DHS/CISA Ransomware Targeting Healthcare October 2020

Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.

Wizard Spider has used Window Remote Management to move laterally through a victim network.

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.

Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.

Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.

Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.

Wizard Spider has used the “net view” command to locate mapped network shares.

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.

Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.

Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.