oddbjorn/ransomware

Curated list of enterprise ransomware defense resources

Enterprise Ransomware Resources

The focus of these resources is more on building resilience against the systemic threat of ransomware from an enterprise perspective. Last updated 2022-02-18. Feel free to send pull requests or tips to me.

Guidance

• ransomware.org:
  • Solid material on what ransomware is, how it works, how to prevent it and how to remove it
  • Ransomware Fundamentals videos and webinars
  • The Ransomware - Understand. Prevent. Recover. book by Allen Liska (2021)
• FS-ISAC: Ransomware Essentials
• Joint CISA/NCSC-UK/ACSC: AA22-040A: 2021 Trends Show Increased Globalized Threat of Ransomware (2022-02)
• Cybersecurity & Infrastructure Security Agency (CISA):
  • StopRansomware
  • Cyber Security Evaluation Tool (CSET) with a Ransomware Readiness Assessment (RRA) module
  • MS-ISAC Ransomware Guide + Ransomware Response Checklist(2020-09)
  • AA20-302A: Ransomware Activity Targeting the Healthcare and Public Health Sector
  • AA20-049A: Ransomware Impacting Pipeline Operations
  • Tabletop Exercise Packages (CTEPs), including ransomware
• FBI Internet Crime Complaint Center (IC3):
  • CISA-FBI Guidance for MSPs and their Customers Affected by the Kaseya VSA Supply-Chain Ransomware Attack
• Australian Cyber Security Centre (ACSC):
  • Ransomware {Emergency Response One-Pager, Prevention and Protection Guide, Action Checklist, Emergency Response Guide} (not really aimed at the enterprise level)
• NCSC-UK:
  • Mitigating malware and ransomware attacks (2021-09)
  • Ransomware: What board members should know and what they should be asking their technical experts (2021-06)
• NCSC-NZ: Protecting from ransomware, incl. lifecycle of a ransomware incident flowchart (2021)
• Canadian Centre for Cyber Security:
  • ITSAP.00.099: How to prevent and recover from ransomware (2021-09) + Ransomware playbook (2021-11)
• Institute for Security + Technology: Ransomware Task Force (RTF): Combating Ransomware (2021-09)
• European Union Agency for Cybersecurity (ENISA):
  • ENISA Threat Landscape 2021 (2021-10)

• Information Security Forum (ISF): Extinction Level Attacks: A Survival Guide (2020-11), Understanding the Ransomware Menace (2021)
• VirusTotal: Ransomware in a Global Context (2021-10)

• National Institute of Science and Technology (NIST):
  • Computer Security Resource Center (CSRC):
    • Getting Started with Cybersecurity Risk Management: Ransomware (2022-02)
    • IR 8374: Ransomware Risk Management: A Cybersecurity Framework Profile (2022-02)
    • Ransomware Protection and Response
    • Securing Data Integrity Against Ransomware Attacks: Using the NIST Cybersecurity Framework and NIST Cybersecurity Practice Guides
    • SP 1800-11: Data Integrity: Recovering from Ransomware and Other Destructive Events (2020-09)
    • SP 1800-25: Identifying and Protecting Assets Against Ransomware and Other Destructive Events (2020-12)
    • SP 1800-26: Detecting and Responding to Ransomware and Other Destructive Events (2020-12)
    • SP 800-184: Guide for Cybersecurity Event Recovery (2016-12)
  • National Cybersecurity Center of Excellence (NCCoE):
    • Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events 
  • Microsoft:
    • Ransomware and Extortion (2022-02-19)
    • Backup and restore plan to protect against ransomware (2022-02-19)
    • DART ransomware approach and best practices (2022-02-19)
    • Azure Defenses for Ransomware Attack (2021-09-10)

Incident Reports

• PWC incident report on the Conti attack against the Irish Health Security Executive (2021-12) + lessons learned by HHS.gov (2022-02)
• KPMG incident report on the attack against Østre Toten municipality in January 2021 (2021-10)

Selected Papers

• The Transnational Cybercrime Extortion Landscape and the Pandemic: Changes in Ransomware Offender Tactics, Attack Scalability and the Organisation of Offending - David S. Wall, European Law Enforcement Research Bulletin (2021)

Insurance

• Lloyds:
  • Guidance for Handling a Ransomware Incident (2021-12)
  • Y5359: Guidance for Handling a Ransomware Claim Incident (2021-12)

Storage Management, incl. and Backup/Restore

• NIST: SP 800-209: Security Guidelines for Storage Infrastructure (2020-10)

Threat Actors and TTPs:

• CISA: BlackMatter, Conti, Conti #2, Conti #3, Darkside, SamSam, Petya
• FBI: Diavol (2022-01), BlackByte (2022-02), Cuba (2021-12), HelloKitty + BlackMatter (2021-10), Hive (2021-08), Darkside (2021-05)
• ACSC: Conti (2021-12), LockBit 2.0 (2021-08)
• Joe DiMaggio: The History of REvil (2022-01-27)
• CERT-FR: CERTFR-2021-CTI-006: Ryuk (2021-02), CERTFR-2021-CTI-007: Egregor (2021-03)
• The DFIR Report (multiple excellent blog posts)
• Conti Ransomware Playbook leak
• Conti February 2022 Leak + Procedures

Miscellaneous

• Ransomware Overview - By @nyxbone and @cyb3rops
• Ransomware Reports

• Curated Intelligence: Initial Access Broker Landscape
• Simulators: Ransim, QuickBuck
• Emsisoft/Fabian Wosar: Decryption tools, faster decryption, various guidance and commercial tooling
• Andy Robbins of SpecterOps: BloodHound versus Ransomware: A Defender’s Guide (2021-06-08)
• Amazon AWS:
  • Ransomware mitigation: Top 5 protections and recovery preparation actions (2021-09)
  • Ransomware Risk Management on AWS Using the NIST Cyber Security Framework (CSF) whitepaper (2021-09)
  • Securing your AWS environments from ransomware (2020-04)

Selected Nordic Ransomware Incidents

Material on Defendable Enterprises split out into separate list available here.