You have been redirected from paterva.com. Maltego.com is the new home for all information regarding Maltego products. Read more about this in a message from the Paterva team and in this blog post and FAQ. close
IMPORTANT: Please upgrade to the latest v4.2.17 of the Maltego Desktop Client by June 7, 2021, which includes important changes in preparation for updates to our Transform Hub planned for the coming month. Versions prior to v4.2.16 will not be compatible with the new Hub updates. For any questions or technical issues, please contact support@maltego.com. close

Investigate NetWalker Ransomware Attack through Malware Intelligence and Crypto Due Diligence Using CipherTrace and Maltego

In recent years, law enforcement agencies and financial institutions globally have struggled to not only regulate the use of virtual currency but also to develop the right tools to manage risk in this dynamic and evolving industry.

By using the NetWalker RaaS case as an example, this case study demonstrates how cyber analysts can use Maltego and CipherTrace cryptocurrency intelligence to analyze, identify, and respond to ransomware attacks. Additionally, it will illustrate how cyber security researchers can enrich threat data in Maltego with its various threat intelligence integrations at early stages of an attack.

About NetWalker Ransomware 🔗︎

Ransomware as a Service (RaaS) is a subscription-based business model that enables affiliates to purchase or rent ransomware tools from ransomware developers and perform attacks. Funds extorted from victims are then shared between the ransomware providers and affiliates. According to the prediction of Cybersecurity Ventures, ransomware damages will reach 20 billion USD by 2021.

Created by the cybercriminal group “Circus Spider”, the NetWalker ransomware started gaining traction among affiliates in March 2020 and earned 25 million USD in just five months. The attacks usually target institutions in healthcare and education as well as governmental organizations and private companies.




About CipherTrace Cryptocurrency Intelligence

CipherTrace provides powerful and easy-to-use cryptocurrency intelligence for tracing Bitcoin, Ethereum, Bitcoin Cash and Litecoin currencies. The CipherTrace integration in Maltego enable investigators to de-anonymize transactions and obtain evidence on individuals who use complex cryptocurrency transactions to launder money, finance terrorism, or carry out drug dealing, extortion, and other crimes.

Access to CipherTrace Data in Maltego

You can access CipherTrace data in Maltego by purchasing a flexible data bundle subscription or brining your own API key. For more information about accessing CipherTrace data in Maltego, please visit our Transform Hub detail page here .

Case Study | How to Evaluate Malware Threats and Identify Affiliates Amidst A Ransomware Attack 🔗︎

Your organization finds itself under a sudden ransomware attack. With no existing attribution data about the ransomware, your SOC team must identify the seriousness of the threat and the malicious actors demanding the ransom.

The compromised machines receive a ransom letter like the one above, warning them about the risk of shutting down their laptops and demanding a payment in exchange for safe decryption of the compromised files. In the ransom note, the malicious actors included two email addresses as a means of contact.

The investigation will focus on the following two aspects of threat intelligence and the findings will help your team assess the necessary measures to solve the crisis:

Part 1: Gathering Malware Intelligence for Incident Analysis 🔗︎

Upon first encounter with the malware, cyber analysts must gain an understanding of the severity of the attack by looking at public reports and find ways to mitigate it by gathering observables and identifying IOCs and attack vectors.

In Part 1 of the case study, we will demonstrate how SOC teams and threat intelligence analysts can quickly evaluate the threat level, understand the malware history, and mitigate risks using Recorded Future and VirusTotal , and IPQS Transforms.

Part 2: Conducting Cryptocurrency Due Diligence in the Event of A Ransomware Attack 🔗︎

Blockchain analysis—since cryptocurrency has become more commonly used by malicious actors—is vital to determine the entities associated with counterparty cryptocurrency addresses, thus avoiding being subject to liabilities and hefty financial penalties under federal law when deciding to pay up a ransom.

In Part 2 of the case study, we will show how investigators can identify the destination of the cryptocurrency ransom and analyze transactions relevant to a ransomware campaign through cryptocurrency due diligence using CipherTrace Bitcoin intelligence .

Investigating NetWalker ransomware using CipherTrace cryptocurrency intelligence

Download and Read the Case Study Now! 🔗︎

Download and read this case study now to deep dive into cryptocurrency intelligence and investigations with CipherTrace and Maltego!

You can also watch our joint webinar with CipherTrace for a video demo of the case study and to learn more about CipherTrace Transforms in Maltego.

Don’t forget to follow us on Twitter and LinkedIn or subscribe to our email newsletter for more whitepapers, case studies, and SOC tips like this!

Download the resource
By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.
Pick the right product and get started.