Ransomware Defense: Where Decryptors Fit into the Bigger Picture

The prevalence of ransomware-as-a-service (RaaS) and increased activity from cybercriminal groups have turned the ransomware problem into a serious issue for organizations. Ransomware is considered one of the top threats posed to organizations by a majority of respondents in Bitdefender’s 2024 Cybersecurity Assessment Report.

Threat actors are not only shifting their tactics but they’re also refining their practices, forcing organizations to adapt in order to manage their risk effectively. 

As ransomware groups continue to evolve, focusing on compromising organizations and exposing sensitive data, the role of ransomware decryptors has shifted. While decryptors can provide critical help in rare cases, relying on them as a fallback creates a false sense of security. Security leaders must recognize that these tools are a last resort, and depending on them alone can lead to disastrous consequences when targeted by increasingly sophisticated threat actors. 

Decryptors still serve a very important role, but organizations must understand how to maximize their effectiveness while remaining vigilant against the evolving tactics of ransomware attacks.

Inside the Minds of Ransomware Attackers: Tactics Used to Compromise Organizations

As we’ve detailed recently, ransomware groups function like small businesses, with specialized roles contributing to a highly efficient system. Among these roles, initial access brokers are responsible for one of the most significant shifts in how ransomware targets its victims.

Initial access brokers (IABs) serve as the penetration experts and are responsible for an organization’s compromise. IABs typically act as intermediaries, buying access from skilled hackers and selling it to affiliates. While they may occasionally enhance access to fetch a higher price, they are not the technical experts responsible for the deeper stages of the attack.

Once access is sold, affiliates or hacking experts often exploit known vulnerabilities and begin the manual hacking process to fully compromise the target. Bitdefender’s threat analysts have found that edge network devices are targeted most often via automated scanning tools. Then, the threat actor will fully embed themselves within an organization. To make the attack even more successful, they’ll implement a backdoor and establish persistence, or develop a way to remotely access the network, allowing them to return to an organization’s network in case something goes wrong.

To evade detection and further deepen their access, they’ll move laterally within a company’s infrastructure and amass more privileges and permissions, prepping to launch the attack. Manual hacking is the longest step within the life cycle of a ransomware attack but it still takes days, so organizations still need to move quickly. 

The use of manual hacking, coupled with tactics like manipulating backups and favoring quiet negotiations disguised as penetration testing exercises, has expanded ransomware attacks beyond traditional encryption-based methods. Instead, threat actors will exfiltrate and encrypt sensitive data and threaten to leak or expose it. They can even threaten to disclose the occurrence of a breach or compromise if the ransom isn’t paid, as that can have its own reputational, legal, and regulatory consequences. 

These double extortion attacks are becoming more common and have become the default approach for many ransomware groups, which is why decryptors, while still valuable, are now just one part of a broader strategy in the fight against ransomware. 

The Evolving Role of Decryptors in the Fight Against Ransomware 

In the past, decryptors were essential for two main reasons:  

1. Restoring a victim’s encrypted files: Decryptors acted as a direct counter to ransomware that encrypted data, restoring an organization’s access to their files and eliminating the need to pay a ransom. Once a decryptor was developed, it could only be used against a specific version of ransomware, limiting its overall effectiveness. While helpful in some cases, decryptors often provide only a partial solution and are not universally effective.
   
2. Destabilizing the ransomware economy: Decryptors were initially effective against specific ransomware strains, disrupting a ransomware group's ability to collect ransoms and significantly impacting their revenue models. This led to internal conflicts between affiliates and operators. Affiliates, who are responsible for delivering the ransomware payloads, often blamed operators for issues like poor operational security (opsec) or software bugs that allowed decryptors to be developed. On the other hand, operators downplayed the impact, arguing that not all victims would have paid the ransom regardless. This internal tension within ransomware groups contributed to a shift in tactics, though other factors, such as improved defenses and law enforcement actions, played a larger role in their adoption of more resilient strategies. 

To minimize the effectiveness of decryptors, ransomware groups began adopting languages like Go and Rust, which made reverse engineering more difficult. Additionally, many threat actors gained access to leaked, mature ransomware code, such as Conti’s, allowing even new groups to start with more advanced and resilient code than in the past. Larger ransomware groups began using these methods, making it near impossible for decryptors to be developed, unless law enforcement was able to infiltrate a group to steal information that could lead to the development of a decryptor. 

The shift towards double extortion attack was also a way to minimize the impact of a decryptor.  

Even if a successful decryptor was deployed, ransomware groups could still threaten exposure and collect their ransom.  

While decryptors are effective at restoring encrypted files, they are utilized post-compromise. This means they don’t help prevent or remediate an attack or a compromise, which is critical given how much access a ransomware group can have due to manual hacking. The exploited vulnerability may still be present, and an initial access broker can easily just attack an organization again. Just last year, the FBI released a statement highlighting the trend of repeat ransomware attacks against previously compromised organizations. Decryptors have no role in preventing this kind of attack. 

Strengthen Your Cyber Resilience: The Final Step 

Decryptors remain a valuable tool in the fight against ransomware, and organizations should always check platforms like No More Ransom to see if a decryptor is available for a current attack. However, decryptors should be viewed as a last line of defense, as they are most effective when used in tandem with proactive measures. It’s more important for organizations to build a more comprehensive and proactive cybersecurity plan against ransomware. While decryptors can be a helpful tool, they should never be considered a primary solution. Instead, organizations should focus on proactive investments in remediation and active threat detection to reduce the impact of ransomware attacks. 

 NoMoreRansom.org offers helpful advice and tools to recover your files without paying the ransom. 

To further protect against these new ransomware tactics, manual hacking, and their various methodologies, such as persistence implementation, privilege escalation, and lateral movement, organizations should prioritize: 

• Vulnerability Management:  By having a prioritized vulnerability management strategy, you minimize the risk of the first step of manual hacking and cut off a ransomware group’s ability to compromise your organization early in the process. Ensure your edge network devices are patched and keep an eye out on CISA’s list of known exploited vulnerabilities as you prioritize critical vulnerabilities. Because ransomware groups are leveraging automated scanning tools to look for vulnerable devices, having patched vulnerabilities will keep you off these groups’ radar. 

• Managed Detection and Response (MDR) and Extended Detection and Response (XDR) Solutions: Advanced detection and response technologies can help identify affiliates as they try to embed themselves deeper in your network. Post-compromise, MDR and XDR tools and services can also facilitate faster incident response and more effective remediation, minimizing the damage a successful ransomware attack can do. 

As ransomware groups evolve and advance their methods, organizations should respond accordingly and look to build out more robust cybersecurity strategies. By having a holistic and comprehensive plan, they can spot an attack early on and be prepared, making sure an attack doesn’t have devastating financial or reputational consequences.

For a deeper dive into effective strategies for ransomware defense, read our regularly updated ransomware white paper. It explores the intricacies of ransomware attacks and defense mechanisms, equipping your team with the knowledge to build resilient security postures.

For additional insights into the inner workings of ransomware gangs, don’t miss our latest eBook, The Gig Economy Behind Ransomware. This resource offers a high-level overview of how these cybercriminal operations function and practical recommendations for organizations. Access both resources to enhance your defenses and stay ahead of emerging threats.