Case study – Dharma

In recent years, ransomware has been very popular, and frequently offered as a service. Among these actors, there have been relatively low-skilled threat actors utilizing a ransomware suite named Dharma, as well as variants thereof:

Figure 3.12 – The Dharma ransom note

In this case study, we'll walk through some of the techniques and tools utilized by the threat actor.

In the vast majority of Dharma cases, the initial vector has been to brute-force weak RDP credentials via a freely available tool called NLBrute. In scenarios such as this, hundreds of passwords and usernames would be tried until a successful RDP session was created.

After gaining access via the remote desktop protocol, hackers would often utilize Advanced IP Scanner to ascertain what other hosts on the network could be infected, and dump passwords from the system or attempt to use the cracked RDP password to authenticate elsewhere.

Once a...