NetWalker
Summary
NetWalker is a ransomware strain known for targeting organizations by encrypting files and demanding ransom payments in exchange for decryption keys. It emerged in 2019 and has been used in multiple high-profile attacks, often delivered through phishing campaigns, Remote Desktop Protocol (RDP) brute force attacks, or exploiting vulnerabilities in public-facing applications. NetWalker operators have also engaged in double extortion tactics, threatening to leak stolen data if the ransom is not paid.
Key Characteristics
- Ransomware-as-a-Service (RaaS) model enabling affiliates to distribute the malware.
- Encryption of a wide range of file types using strong cryptographic algorithms.
- Use of double extortion by exfiltrating sensitive data before encryption.
- Delivery methods include phishing emails, RDP brute force, and exploitation of software vulnerabilities.
- Ransom notes typically include instructions for payment in Bitcoin and warnings about data leaks.
- Targets primarily include healthcare, government, education, and corporate sectors.
Defensive Controls
- Implement multi-factor authentication (MFA) to secure remote access points such as RDP.
- Regularly update and patch software to mitigate vulnerabilities.
- Conduct user training to recognize phishing attempts and suspicious attachments.
- Maintain offline and encrypted backups to enable recovery without paying ransom.
- Deploy endpoint detection and response (EDR) solutions to identify and block ransomware activity.
- Restrict unnecessary network access and monitor for unusual data exfiltration.
Related Security Solutions
Security solutions relevant to defending against NetWalker include advanced email filtering systems, endpoint protection platforms with ransomware detection capabilities, network intrusion detection systems (NIDS), vulnerability management tools, and secure backup solutions. Additionally, Security Information and Event Management (SIEM) systems can assist in correlating and analyzing suspicious activities related to ransomware attacks.