Initial Access & Workflow: Ransomware Insights

Initial Access & Workflow: Ransomware Insights

Speakers: Iulian Schifirnet, Senior Penetration Tester, Data Core Systems

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=A1z-fAwsOA8

Overview

In this insightful talk from DefCamp, Iulian Schifirnet, a Senior Penetration Tester at Data Core Systems, pulls back the curtain on the initial access methodologies and subsequent workflow employed by modern ransomware operators. Moving beyond theoretical exploits, Schifirnet focuses on real-world techniques that remain alarmingly effective even in 2025, drawing heavily from leaked playbooks of prominent ransomware groups like Logbit and the notorious operator known as "Buster Lord." The presentation serves as a stark reminder that many successful breaches leverage fundamental vulnerabilities and human errors rather than sophisticated zero-days.

Schifirnet's objective is to dissect the attacker's journey from reconnaissance to ransomware deployment, providing a granular view of their tactics, techniques, and procedures (TTPs). By illustrating how initial access brokers (IABs) and even internal employees facilitate these attacks, the talk underscores the critical importance of robust foundational cybersecurity practices. It’s a call to action for defenders to understand the adversary's mindset, prioritize early detection, and implement comprehensive strategies to disrupt the ransomware kill chain before significant damage occurs.

This article will delve into the core aspects of Schifirnet's presentation, from the initial reconnaissance phases and common access vectors to the intricate details of privilege escalation, lateral movement, and ultimately, the defensive measures organizations must adopt to counter these persistent threats. The insights provided are not merely academic; they are derived from the cold, hard reality of ransomware operations, offering invaluable lessons for cybersecurity professionals.

Background

▶ Watch: Introduction: Ransomware Initial Access Insights (0:00)

Ransomware remains one of the most pervasive and financially devastating threats to organizations worldwide. At its core, ransomware is a malicious activity designed to deny access to systems and data, often coupled with data exfiltration, in exchange for a monetary ransom. The impact is multifaceted, ranging from severe operational downtime and lost business continuity—potentially lasting weeks or months—to direct financial costs from ransom payments, incident response, legal fees, and regulatory fines. Perhaps most critically, it erodes customer trust and causes significant reputational damage.

The ransomware ecosystem operates efficiently, often leveraging a Ransomware-as-a-Service (RaaS) model where developers provide payloads and infrastructure, while affiliates (operators) execute the attacks. The primary motivation is financial gain, driven by ransom payments, insurance payouts, and extortion. Schifirnet highlights resources like Ransomware.live, a public repository for ransom notes and victim reports, and stresses that attackers often perceive this as a "normal job," working 9-to-5, devoid of empathy for their victims' pleas. He also points out that skilled crisis negotiators can often reduce ransom demands by 50% or more, and importantly, attackers typically cease their operations once contacted, assuming the victim intends to pay.

A crucial component of the ransomware kill chain is initial access – the first foothold an attacker gains within a target environment. This access is highly valued and often brokered on dark web forums. Schifirnet distinguishes between Initial Access Brokers (IABs), who gain access and then sell it, and Initial Access Providers, which can even be internal employees susceptible to financial or personal pressures. The latter poses a particularly insidious threat due to their direct, authorized entry into an organization's systems.

The talk introduces "Buster Lord," a 23-year-old operator who worked for prominent groups like Conti and Logbit, specializing in initial access brokerage through corporate VPN brute-force attacks. His leaked playbooks, sold for over $10,000 on the dark web, form the practical backbone of Schifirnet's presentation, illustrating the real-world TTPs of these adversaries.

Common initial access vectors highlighted include:

• Email Phishing (70% of attacks): Still the most prevalent entry point, used for credential harvesting or delivering malicious attachments.
• Credential Compromise and Reuse: Exploiting leaked or weak credentials for VPNs, cloud services, and internal portals. The speaker emphasizes Multi-Factor Authentication (MFA) and strong password hygiene as high-return-on-investment defenses.
• Exposed Remote Services: Services like RDP (Remote Desktop Protocol), VPN (Virtual Private Network), and SSH (Secure Shell), often exposed to the internet, are prime targets. Tools like Censys and Shodan are used by attackers to discover these services, even when running on non-default ports (e.g., not 3389 for RDP).
• Software Vulnerabilities and Exploits: Unpatched or misconfigured internet-facing applications (e.g., web portals with SQL injection vulnerabilities) provide entry points.
• Supply Chain and Third-Party Access: Malicious code injected into software updates or dependencies can compromise numerous customers downstream.

