Ransomware:

Let’s Talk About Ransomware

Providing the Critical Visibility Necessary to Identify Ransomeware BEFORE Extortion Occurs
IronNet-Ransomware-Reconnaissance@2x
Reconnaissance
  • Essential to be able to understand the target
  • Could be network based, socially based, or supply chain based
  • External and Internal Scanning Analytics
  • Phishing and PII Data Loss Analytics to identify weak points in employee training
Learn how
IronNet-Ransomware-Initial Entry Point@2x
Initial Entry Point
  • Compromised Web Pages, Phishing Back doors, Direct system access…
  • Necessary to establish a mechanism of control. Workstations are primary targets
  • Suspicious File Download
  • Knowledge Base
  • TIRs 
  • Extreme Rates
Learn how
IronNet-Ransomware-C2@2x
C2(Command & Control)
  • Ransomware cannot operate in a vacuum, and must be controlled to be effective
  • Covert C2 channels are difficult, but not impossible to detect
  • Beaconing Behaviors
  • DGA
  • Tunneling
  • Domain Analysis
  • Knowledge Base
Learn how
IronNet-Ransomware-ExpansionPersistence@2x
Expansion / Persistence
  • In order to be effective, multiple systems must be accessed and controlled
  • The individual workstation is never the end target
  • Lateral Movement
  • Logon/Logoff
  • Password Spray
  • Suspicious File Download
  • Knowledge Base
  • TIRs
Learn how
IronNet-Ransomware-Encryption@2x
Encryption / Exfil
  • This is the last chance to intercept prior to ransom
  • Data will be encrypted and removed from the network for leverage
  • Extreme Rates
  • TOR Traffic
  • PII Data Loss
  • Encrypted Comms 
  • Unusual Day
Learn how
[ Click the links above to take a tour of our platform. ]