# data[].attributes.body
The attacker ultimately succeeded in achieving an MFA push acceptance, granting them access to VPN in the context of the targeted user.”

The report adds that once the attacker obtained initial access, they enrolled a series of new devices for MFA and authenticated successfully to the Cisco VPN.

# data[].attributes.body
After the attackers were booted off, the attackers tried to manipulate the company executives by trying to establish email communications at least three times to urge them to pay so that no one will know about the incident and information leakage. The email also included a screenshot of the directory listing of the exfiltrated Box folder

# data[].attributes.body
Got hold of an employee's personal Google account that contained passwords synced from their web browser

# data[].attributes.body
Step 1: Reconnaissance
Look for organizations with critical assets that are more likely to pay, a technique the security industry calls "big game hunting".

Step 2: Weaponisation
Ryuk uses Trickbot computer malware to install itself, once access is gained to a network's servers. It has the capability to defeat many anti-malware countermeasures that may be present and can completely disable a computer network. It can even seek out and disable backup files if kept on shared servers.

Step 3: Delivery
Created phishing campaigns that contain either links to malicious websites that host the malware or attachments with the malware.

Step 4: Exploitation
The phishing email would have contained Emotet, a piece of trojan. Emotet would have installed Trickbot, which then enabled the hacker group, WIZARD SPIDER, to manually install Ryuk through a reverse shell.

Step 5: Installation
Loaders start the infection chain by distributing the payload; they deploy and execute the backdoor from the command and control server and install it on the victim’s machine.

Step 6: C2
At that point, the encryption can occur. Ryuk encrypts files such as photos, videos, databases, and documents – all the data you care about – using AES-256 encryption. The symmetric encryption keys are then encrypted using asymmetric RSA-4096.

Step 7: Action on Objectives
The hackers leave ransom notes in the system as RyukReadMe.txt, demanding a ransom

# data[].attributes.body
WannaCry - Self-spreading ransomware
Exploitation of one of Microsoft's protocols led to creation of EternalBlue, one of the tools used to gain access to remote computers.
DoublePulsar, a backdoor tool used for installation and execution of programs.
This exploit was patched within a month of discovery, but many users across the globe did not install the patch.
A combination of these tools allowed the creation of WannaCry, which spread across the world.
User's computers data was encrypted by WannaCry, spreading with the use of EternalBlue, and installation using DoublePulsar.

When WannaCry is executed, it checks for a fixed domain name, if this domain name is not found, it will encrypt the computer data.

A computer researcher reverse-engineered the malware code and found this vulnerability, and registered the domain name. This caused WannaCry to stop any further executions, effectively acting as a kill switch.

# data[].attributes.body
Payload of malicious code is injected into vulnerable systems through port 445, using SMB file-sharing through EternalBlue

# data[].attributes.headline
command and control (C2) & actions on objectives

# data[].attributes.subject
command and control (C2) & actions on objectives

# data[].attributes.body
-Got access to system files and deleted existing shadow copy folders to prevent the user from retrieving information.
-It do not allow booting in system recovery mode, and hides the recycle bin.
-It kills processes that have open databases to guarantee access to the encryption of such databases (mysql, sqlserver, and exchange)
-Proceeds to encrypt the files and directories of the system using an AES algorithm, which can only be decrypted if the private RSA key is available.
-when the file encryption finishes, it shows a dialog to the user requesting the ransom.

# data[].attributes.body
After gaining domain admin, they used enumeration tools like ntdsutil, adfind, and secretsdump to collect more information and installed a series of payloads onto compromised systems, including a backdoor malware.

"After obtaining initial access, the threat actor conducted a variety of activities to maintain access, minimize forensic artifacts, and increase their level of access to systems within the environment," Cisco Talos added.

Weaponisation

# data[].attributes.body
Artifacts such as injection code for SMB process & kill-switch mechanism were created

# data[].attributes.body
It copies itself to those vulnerable endpoints by exploiting a variant of the DoublePulsar payload. The process starts again on every infected computer. The capacity of the propagation within the network is enormous.

# data[].attributes.body
Exploits the vulnerability with EternalBlue. It injects code into the SMB system process and becomes persistent by creating an entry in the windows registry.

# data[].attributes.body
Organizations with open port 445 endpoints were searched for, exploitable with EternalBlue.

# data[].attributes.body
Once they gained a foothold on the company's corporate network, Yanluowang operators spread laterally to Citrix servers and domain controllers.

# data[].attributes.body
The attacker convinced the Cisco employee to accept multi-factor authentication (MFA) push notifications through MFA fatigue and a series of sophisticated voice phishing attacks initiated by the Yanluowang gang that impersonated trusted support organizations.

Under cyber kill chain, it can be classified as credential access

# data[].attributes.body
Singhealth disconnected factor systems and others permenantly. It also made use of more secure information exchange gateways and hired independent operatives tk review the health records before submission.

The IHS has since strengthened public health systems against data breaches. All suspicious occurences are to be reported within 24 hours. Other measures include 2 factor authentication, proactive threat hunting and ensuring all machines have the most updated security updates.

Two employees were dismissed for negligence and misinterpretation of the threat respectively and financial penalties were imposed on the related supervisors and managers.

Cybersecurity company Symantec identified a state-sponsored group called Whitefly but its benefactor has yet to be found.

# data[].attributes.body
Personal particulars of 1.5M singhealth patients, including PM Lee's, as well as 160k records of outpatient dispensed medicines were obtained by the perpetrators. Details included names, NRIC, addresses and other personal information. The data stolen spanned entries from 1 May 2015 to 4 July 2018. PM Lee's information was specifically targeted.

CYBER KILL CHAIN
Reconaissance: obtained login credentials
Weaponization: customized malware used
Delivery: through front end workstation
Exploitation: malware modified to target singhealth cybersecurity weaknesses
Installation: on front end workstation i guess, into IT network
Command and Control: database accessed
Actions on objectives: personal particulars obtained

# data[].attributes.body
step 1: reconnaissance
Hackers went on the dark web to acquire passwords
step 2: weaponisation
hackers logged into the VPN account using acquired passwords
step 3 : delivery
hackers found where to login using their new found credentials

step 4 : exploitation
the website did not have 2FA and the employees did not disable the accounts properly
step 5 : installation
hackers installed ransomware
step 6 :command and control
hackers controlled the supply of oil, causing many drivers to be stranded and effectively resulting in the standstill of society.
step 7 actions and objectives
they received 4 million usd in ransom