Turn And Face The Strange: Ch-Ch-Changes In Ransomware Techniques by Lindsay Kaye

### Overview In this talk, Lindsay Kaye, Senior Director of Advanced Reversing Malware Operations and Reconnaissance at Recorded Future's Insikt Group, examines recent tactical, techniques, and procedures (TTP) changes across the ransomware ecosystem. Driven by market pressures and competition, ransomware groups actively innovate their tooling, delivery, and extortion strategies. However, these technical shifts do not always produce their intended effects; poorly planned or executed features frequently backfire, introducing exploitable flaws, distinct signature artifacts, and opportunities for defensive hunting.

### Key Topics - **Evolution of Delivery and Extortion**: Attackers increasingly utilize benign tools, MSP software, SMB/CIFS/NFS shares, and impersonation tokens for lateral movement. To force ransom payments, threat actors deploy multi-faceted extortion, including DDoS attacks, direct outreach to executives and journalists, and printing ransom notes directly via network printers. - **Language Transitions and Architecture Targeting**: Groups have shifted from traditional C/C++ to languages like Rust, Go, and Python. Furthermore, operators are releasing specialized lockers for Linux, VMware ESXi, and ARM architectures (targeting NAS platforms like QNAP and Synology). - **Speed via Intermittent Encryption**: Attackers such as Play, ALPHV, Black Basta, and Agenda encrypt data intermittently (e.g., alternating 1 MB blocks) to maximize encryption speed and evade detection while preventing easy file recovery. - **Flawed Tooling and Obfuscation**: Custom obfuscation frameworks (such as ALPHV's Morph toolkit) and homemade cryptographic implementations frequently result in bloat, reverse-engineering aids (like unstripped symbol names), or catastrophic decryption bugs that allow victim file recovery without payment. - **Code Reuse and Rebranding**: Leaked source code and builders (notably BlackMatter, Conti, and REvil) fuel multiple offshoots, including LockBit Black and LockBit Green, as well as false-flag attribution efforts.

### Technical Details - **Play Ransomware**: Written in C++, Play introduced a minimal ransom note and intermittent encryption (encrypting every other 1 MB). In August 2022, Play incorporated Return-Oriented Programming (ROP) gadgets using `ret` instructions to jump to actual code, alongside automated garbage code insertion and API hashing. While ROP complicated static analysis, the automated garbage code proved highly signatureable. - **ALPHV (BlackCat)**: Emerging as a rebrand of BlackMatter/DarkSide, ALPHV introduced a cross-platform Rust codebase, an ARM variant for NAS devices, and build-time chat access tokens requiring parameters to prevent security researchers from discovering active victim negotiation links. Its "Morph" obfuscation engine utilized a 1-byte XOR key and dead arithmetic code on Windows, expanding binary sizes over fourfold. On 64-bit Linux/ESXi builds, Morph failed to obfuscate strings and left demangled function names containing references like `Locker` and core routines. - **Cryptographic Blunders**: ESXiArgs' early variant calculated skip offsets based on file size, skipping approximately 4.5 GB in large virtual machine disks (leaving data largely intact). Luna failed to stop VMs before encrypting them, causing data corruption. DarkSide and BlackMatter rolled custom crypto with flaws that enabled researchers to create free decrypters. - **LockBit Evolution & Code Lineage**: LockBit deployed the "StealBit" automated exfiltration utility and actively solicited enterprise insiders for initial access. Following leaks of BlackMatter and Conti source code, LockBit created LockBit Black and LockBit Green. LockBit Black retained BlackMatter's architecture, anti-debugging tricks (such as crashing when a breakpoint is placed on a thread), and configuration formats, while adding password-based execution/decryption flags and extended command-line options. - **False-Flag Attribution**: Threat actors frequently attempt misdirection, such as LockBit claiming Chinese residency, or groups posting machine-translated Chinese on forums like RAMP. In one case, a group claiming to be Chinese (Yanluowang) had internal Russian chat logs leaked, while samples of "Xiao" ransomware reused REvil's "Revix 1.1" Linux locker codebase.

### Takeaways Defenders and malware analysts can capitalize on threat actor mistakes to hunt and disrupt ransomware operations. Tracking automated obfuscation artifacts, compiler-specific runtime anomalies, odd string misspellings, anti-analysis patterns, and code reuse across leaked builders provides powerful pivot points for detecting emerging ransomware variants.