoring Data 2249.7 Decryption 2279.8 It's Not Over 2349.9 Adapt 2359.10 Conclusion 2369.11 Your Turn! 236Chapter 10: Prevention 23910.1 Running an Effective Cybersecurity Program 24010.2 Preventing Entry 25010.3 Detecting and Blocking Threats 25810.4 Operational Resilience 26110.5 Reducing Risk of Data Theft 26710.6 Solving the Cyber Extortion Problem 26910.7 Conclusion 27410.8 Your Turn! 274Afterword 277Checklist A: Cyber Extortion Response 279Checklist B: Resources to Create in Advance 285Checklist C: Planning Your Response 291Checklist D: Running an Effective Cybersecurity Program 293Index 299