Key Findings

▶ Watch: Buster Lord's FortiVPN Cleartext Credential Exploit (8:00)

Schifirnet's presentation reveals several critical findings about contemporary ransomware operations, primarily informed by the practical methods documented in Buster Lord's playbooks:

1. Simplicity Trumps Sophistication: Despite the perception of ransomware as highly advanced, many successful attacks rely on surprisingly basic and well-known techniques. Buster Lord's methods frequently involved brute-forcing weak credentials, exploiting older, publicly known vulnerabilities (like FortiVPN's CVE-2018-XXXX or EternalBlue), and leveraging common misconfigurations. This underscores that fundamental security hygiene failures, rather than zero-day exploits, are often the primary enablers.

1. OSINT is Foundational: Open-source intelligence (OSINT) is not just a preliminary step but a deeply integrated component of the attacker's workflow. Information like email patterns, employee roles, and exposed services gathered from tools like Phonebook, Intelix, Shodan, and Leaks is crucial for mapping targets, identifying high-value assets, and crafting highly believable social engineering campaigns.

1. Ubiquitous Misconfigurations and Weaknesses: The prevalence of publicly exposed VPN endpoints without MFA, the use of weak or leaked credentials (e.g., "test/test," "wsv/12345678"), and poor network segmentation are recurring themes. These common mistakes create vast attack surfaces that ransomware operators actively scan for and exploit. The speaker even notes that the FortiVPN clear-text credential exploit from 2018 is "still used in 2025" and yields "a lot of hits."

1. Ransomware Operators Mimic Business Operations: The talk highlights that these groups often operate with a structured, almost corporate, approach (e.g., 9-to-5 workdays). They also engage in "negotiations," often ceasing active attacks once contact is made, demonstrating a calculated, trust-based (albeit malicious) business model. This behavior can be leveraged by victims to buy critical time for recovery.

1. Early Detection is Paramount: The entire workflow emphasizes the dramatic impact of stopping attackers early. Detecting initial access or lateral movement before critical assets are compromised significantly reduces the attacker's ability to escalate privileges and cause widespread damage. This necessitates a shift towards behavioral detection rather than solely signature-based approaches.

1. Backups are a Primary Target: Once inside, attackers prioritize compromising backup systems (e.g., Synology, Veeam). The statistic that "40% of the cases domain admin credentials are working" to access backup solutions highlights a severe vulnerability, as the destruction or encryption of backups ensures the victim's inability to recover without paying.

Technical Deep Dive

▶ Watch: ZeroLogon (DC Sync) for Domain Controller Compromise (22:00)

The core of Schifirnet's talk is a detailed walkthrough of the ransomware operator's technical workflow, mirroring the steps outlined in Buster Lord's playbooks.

Reconnaissance and Initial Foothold

The journey begins with OSINT (Open Source Intelligence). Attackers gather publicly available information to map organizational structures, identify key personnel, discover email patterns (which often match Active Directory usernames), and pinpoint exposed services. Tools mentioned include:

• Phonebook (IntelligenceX): For email harvesting.
• Intelix: For searching data breaches and compromised credentials.
• Shodan/Censys: Internet search engines for exposed services, vulnerabilities, and misconfigurations (e.g., RDP not on port 3389).
• Leaks: For exposed data and leaked files.

While sophisticated OSINT is possible, Buster Lord often opted for a more direct approach: brute-forcing. Examples include:

• Cisco VPN: Targeting instances where administrators left default or test accounts like "test" with password "test."
• FortiVPN: Leveraging the fact that an employee mentioned a Forti instance, leading to a successful login with username wsv and password 12345678 for a company with a $25 billion revenue.
• Exploiting CVE-2018-XXXX: This exploit for FortiVPN allows recovery of clear-text credentials. Buster Lord would use a Russian online mass scanner to find vulnerable FortiVPN IPs, then execute a Python script (exploit.py) against the list to harvest usernames and passwords.

