Register for our upcoming webinar about corporate security! Cyber Meets Physical Security: Threat Assessment for Corporate Security with Prescient on Wednesday, April 03, 2024 at 17:30 CET. Register now! close
28 Apr 2021

Investigate NetWalker Ransomware Attack through Malware Intelligence and Crypto Due Diligence Using CipherTrace and Maltego

Maltego Team

In recent years, law enforcement agencies and financial institutions globally have struggled to not only regulate the use of virtual currency but also to develop the right tools to manage risk in this dynamic and evolving industry.

By using the NetWalker RaaS case as an example, this case study demonstrates how cyber analysts can use Maltego and CipherTrace cryptocurrency intelligence to analyze, identify, and respond to ransomware attacks. Additionally, it will illustrate how cyber security researchers can enrich threat data in Maltego with its various threat intelligence integrations at early stages of an attack.

About NetWalker Ransomware đź”—︎

Ransomware as a Service (RaaS) is a subscription-based business model that enables affiliates to purchase or rent ransomware tools from ransomware developers and perform attacks. Funds extorted from victims are then shared between the ransomware providers and affiliates. According to the prediction of Cybersecurity Ventures, ransomware damages will reach 20 billion USD by 2021.

Created by the cybercriminal group “Circus Spider”, the NetWalker ransomware started gaining traction among affiliates in March 2020 and earned 25 million USD in just five months. The attacks usually target institutions in healthcare and education as well as governmental organizations and private companies.




About CipherTrace Cryptocurrency Intelligence đź”—︎

CipherTrace provides powerful and easy-to-use cryptocurrency intelligence for tracing Bitcoin, Ethereum, Bitcoin Cash and Litecoin currencies. The CipherTrace integration in Maltego enable investigators to de-anonymize transactions and obtain evidence on individuals who use complex cryptocurrency transactions to launder money, finance terrorism, or carry out drug dealing, extortion, and other crimes.

Access to CipherTrace Data in Maltego đź”—︎

You can access CipherTrace data in Maltego by purchasing a flexible data subscription or brining your own API key. For more information about accessing CipherTrace data in Maltego, please visit our Transform Hub detail page here.

Case Study | How to Evaluate Malware Threats and Identify Affiliates Amidst A Ransomware Attack đź”—︎

Your organization finds itself under a sudden ransomware attack. With no existing attribution data about the ransomware, your SOC team must identify the seriousness of the threat and the malicious actors demanding the ransom.

The compromised machines receive a ransom letter like the one above, warning them about the risk of shutting down their laptops and demanding a payment in exchange for safe decryption of the compromised files. In the ransom note, the malicious actors included two email addresses as a means of contact.

The investigation will focus on the following two aspects of threat intelligence and the findings will help your team assess the necessary measures to solve the crisis:

Part 1: Gathering Malware Intelligence for Incident Analysis đź”—︎

Upon first encounter with the malware, cyber analysts must gain an understanding of the severity of the attack by looking at public reports and find ways to mitigate it by gathering observables and identifying IOCs and attack vectors.

In Part 1 of the case study, we will demonstrate how SOC teams and threat intelligence analysts can quickly evaluate the threat level, understand the malware history, and mitigate risks using Recorded Future and VirusTotal, and IPQS Transforms.

Part 2: Conducting Cryptocurrency Due Diligence in the Event of A Ransomware Attack đź”—︎

Blockchain analysis—since cryptocurrency has become more commonly used by malicious actors—is vital to determine the entities associated with counterparty cryptocurrency addresses, thus avoiding being subject to liabilities and hefty financial penalties under federal law when deciding to pay up a ransom.

In Part 2 of the case study, we will show how investigators can identify the destination of the cryptocurrency ransom and analyze transactions relevant to a ransomware campaign through cryptocurrency due diligence using CipherTrace Bitcoin intelligence.

Investigating NetWalker ransomware using CipherTrace cryptocurrency intelligence

Download and Read the Case Study Now! đź”—︎

Download and read this case study now to deep dive into cryptocurrency intelligence and investigations with CipherTrace and Maltego!

You can also watch our joint webinar with CipherTrace for a video demo of the case study and to learn more about CipherTrace Transforms in Maltego.

Don’t forget to follow us on Twitter and LinkedIn or subscribe to our email newsletter for more whitepapers, case studies, and SOC tips like this!

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.