The gist of it is gathering credentials from the initialy compromised machines, and using them to access other computers on the network. A lot of this is possible because of the way Windows handles authentication between computers. Mimikatz is a tool that really made this method of lateral movement much easier for attackers, and Microsoft has been slow to adapt defences. Over time the attackers will eventually gather some admin credentials, and then it is really game over.

It is hard to defend against, unless you want a system that constantly prompts you for your password everytime you want to do something. Frequent password prompts is not really good for security either. Current mitigations really just slow down the attacks and gives you time to respond. If they are left alone they will manage to gather credentials over time.

https://github.com/gentilkiwi/mimikatz https://www.sans.org/reading-room/whitepapers/detection/mimi...

The "mimikatz" problem (aka memory protections on the lsass.exe process) has basically been solved by Microsoft, they call it "Credential Guard". It works by doing some trusted boot stuff and using the hyper-v hypervisor to protect certain regions of memory from even the OS itself.

It's pretty complicated and requires server 2016 or windows 10. More info here - https://docs.microsoft.com/en-us/windows/security/identity-p...

@mox1: ‘The "mimikatz" problem (aka memory protections on the lsass.exe process) has basically been solved by Microsoft, they call it "Credential Guard". It works by doing some trusted boot stuff and using the hyper-v hypervisor to protect certain regions of memory from even the OS itself.’

How about running the OS in a Virtual Machine, that evaporates on exit and you get a new clean image on each invocation.

“All the King's horses and all the King's men couldn't put Humpty together again”

This talk tells you about how it works in very understandable way with examples.

https://www.youtube.com/watch?v=tTl5Rl8cKy8

"Gig05 Pen Test War Stories Why my job is so easy and how you can make it harder Aaron Herndon"

Some of them are probably fully automated, at least the process of the ransomware trying to grab any locally available credentials to touch as many servers as it can. These are probably the smaller dollar value attacks.

It sounds like this attack was by a more sophisticated group that compromised some initial system in that way, and then somebody actually went in to explore and determine how to spread the compromise around further. It seems to be difficult indeed even for large and sophisticated companies to defend against these types of attacks. Since somebody, or a team of people, has to do most of the compromising manually, they naturally demand higher ransoms.

> Isn't it should have root/admin privieleges to do such thing?

There are a lot of networks out there with fileshares configured far more permissively than they should be. Additionally, if the malware infects a machine that has cached domain admin credentials stored on it, it can use those to authenticate to the rest of the network and own the entire domain.

Yes, if best practice is followed, these tactics wouldn't work. Best practice is not always followed.

> "Isn't it should have root/admin privieleges to do such thing?"

Privilege escalation: https://www.fuzzysecurity.com/tutorials/16.html

You get a much bigger ransom for encrypting the list of customers who haven't paid yet, which is critical for the company to stay in business, than by encrypting the OS and software that could just be reinstalled. [1]

And if the company has everyone save their work on a shared network drive that lots of users have write access to, you don't even need to spread to other computers.

Plus of course, there are the classic means of spreading within a network - scan machines on the network for vulnerabilities, infect anything executable on shared drives, phishing e-mails that genuinely come from another employee's computer, keylog or brute force an admin password....

[1] https://xkcd.com/1200/