Red Canary has observed Mega.io used as an exfiltration destination in multiple incident response engagements this year. And even when adversaries exfiltrate your data to seemingly normal cloud storage providers, they often do so with unusual file transfer utilities. Luckily for us though, they very frequently use cloud storage services that aren’t normal in enterprise environments. Detection can be a particular challenge when adversaries choose to use services that are common in enterprise environments, like Google Drive or Amazon S3.

With the growing number of data backup solutions, it can be hard to decipher where ransomware operators might choose to store their newly stolen data. Since we’re publishing this on Star Wars Day, we’d like to take you on an epic detection adventure. This post offers some detection strategies that security teams can employ to detect malicious file transfer activity.

While piling extortion on top of ransomware is an effective way of increasing leverage, it also adds conspicuous opportunities for detection in the form of illicit file transfer activity.

In fact, the extortion side of these schemes is proving so effective that one prominent ransomware group recently announced that it would stop encrypting files and focus entirely on extortion moving forward. However, as organizations have gotten better about data backup and recovery practices-by implementing policies like the “ 3-2-1 rule,” for example-ransomware operators find themselves having to apply more and different kinds of leverage.Ī so-called “ double extortion” scheme, where an adversary encrypts files and threatens to leak stolen data, is one prominent example of this. Ransomware has always been about leverage, and sometimes, just encrypting files is enough to get a payment.

How to recover megasync password