Behind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
summary
Scans of live C2 and leak sites use deers/Deeprs, ffuf, Burp Suite, Tor Browser, sandboxes and DigitalOcean droplets to catch short-lived panels; results are thin but real: 3 of 150 panels compromised for ransomware versus 18 of 36 for other malware, one Rust C2 yields 197 commands in 2 minutes during a 4‑hour window. Findings include exposed Apache status, incremental message IDs (IDOR), WordPress admin access via default creds leading to RCE, private/onion keys and victim data, and disruption of four crypto-targeting campaigns.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:52What is ransomware
- 10:22Research goals and ethics
- 13:36Finding ransomware panels
- 16:59Malo ransomware gang
- 21:41BlackCat AlphaV ransomware
- 26:58Everest ransomware gang
- 32:46Black Angel ransomware
- 34:14Ethics and conclusions
related talks
35mCrimeware Chaos: Empirical Analysis of HTTP-Based Botnet C&C Panels
27mWhat Goes Around Comes Back Around - Exploiting Fundamental Weaknesses in Botnet C&C Panels!
42mStart Covering Your Bases And Stop Chasing APT Headlines
52mRansomware 101: Get Smart Understanding Real Attacks
37mThe 2024 Ransomware Threat Landscape: What's Fueling the Epidemic?
40mRansomware Threat Landscape
39mHow to think like a hacker
35mBreaking Endpoint Anti-Ransomware: Going... (Nishant Sharma, Vivek Ramachandran)