For businesses, the threat of ransomware is escalating rapidly. This is largely due to two distinct cybercriminal operations: 1) Ransomware as a Service (RaaS) groups who specialize in developing ransomware - and their symbiotic relationship with 2) Access as a Service (AaaS) groups who specialize in providing access to victim organizations.
In this talk we outline the modus operandi of one particular RaaS group we call Water Roc, that has been active since at least March 2020. Water Roc is notable in how it targets multi-billion-dollar organizations using ransomware, while trying to maximize payouts through the use of double-extortion. Not only does this group make computer networks unusable and files inaccessible, it also relentlessly releases stolen sensitive information on victims and continues to leak more data for many months after the initial compromise.

In this talk we outline the details of the techniques, tactics and procedures of Water Roc, which we have learned from research spanning more than a year and data obtained from several incident response cases. We will talk about ways the ransomware group gains initial access to a network, the lateral movement phase, data exfiltration of sensitive data, the launching of ransomware, and finally double extortion through the publishing of stolen sensitive data.

We will also compare the particular RaaS of Water Roc with a dozen other Ransomware-as-a-Service groups. Not all of the RaaS groups are organized to the same level as Water Roc. We will point out that several of these RaaS groups have weak points in their operational security that may lead to clues for researchers and law enforcement to take action against them. We also talk about how to utilize aspects of their known mode of operation for better protection and defence against their ransomware attacks.

Got a question about this presentation? To get in touch with the speakers, find Fernando on Discord under the nickname merces#8301 or contact the speakers on Twitter at @FeikeHacquebord, @mer0x36 and @ian_kenefick.