Editor’s Note: Unlock the knowledge, resources and expert guidance you need to successfully prevent ransomware attacks from impacting your organization’s operations with this complimentary Ransomware Toolkit…

The theme for Week 3 of Cybersecurity Awareness Month 2021 is “Explore. Experience. Share.” It’s also Cybersecurity Career Awareness Week. The purpose of the theme is to highlight all the many contributions that people in cybersecurity roles can make to society through their work.

One of the ways that cybersecurity people can benefit society is by investigating ransomware actors’ use of the dark web. We’ll explore how these malicious actors use the dark web later in this article. But first, let’s contextualize the dark web itself.

What Is the Dark Web?

To understand the dark web, it’s important to understand the difference between what’s known as the “surface web” and the “deep web.” The former is what we all know to be the part of the Internet that’s accessible through major search engines. Netflix, Facebook, and anything that pops up on a Google search results page falls into this category.

The surface web makes up only about 0.03% of the Internet, however. The rest sits on the deep web, or the part of the Internet not indexed by search engines like Google. Per Encyclopedia Britannica, the deep web includes benign sites like users’ password-protected email accounts and other web pages accessible only via an online form. It also includes other resources that owners have intentionally prevented web crawlers from indexing.

The dark web falls into that last category. It’s a part of the deep web that visitors can’t access without the help of a special browser known as The Onion Router (or TOR). People can use the dark web for legitimate purposes such as joining a chess club and creating a channel for private communication, notes CSO. Alternatively, they can use it for nefarious purposes.

At least some of that activity takes place on dark web marketplaces (or “dark markets”). According to Nature, dark markets are places where members can trade in illicit goods such as drugs and weapons. In this capacity, these marketplaces enable digital attackers to connect with one another anonymously so that they buy and sell stolen credit card information, for example, or offer access to a new phishing-as-a-service kit.

All transactions usually involve bitcoin or another form of cryptocurrency as their form of payment. This is by design to help conceal the identities of whoever is involved in a given transaction.

Ransomware Services on the Dark Web

When it comes to ransomware, members of dark markets commonly promote Ransomware-as-a-Service (RaaS) operations. Cybersecurity Ventures clarified that malicious actors post ads highlighting different ransomware kits and their varying levels of service. One ad might mention a discounted bundle of multiple digital crime kits, for example. Another might display the positive user reviews of one RaaS operation only.

Popularity, functionality, and bundled items are just some of the factors that help to influence the cost of a ransomware offering. CPO Magazine wrote that some ransomware sell or rent out access for as little as $5. By contrast, more established strains can go for $100 or more.

In the context of these dark market ads, ransomware developers have traditionally sought to recruit affiliates to the RaaS schemes. But that changed after the Colonial Pipeline attack. As reported by KrebsonSecurity at the time, the administrators of the Russian digital crime forum XSS banned individuals from discussing ransomware around the same time that the DarkSide ransomware affiliate program went offline. Two other digital crime forums followed suit shortly thereafter, as pointed out by The Record.

Some ransomware actors have consequently shifted their tactics so that they can continue to engage dark markets. In particular, Flashpoint has witnessed a shift towards advertising for and working with initial access brokers (IABs) on dark markets. This change lets ransomware actors quietly advertise their activities on the dark web. It also lets them focus on honing their malware payloads instead of needing to worry about gaining access to their target’s networks.

The Cybereason Advantage Over Ransomware

The best strategy for organizations is to prevent a ransomware attack from being successful in the first place. To do that, they need to invest in a multi-layered solution that leverages Indicators of Behavior (IOBs) to detect and prevent a ransomware attack at the earliest stages of initial ingress, prior to the exfiltration of sensitive data for double extortion.

The Cybereason Operation-Centric approach provides the ability to detect ransomware attacks earlier based on rare or advantageous chains of malicious behavior. This is why Cybereason is undefeated in the battle against ransomware and delivers the best prevention, detection, and response capabilities on the market, which include:

• • Anti-Ransomware and Deception: Cybereason uses a combination of behavioral detections and proprietary deception techniques surface the most complex ransomware threats and end the attack before any critical data can be encrypted.
  • Intelligence Based-Antivirus: Cybereason block known ransomware variants leveraging an ever-growing pool of threat intelligence based on previously detected attacks.
  • NGAV: Cybereason NGAV is powered by machine learning and recognizes malicious components in code to block unknown ransomware variants prior to execution.
  • Fileless Ransomware Protection: Cybereason disrupts attacks utilizing fileless and MBR-based ransomware that traditional antivirus tools miss.
  • Endpoint Controls: Cybereason hardens endpoints against attacks by managing security policies, maintaining device controls, implementing personal firewalls and enforcing whole-disk encryption across a range of device types, both fixed and mobile.
  • Behavioral Document Protection: Cybereason detects and blocks ransomware hidden in the most common business document formats, including those that leverage malicious macros and other stealthy attack vectors.

Cybereason is dedicated to teaming with defenders to end cyber attacks from endpoints to the enterprise to everywhere – including modern ransomware. Learn more about ransomware defense here or schedule a demo today to learn how your organization can benefit from an operation-centric approach to security.

About the Author

Cybereason Security Team

The Cybereason Security Team champions cyber defenders by providing future-ready attack protection that unifies security from the endpoint, to the enterprise, to everywhere the battle moves. The Cybereason Defense Platform combines the industry’s top-rated detection and response (EDR and XDR), next-gen anti-virus (NGAV), and proactive threat hunting to deliver context-rich analysis of every element of a Malop (malicious operation). The result: defenders can end cyber attacks from endpoints to everywhere.

All Posts by Cybereason Security Team