Privilege Escalation and Internal Reconnaissance

Once initial access is gained (e.g., via VPN), the attacker focuses on internal reconnaissance and privilege escalation. Key targets include:

• Domain Controllers (DCs): The ultimate prize for network control.
• Databases, Password Vaults, NAS Shares: Rich sources of sensitive data and credentials.
• Accounts with Administrative or Backup Privileges: Service accounts, admin accounts.
• Local file shares, desktop folders, document management systems: Often contain cached credentials, configuration files, or sensitive documents (e.g., "sysadmins storing all passwords on a simple document on desktop").

Buster Lord's approach involved:

1. Network Scanning: Using tools like SoftPerfect Network Scanner (or Nmap). Crucially, he would configure the scanner to use the stolen credentials, hoping to gain access to more systems. He looked for common management ports (RDP 3389, Synology 5000/5001, Veeam backup ports).
2. Exploiting EternalBlue (MS17-010): SoftPerfect Scanner includes modules, one of which is for EternalBlue. By scanning the network with this module, Buster Lord could identify machines vulnerable to this exploit, gaining local administrator access to them.
3. Metasploit Integration: For vulnerable machines, he would launch Metasploit Framework (msfconsole), set the exploit/windows/smb/ms17_010_eternalblue module, provide the vulnerable IPs, and establish a session.
4. Domain Information: Within the Metasploit session, sysinfo command would reveal if the machine was domain-joined, indicating the presence of an Active Directory.
5. Credential Dumping: With local administrator access, hashes of local users could be dumped and subsequently cracked or reused in Pass-the-Hash attacks.

Other privilege escalation techniques mentioned include:

• Brute-forcing Relative Identifiers (RIDs): If a domain controller allows guest authentication, RIDs can be brute-forced to enumerate users, creating a username list.
• AS-REP Roasting: Targeting user accounts that have "Do not require Kerberos preauthentication" enabled. Attackers can extract password-derived data (hashes) offline. An example from the speaker's lab showed a user "Nell Robinson" with password "squrty."
• Kerberoasting: Exploiting service accounts with weak Service Principal Names (SPNs) to obtain hashes.
• Pre-Windows 2000 Computer Accounts: A legacy misconfiguration where a computer account's password defaults to its lowercase machine name (e.g., WSOLD$ becomes wsold). This can be bypassed by changing the password, allowing reuse.
• Cleartext Credentials in AD Descriptions: Attackers query Active Directory for user descriptions, which sometimes contain passwords.
• LDAP Queries and BloodHound: Using valid accounts to perform LDAP queries and map the Active Directory structure into a graph for further exploitation (e.g., with BloodHound).

Lateral Movement and Pivoting

Once inside, attackers move laterally to reach their objective, often the domain controller or critical data.

• Credential Reuse: Buster Lord extensively reused cracked local administrator credentials to access more machines.
• Zerologon (CVE-2020-1472) Exploitation: A critical vulnerability allowing an attacker to bypass cryptographic checks and reset a domain controller's machine account password to an empty string. This is achieved using a simple exploit script with the DC's hostname and IP.
• DCsync Attack: After exploiting Zerologon, the attacker can perform a DCsync attack using tools like secretsdump.py from Impacket. This dumps all user hashes from the Active Directory, including the powerful domain administrator hashes.
• Hash Cracking and Pass-the-Hash: Dumped hashes are sent to cracking services like crackmd.ru (or alternatives like crackstation.net). However, often, attackers use Pass-the-Hash with tools like smbexec.py (Impacket suite) to authenticate directly to systems without cracking the password, as many hashes are not easily crackable.
• Persistence: With domain administrator access, Buster Lord would create a new, inconspicuous user (e.g., "support"), activate it, add it to the local administrators group, and then to the Domain Admins group. This is a significant "red flag" for defenders.
• AV Evasion: To deploy tools and move freely, attackers disable endpoint security. While directly disabling Windows Defender is an option, a more subtle approach is to add an exclusion folder and dump all tools there.
• Targeting Backups: Ransomware operators prioritize compromising backup systems (e.g., Synology on ports 5000/5001, Veeam). Schifirnet notes that domain admin credentials often grant access to these systems, allowing attackers to delete or encrypt backups, crippling recovery efforts.

Ransomware Deployment

With complete control, the final stage is ransomware deployment.

