I found this Akira Ransomware writeup absolutely fascinating today. Why did I find it fascinating? Because this is a direct profile of many of the clients that I work with.
(1) The attack surface was external using credential spraying.
(2) NGFW matches most of the clients I work with.
(3) Any sort of simple monitoring and log aggregation would have alerted internal resources that something was amiss.
(4) The cost of implementing the basic fundamentals here are minimal.
I truly don’t believe that an organization has to spent infinite funds on their security program. Too many organizations chase the latest tooling or product because of flashy marketing. Oooh it has AI and all that.
No. You just need to cover the basics. Don’t let perfect become the enemy of good.
Cycle credentials. Disable accounts. Monitor your attack surface and reduce it as you can. Set up basic monitoring so you know when odd things (like the clearing of event logs!) happens.
All credit to Manuel Humberto Santander Peláez and SANS for this excellent write up.
https://isc.sans.edu/diary/Reconstructing+an+Akira+Ransomware+Kill+Chain+from+Perimeter+and+Endpoint+Logs/33024/?is=2d2fbe785afc9b8e2c6eea7c1d709cc40114a256e13b934fc4d3e4e0efacc396