The SOC case files: Play ransomware targets manufacturing firm

Incident summary

• A U.S.-based manufacturing company was recently targeted by the Play ransomware group in the early hours of the morning
• The attackers broke into an under-protected domain controller at 1:00 am
• At 3:20 a.m. the gang attempted to execute the ransomware. They targeted multiple endpoints that were monitored by the security operations center (SOC).
• The SOC identified the attack, alerted the customer, and took automated response actions.
• By 3:23 a.m. the attackers had been blocked and locked out of the network.

The SOC is part of Barracuda Managed XDR, an extended visibility, detection, and response (XDR) service that provides customers with round-the-clock human and AI-led threat detection, analysis, and mitigation services to protect against complex threats.

How the attack unfolded

The attack took place on a Tuesday night in October

• At approximately 1:00 a.m. the sophisticated threat actors began their attack. They started by exploiting compromised credentials for a domain admin account, which allowed them to authenticate to an under-protected remote desktop server from where they planned to conduct the whole operation.
• The target did not have XDR server security in place, leaving a gap in monitoring capabilities that could have detected anomalous activity on the domain controller at the very start of the attack.

The main attack

• The attackers then tried to establish persistence. They did so by installing a legitimate remote monitoring and management (RMM) application on the target server so that they could control the host remotely.
• Next, the attackers employed a living off the land (LOLT) tactic by using PsExec, a native Windows tool commonly abused by threat actors. The group used PsExec to create additional files intended to be used for persistence.
• The attackers then attempted to query the registry to obtain the SysKey to conduct credential dumping and lateral movement. XDR Endpoint Security detected the activity and successfully killed the malicious process.
• After this, the attackers attempted to evade defenses by disabling the OS firewall, manipulating Windows Defender, and attempting to delete shadow copies — all of which were also remediated by XDR Endpoint Security.
• Finally, at 3:20 a.m. the attackers attempted to execute Play ransomware to encrypt several assets. XDR Endpoint Security quickly mitigated the ransomware.
• By 3:23 a.m. the targeted endpoints were isolated from the network, and the attack had failed.

Restore and recover

• XDR Endpoint Security’s SentinelOne agent killed, quarantined, and mitigated the malicious processes and files throughout the attack lifecycle.
• The Storyline Active Response (STAR) custom rules developed by Barracuda’s SOC engineers effectively detected the file manipulation that signaled attempted encryption and took response actions to isolate the targeted endpoints.
• Barracuda’s SOC analysts, who operate 24x7, sprang into action to isolate as a precaution any additional endpoints where suspicious activity was observed.
• The SOC also issued rollback commands to restore the targeted endpoints to their prior state, before the threats were present.
• The SOC analyzed the events, established a timeline, and identified key artifacts, including the compromised admin account, breached server, and communication with a malicious IP.
• The SOC provided critical recommendations to the organization to help them strengthen the security of their environment.

The main tools and techniques used in the attack