Impact

With that, we have reached the last stage of the attack. As mentioned in Chapter 1, the goals differ depending on the attacker. Low-maturity actors perform resource hijacking to mine cryptocurrency, ransomware actors seek data encryption for impact, some APTs prefer to destroy the data, inhibit system recovery, and cause a denial of service attack, and financially-motivated groups will attempt to transfer funds.

Resource hijacking is not limited to cryptocurrency mining. We have seen cases when intruders deployed the masscan tool to run account brute-force attacks on other public-facing servers with a published RDP by using a predefined credential dictionary. Financially motivated groups may also send thousands of emails to other victims to gain trust. We remember a campaign called Wave where the attacker successfully compromised an organization. They offered accounting services to others, then sent a malicious email to 100+ organizations threatening them with non-payment...