Future of Threat Intelligence ZScaler’s Brett Stone-Gross on the Tactics of the Dark Angels Ransomware Group (Black Hat Edition)
In our latest special episode of the Future of Threat Intelligence podcast, Brett Stone-Gross, Senior Director of Threat Intelligence at Zscaler, joins us at the Black Hat conference. He shares their uncovering of the largest ransomware payment in history — $75 million — made by a Fortune 50 company to the Dark Angels group.
Brett explains the group's unique approach, which involves stealing vast amounts of data without encrypting files, and their preference for low-volume, high-impact attacks to evade media scrutiny. He also highlights essential cybersecurity measures, such as implementing two-factor authentication and adopting a zero-trust architecture to protect against such threats.
Topics discussed:
- How the Dark Angels group executed the largest ransomware payment in history, totaling $75 million.
- How, unlike typical ransomware attacks, the group stole data without encrypting files, exfiltrating approximately 100 terabytes of sensitive information.
- How their operational model is low-volume, focusing on individual companies to avoid media attention and maintain a low profile.
- The importance of basic IT hygiene practices, such as two-factor authentication, which are crucial for preventing significant data breaches and ransomware attacks.
- How implementing a zero-trust architecture can help organizations limit lateral movement and enhance overall cybersecurity defenses against threats.
Key Takeaways:
- Implement two-factor authentication to enhance security and reduce the risk of unauthorized access to sensitive corporate data.
- Monitor network traffic for anomalous behavior, especially large data transfers, to quickly identify potential data exfiltration attempts.
- Adopt a zero-trust architecture to limit lateral movement within your network and ensure users only access necessary resources.
- Limit user privileges, ensuring that users have only the access necessary for their roles.
- Stay informed about emerging ransomware trends and tactics to proactively adjust your cybersecurity strategies and defenses.
If you’re interested in Team Cymru’s latest research, download our “Voice of a Threat Hunter 2024” report here: https://www.team-cymru.com/voth2.0