'Releasing the Hounds?' Disruption of the Ransomware Ecosystem
Through Offensive Cyber Operations

D 2022

'Releasing the Hounds?' Disruption of the Ransomware Ecosystem Through Offensive Cyber Operations

BÁTRLA, Michael a Jakub HARAŠTA

Základní údaje

Originální název

'Releasing the Hounds?' Disruption of the Ransomware Ecosystem Through Offensive Cyber Operations

Autoři

BÁTRLA, Michael (203 Česká republika, domácí) a Jakub HARAŠTA (203 Česká republika, garant, domácí)

Vydání

Tallinn, 2022 14th International Conference on Cyber Conflict: Keep Moving, od s. 93-115, 23 s. 2022

Nakladatel

NATO CCDCOE Publications

Další údaje

Jazyk

angličtina

Typ výsledku

Stať ve sborníku

Obor

50501 Law

Stát vydavatele

Estonsko

Utajení

není předmětem státního či obchodního tajemství

Forma vydání

tištěná verze "print"

Odkazy

Open access sborníku

Kód RIV

RIV/00216224:14220/22:00125964

Organizační jednotka

Právnická fakulta

ISBN

978-9916-9789-0-0

ISSN

DOI

http://dx.doi.org/10.23919/CyCon55549.2022.9811074

UT WoS

000853652000006

Klíčová slova anglicky

ransomware-as-a-service; cybercrime; offensive cyber operations; cyber incident; cryptocurrency

Štítky

rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 3. 4. 2023 10:02, Mgr. Petra Georgala

Anotace

V originále

Ransomware groups represent a significant cyber threat to Western states. Most high-end ransomware actors reside in territorial safe-haven jurisdictions and prove to be resistant to traditional law enforcement activities. This has prompted public sector and cybersecurity industry leaders to perceive ransomware as a national security threat requiring a whole-of-government approach, including cyber operations. In this paper, we investigate whether cyber operations or the threat of cyber operations influence the ransomware ecosystem. Subsequently, we assess the vectors of influence and characteristics of past operations that have disrupted the ecosystem. We describe the specifics of the ransomware-as-a-service system and provide three case studies (DarkSide/BlackMatter, REvil, Conti) highly representative of the current ecosystem and the effect cyber operations have on it. Additionally, we present initial observations about the influence of cyber operations on the system, including best practices from cyber operations against non-state groups. We conclude that even professional, highly skilled, and top-performing ransomware groups can be disrupted through cyber operations. In fact, cyber operations can even bypass some limits imposed on law enforcement operations. Even when ransomware groups rebrand or resurface after a hiatus, we suggest their infrastructure (both technical, human, and reputational) will still suffer mid- to long-term disruption. Although cyber operations are unlikely to be a silver bullet, they are an essential tool in the whole-of-government and multinational efforts and may even grow in importance in the next several years.

Návaznosti

EF16_019/0000822, projekt VaV

Název: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur

Přiložené soubory

Batrla-Harasta_text.pdf

Požádat o autorskou verzi souboru

Citovat

BÁTRLA, Michael a Jakub HARAŠTA. 'Releasing the Hounds?' Disruption of the Ransomware Ecosystem Through Offensive Cyber Operations. In T. Jančárková, G. Visky, I. Winther. 2022 14th International Conference on Cyber Conflict: Keep Moving. Tallinn: NATO CCDCOE Publications, 2022, s. 93-115. ISBN 978-9916-9789-0-0. Dostupné z: https://dx.doi.org/10.23919/CyCon55549.2022.9811074.

@inproceedings{1859026,
   author = {Bátrla, Michael and Harašta, Jakub},
   address = {Tallinn},
   booktitle = {2022 14th International Conference on Cyber Conflict: Keep Moving},
   doi = {http://dx.doi.org/10.23919/CyCon55549.2022.9811074},
   editor = {T. Jančárková, G. Visky, I. Winther},
   keywords = {ransomware-as-a-service; cybercrime; offensive cyber operations; cyber incident; cryptocurrency},
   howpublished = {tištěná verze "print"},
   language = {eng},
   location = {Tallinn},
   isbn = {978-9916-9789-0-0},
   pages = {93-115},
   publisher = {NATO CCDCOE Publications},
   title = {'Releasing the Hounds?' Disruption of the Ransomware Ecosystem Through Offensive Cyber Operations},
   url = {https://ccdcoe.org/uploads/2022/06/CyCon_2022_book.pdf},
   year = {2022}
}

TY  - JOUR
ID  - 1859026
AU  - Bátrla, Michael - Harašta, Jakub
PY  - 2022
TI  - 'Releasing the Hounds?' Disruption of the Ransomware Ecosystem Through Offensive Cyber Operations
PB  - NATO CCDCOE Publications
CY  - Tallinn
SN  - 9789916978900
KW  - ransomware-as-a-service
KW  - cybercrime
KW  - offensive cyber operations
KW  - cyber incident
KW  - cryptocurrency
UR  - https://ccdcoe.org/uploads/2022/06/CyCon_2022_book.pdf
N2  - Ransomware groups represent a significant cyber threat to Western states. Most high-end ransomware actors reside in territorial safe-haven jurisdictions and prove to be resistant to traditional law enforcement activities. This has prompted public sector and cybersecurity industry leaders to perceive ransomware as a national security threat requiring a whole-of-government approach, including cyber operations. In this paper, we investigate whether cyber operations or the threat of cyber operations influence the ransomware ecosystem. Subsequently, we assess the vectors of influence and characteristics of past operations that have disrupted the ecosystem. We describe the specifics of the ransomware-as-a-service system and provide three case studies (DarkSide/BlackMatter, REvil, Conti) highly representative of the current ecosystem and the effect cyber operations have on it. Additionally, we present initial observations about the influence of cyber operations on the system, including best practices from cyber operations against non-state groups. We conclude that even professional, highly skilled, and top-performing ransomware groups can be disrupted through cyber operations. In fact, cyber operations can even bypass some limits imposed on law enforcement operations. Even when ransomware groups rebrand or resurface after a hiatus, we suggest their infrastructure (both technical, human, and reputational) will still suffer mid- to long-term disruption. Although cyber operations are unlikely to be a silver bullet, they are an essential tool in the whole-of-government and multinational efforts and may even grow in importance in the next several years.
ER  -

BÁTRLA, Michael a Jakub HARAŠTA. 'Releasing the Hounds?' Disruption of the Ransomware Ecosystem Through Offensive Cyber Operations. In T. Jančárková, G. Visky, I. Winther. \textit{2022 14th International Conference on Cyber Conflict: Keep Moving}. Tallinn: NATO CCDCOE Publications, 2022, s.~93-115. ISBN~978-9916-9789-0-0. Dostupné z: https://dx.doi.org/10.23919/CyCon55549.2022.9811074.

Podrobný výpis o publikaci