APT Groups Using Ransomware ‘Smokescreen’ for Espionage

Nation-state hackers are now relying on collaboration with ransomware groups for espionage campaigns, making it challenging for security researchers to distinguish their hacking operations, as well as attribute attacks to specific groups.

See Also: A Modern Approach to Data Security

Reports by Google Cloud and Trellix indicate that the growing collaboration between nation-state actors and cybercriminal networks for help with initial access and the use of custom malware sold on underground forums.

APT groups are using ransomware as a “smokescreen for geopolitical objectives,” said Tomar Shloman, a senior security researcher at Trellix. “Deploying ransomware allows these groups to create chaos and financial losses while masking the true objective – accessing sensitive information,” Shloman told Information Security Media Group.

Google also found evidence of APTs using ransomware to hide their tracks. In one case, STEAMTRAIN ransomware was deployed by the Chinese GhostEmperor group, but the variant dropped a JPG file named “Read Me.jpg” that contained a ransom note that appeared to come from the DarkSide ransomware-as-a-service group. On analyzing the file, Google found no links to the DARKSIDE group.

“Deliberately mixing ransomware activities with espionage intrusions supports the Chinese government’s public efforts to confound attribution by conflating cyber espionage activity and ransomware operations,” Google said.

John Hultquist, chief analyst at Google Threat Intelligence Group, said ironically law enforcement crackdowns may be driving these the APT-ransomware collaborations.

“As we ratchet up the pressure on these criminals, we may be inadvertently driving them into the arms of government sponsors,” Hultquist told Information Security Media Group.

Another noted case includes North Korea Jumpy Pisces collaborating with the Play ransomware gang for espionage.

This growing collaboration is adding complexity to current threat detection and mitigation practices.

“One major issue is attribution complexity. Additionally, there is a growing sophistication gap,” Shloman said. “As tools and techniques are shared between these groups, the level of technical expertise required for detection and mitigation continues to rise, pushing the limits of current defenses,” he said.

Recent ransomware attacks targeting critical infrastructure in defense and healthcare – key strategic areas of interest for APT groups – are an indication of this evolving collaboration, he added.

“Researchers will have to pay closer attention to find the connections between criminal and state activity. We will have to think more critically about the implications of some criminal activity we might have never prioritized,” Hultquist said about addressing the security risks stemming from APT and ransomware convergence.

In addition to sanctions and malware infrastructure takedowns, governments should consider policies that would encourage security-by-design principles, as well as diversification of vendors to avoid the risk stemming from overreliance on a single technology, Google said.