• Ransomware Builders: Platforms like Vakkes Underground offer "builders" for various malware and ransomware strains.
• Logbit 3.0 Builder: An example shown, allowing attackers to configure ransom notes, whitelist folders, kill processes, and then generate the encryptor.
• Other Malware: The talk also showed examples of other malicious tools like the 88 Riot Remote Access Trojan (RAT) and the Babuk ransomware builder.

Demo / Proof of Concept

▶ Watch: Blue Team: Behavioral Detection over Tool Signatures (28:30)

Iulian Schifirnet's presentation included several visual demonstrations and references to actual proof-of-concept steps, illustrating the techniques discussed.

1. Buster Lord's Playbook Screenshots: The talk featured authentic screenshots from Buster Lord's leaked playbooks. These visuals depicted:

• Dark web forum posts advertising access to companies.
• Results from mass scanners showing vulnerable FortiVPN instances with clear-text credentials.
• Successful FortiVPN logins using weak credentials like wsv and 12345678.
• SoftPerfect Network Scanner in action, configured with stolen credentials and showing results from an EternalBlue scan, indicating machines vulnerable to local administrator access.
• Output from Metasploit demonstrating the successful creation of a session after exploiting EternalBlue.
• The sysinfo command output within Metasploit, confirming a machine's domain-join status.

1. AS-REP Roasting Example: Schifirnet presented a screenshot from his lab demonstrating an AS-REP Roasting attack, specifically showing the hash extraction for a user named "Nell Robinson" and its successful cracking to reveal the password "squirty." This illustrated the real-world simplicity of exploiting misconfigured Kerberos preauthentication.

1. Zerologon and DCsync Execution: The speaker visually walked through the execution of the Zerologon exploit (CVE-2020-1472). This was followed by a demonstration of secretsdump.py (Impacket) being used to perform a DCsync attack, dumping all user hashes from a compromised domain controller after its machine account password was reset to an empty string. The output clearly showed the extracted hashes.

1. Babuk Ransomware Encryption/Decryption: A practical demonstration showed the use of the Babuk ransomware builder. Schifirnet encrypted files using the generated encryptor, changing their extensions to .Babik. He then successfully used the corresponding decryptor to restore the files to their original state, illustrating the end-to-end process of this ransomware.

These demonstrations, rooted in actual attacker methodologies and tools, provided concrete evidence of the effectiveness of the discussed techniques and the tangible impact of ransomware operations.

Defensive Implications

▶ Watch: Q&A: Strategy to Delay Ransomware Payment (36:00)

Understanding the ransomware operator's workflow is paramount for building effective defenses. Schifirnet provides a comprehensive blueprint for blue teams, emphasizing proactive monitoring and behavioral detection.

Core Telemetry Sources

Organizations must establish robust telemetry collection across critical systems:

• AD and LDAP Logs: Essential for detecting LDAP queries, user enumeration, and the creation of new administrative accounts – common attacker activities.
• Endpoint Protection (EDR/AV): Monitor for process creation, command-line arguments, script interpreter usage, lateral movement tools, and most critically, file encryption activity. It's crucial for endpoint solutions to resist tampering, as attackers will attempt to disable them or create exclusions.
• Network and Firewall Logs: Detect unusual traffic patterns, internal lateral movement, and communication with known command-and-control infrastructure.
• Email and Web Gateways: Essential for identifying phishing payloads, URL redirections, and malicious attachments that serve as initial access vectors.
• Backup Systems: Monitor for snapshot deletions, unauthorized file changes, or access from outside of standard business processes. The fact that domain admin credentials often grant access to backups (40% of cases) highlights the need for isolated, multi-factor protected backup access.

Behavioral Approaches to Detection

Instead of solely relying on signature-based detection, which attackers can easily bypass through obfuscation, defenders must focus on how adversaries operate:

• Unusual Process Chains: Look for legitimate tools (e.g., PowerShell, cmd.exe) executing in anomalous sequences or from unexpected locations.
• Rapid File Modifications: A strong indicator of ransomware activity.
• Authentication from New Hosts: Unexpected logins from previously unseen IP addresses or devices.
• Enumeration of Shares and Users: Attackers frequently scan the network and query Active Directory to map their environment.
• Disabling Security Tools: Alerts should trigger if endpoint protection, firewalls, or other security agents are tampered with or disabled (e.g., Buster Lord disabling Windows Defender).
• Creation of New Local or Domain Admins: As demonstrated by Buster Lord creating a "support" user and promoting it, this is a significant red flag.
• Access to Backups or Shadow Copies: Unauthorized access or deletion attempts on backup systems.

