Forest Global Training Partners

Cyber Risks · Cisco Talos

Everyday tools, extraordinary crimes: the ransomware exfiltration playbook

Summary: Cisco Talos describes a shift in data exfiltration away from custom malware and command-and-control infrastructure toward legitimate, allow-listed tools already in enterprise environments, including cloud command-line interfaces, file synchronization utilities, managed file transfer platforms, and legitimate cloud storage services. The research catalogs these tools in an Exfiltration Framework organized by exfiltration tactic across endpoint, network, and cloud telemetry, and notes that transfers commonly use HTTPS on expected ports with encrypted payloads, as seen in ransomware and extortion investigations involving tools such as rclone and Syncthing.

What's compelling: Network flow detection built on protocol identification, destination allow-listing, or port filtering offers limited visibility when an attacker's upload to an external bucket looks like routine backup traffic, and cloud service endpoints are shared infrastructure that cannot be blocked without operational disruption.

Read the original at Cisco Talos ↗

Topics
Malware
Related