Using the MITRE ATT&CK^® Framework to Boost Ransomware Defenses

The explosive growth, evolution, and success of ransomware over the past few years has given rise to more and more cybercriminal gangs going the route of Ransomware as a Service (RaaS). Mirroring the normal business sector, we’re seeing a separation of duties unfold, which is yielding a best of breed scenario for both development and execution.

Traditionally, the people that are really good at developing ransomware, aren't necessarily so good at executing it, and vice versa. However, with the RaaS model, both parties are able to focus on what they do best. The result, of course, is that the threat to businesses is growing as the cybercriminal gangs are becoming more effective and taking millions of dollars in ransoms. 

This paper will look at some of the tactics, techniques, and procedures (TTPs) used by REvil and Conti to explore how they impact organizations and hold them for ransom.