Full Report
Building Adaptable Security Architecture Against NetWalker NetWalker Overview The NetWalker ransomware, initially known as Mailto, was first detected in August... The post McAfee Defender’s Blog: NetWalker appeared first on McAfee Blog.
Analysis Summary
# Tool/Technique: NetWalker Ransomware
## Overview
NetWalker is a significant ransomware strain, initially detected as 'Mailto', that has evolved into a robust Ransomware-as-a-Service (RaaS) model, attracting technically advanced criminal affiliates. Its effectiveness is suggested by evidence of victims paying large sums in bitcoins.
## Technical Details
- Type: Malware family (Ransomware)
- Platform: Not explicitly detailed, but ransomware typically targets Windows environments for file encryption.
- Capabilities: File encryption for extortion, operation under a RaaS model.
- First Seen: August 2019 (known initially as Mailto).
## MITRE ATT&CK Mapping
The article primarily maps the *tactics* related to NetWalker intrusion stages, rather than specific execution techniques:
- **Initial Access**
- T1566.001 - Spearphishing Attachment
- T1190 - Exploit Public-Facing Application (e.g., Tomcat, Web Logic)
- T1078 - Valid Accounts (e.g., via RDP Compromise)
The analysis also highlights associated behavioral techniques:
- Use of PowerShell for deployment.
- Modification of Registry Keys/Startup folder for persistence.
- Encryption of files (Impact).
## Functionality
### Core Capabilities
- **Initial Access:** Gaining entry via spearphishing attachments, exploitation of public-facing applications (e.g., vulnerable Web Logic, Tomcat instances), or leveraging compromised valid accounts (e.g., RDP access).
- **Execution/Persistence:** Deployment utilizing PowerShell and establishing persistence through modification of Registry Keys or the Startup folder.
- **Impact:** Comprehensive file encryption to extort victims.
### Advanced Features
- **Ransomware-as-a-Service (RaaS):** Operates on a RaaS model, suggesting a structured criminal enterprise supporting affiliates.
- **Evolution:** Has evolved into a more "stable and robust" variant since its initial appearance.
## Indicators of Compromise
*Note: The summary provided by the context focuses on layered defenses rather than specific IOCs, but the description details known methods for IOC generation.*
- File Hashes: [Not provided in the context]
- File Names: [Not provided in the context]
- Registry Keys: Modification of Registry Keys/Startup folder (Persistence implementation).
- Network Indicators: [Not provided in the context]
- Behavioral Indicators: Use of PowerShell for deployment; attempts to encrypt files; attempts to gain persistence in Startup folder/Registry.
## Associated Threat Actors
- Technically advanced and enterprising criminal affiliates operating under the NetWalker RaaS structure.
## Detection Methods
The article emphasizes security architecture based on intelligence gathering using tools that provide CTI, including MITRE ATT&CK mappings.
- **Behavioral Detection:** Detection based on the known attack stages and behaviors (e.g., PowerShell execution for deployment, file encryption activity).
- **Adaptive Defenses:** Importance of user awareness training, behavior-based malware defenses on email systems, and web access controls.
## Mitigation Strategies
Mitigation relies on layering security controls across device, network, and security operations, often mapping to CIS Top 20 Controls:
- **Initial Access Prevention:**
- Strong boundary defense and limitation of network ports/protocols (CSC 9, 12).
- Endpoint Security (Threat Prevention, Application Control) against vulnerability exploitation (T1190).
- Email/Web protection and Adaptive Threat Protection against phishing (T1566.001).
- **Persistence Prevention:** Monitoring and restricting modifications to critical persistence locations like the Registry and Startup folder.
- **General Security Posture:** Continuous vulnerability assessment (CSC 3) and secure configuration management (CSC 5).
## Related Tools/Techniques
The document notes that NetWalker leverages tactics and techniques "common to other ransomware attacks."