Ransomware Detection and Response Playbook

Schifirnet outlines a structured incident response playbook:

1. Detection & Triage: Validate alerts, assess the scope of the compromise, and prioritize based on asset criticality.
2. Containment: Isolate compromised systems, disable affected accounts, and revoke active sessions. Crucially, if an organization plans to pay the ransom, do NOT shut down or stop the ransomware-affected storage/machines, as this can corrupt files and prevent recovery. Instead, isolate them from the network.
3. Investigation: Collect volatile evidence (memory snapshots), log data, and other digital forensics artifacts.
4. Eradication: Remove malicious artifacts, reset all compromised credentials, and patch exploited vulnerabilities.
5. Recovery: Restore systems from clean backups, verify system integrity, and monitor for re-entry attempts.
6. Post-Incident Review: Analyze the root cause, update detection rules, and enhance response processes to prevent future occurrences.

Q&A Insights for Defense

The Q&A session further emphasized key defensive challenges:

• Data Exfiltration: Extremely difficult to prevent entirely. Attackers can use non-traditional methods like taking photos with phones, encoding data to Base64, or uploading to legitimate file-sharing services (e.g., Pastebin, WeTransfer). The best defense is proactive monitoring of traffic for unusual uploads (e.g., 100GB at night) and egress points.
• DLP and Sensitivity Labels: While helpful, Data Loss Prevention (DLP) and sensitivity labels can often be bypassed by a determined attacker (e.g., encoding confidential PDFs to Base64 via PowerShell). They reduce the attack surface but aren't foolproof.
• Limiting Lateral Movement: Achieved through strong network segmentation, diligent monitoring of LDAP queries (unusual queries to domain controllers), and identifying unexpected connections between internal IPs. Regular employees should not typically connect to domain controllers daily.

In essence, defense against modern ransomware requires a multi-layered approach that combines fundamental security hygiene, proactive monitoring, behavioral detection, and a well-rehearsed incident response plan.

Key Takeaways

• Simple Techniques Remain Effective: Many successful ransomware attacks, as exemplified by Buster Lord's playbooks, leverage basic brute-forcing, weak credentials, and known, older exploits (e.g., FortiVPN CVE-2018-XXXX, EternalBlue MS17-010). Focus on patching, strong passwords, and MFA.
• OSINT is the Foundation: Open-source intelligence is a critical first step for attackers to map targets, identify high-value assets, and craft effective social engineering or brute-force campaigns. Organizations should be aware of their public-facing information.
• MFA and Network Segmentation are Non-Negotiable: The lack of Multi-Factor Authentication (MFA) on exposed services and poor network segmentation are consistently exploited. These two defenses offer a high return on investment by preventing initial access and limiting lateral movement.
• Behavioral Monitoring is Key: Instead of focusing solely on detecting specific tools, defenders must prioritize identifying anomalous behaviors (e.g., unusual process chains, rapid file modifications, new admin account creation, unauthorized backup access) to catch sophisticated or obfuscated attacks.
• Backups are a Prime Target: Ransomware operators prioritize compromising backup systems, often using domain administrator credentials. Robust, isolated, and multi-factor protected backups are crucial for recovery without paying a ransom.
• Incident Response Requires a Proactive Playbook: A well-defined incident response plan, covering detection, containment (with careful consideration for potential ransom payment), investigation, eradication, and recovery, is essential for minimizing ransomware impact.

About the Speaker(s)

Iulian Schifirnet is a Senior Penetration Tester at Data Core Systems, bringing a wealth of practical offensive security experience to his work. He describes himself as a "certification addict," demonstrating a commitment to continuous learning and professional development in the cybersecurity field. Beyond his role at Data Core Systems, Iulian is also the founder of Disruption Academy, an initiative where he develops and offers offensive cybersecurity courses. This presentation at DefCamp reflects his expertise in understanding real-world attacker methodologies, particularly in the realm of initial access and ransomware operations.