Osiris Ransomware: New BYOVD Attack Disables Security Software

The Rise of ‘Bring Your Own Vulnerable Driver’ and the Future of Ransomware

The recent emergence of the Osiris ransomware, leveraging the “Bring Your Own Vulnerable Driver” (BYOVD) technique, isn’t an isolated incident. It’s a stark indicator of a rapidly evolving threat landscape where attackers are becoming increasingly sophisticated in bypassing traditional security measures. Osiris, first detected in November 2023 targeting a Southeast Asian food service provider, highlights a dangerous trend: the weaponization of trusted system components.

Understanding BYOVD: A New Level of Stealth

BYOVD flips the script on traditional malware detection. Instead of introducing entirely new malicious code, attackers exploit legitimate, signed drivers with known vulnerabilities. The POORTRY driver used in the Osiris attack, previously linked to the Medusa ransomware, exemplifies this. This tactic allows attackers to operate with higher privileges – kernel-level access – effectively disabling Endpoint Detection and Response (EDR) solutions and other security software. It’s a stealthier approach, making detection significantly harder.

Think of it like this: instead of trying to break down a castle gate, attackers are finding a secret passage built by the castle’s own architects. This is why BYOVD is proving so effective. According to a recent report by Sophos, attacks leveraging driver vulnerabilities increased by 47% in the last quarter of 2023.

The INC-Ransomware Connection and Advanced Tactics

Attribution is always challenging, but researchers at Symantec and Carbon Black have identified links between Osiris and the INC-Ransomware group. Shared tactics, such as the use of a specific Mimikatz version for credential dumping and data exfiltration to Wasabi cloud storage, point to a potential connection. This suggests a level of collaboration or shared tooling within the cybercriminal ecosystem.

Beyond the BYOVD technique, Osiris demonstrates a high degree of operational security. The attackers heavily relied on “Living-off-the-Land” (LOLBin) binaries – legitimate system tools repurposed for malicious activities. Netscan for network reconnaissance and a customized version of Rustdesk for remote access allowed them to remain undetected for extended periods. This is a hallmark of advanced persistent threat (APT) groups, indicating a well-resourced and skilled adversary.

Hybrid Encryption and Targeted Disruption: Maximizing Impact

Osiris isn’t just about stealth; it’s about maximizing impact. The ransomware employs a hybrid encryption scheme, making decryption without the attacker’s key virtually impossible. Furthermore, it’s highly configurable, allowing attackers to selectively encrypt specific file types and paths while avoiding critical system files – a tactic designed to prevent complete system failure and increase the likelihood of ransom payment.

Before encryption, Osiris systematically disables services that could hinder its operation, including databases (SQL, Microsoft Exchange), backup solutions (Volume Shadow Copy Service, Veeam), and other essential components. This proactive disruption ensures that victims have limited recovery options, increasing pressure to pay the ransom. A recent study by Coveware found that ransomware attacks targeting backup infrastructure increased by 30% in 2023.

Future Trends: What to Expect in the Ransomware Arms Race

The Proliferation of BYOVD

Osiris is unlikely to be the last ransomware to utilize BYOVD. Groups like Akira, BlackByte, and Kasseika are already adopting this technique. The challenge for security vendors is to move beyond signature-based detection and focus on behavioral analysis – identifying malicious activity even when legitimate tools are being abused. Expect to see increased investment in driver integrity monitoring and anomaly detection systems.

Increased Sophistication of LOLBin Usage

LOLBins will continue to be a favorite tactic for attackers. They offer a low-noise, high-reward approach to evading detection. Future attacks will likely involve more sophisticated manipulation of LOLBins, potentially combining them with custom-developed tools to create highly targeted and evasive malware. Organizations need to implement robust application control policies and continuously monitor system activity for unusual behavior.

AI-Powered Ransomware: A Looming Threat

Artificial intelligence (AI) is a double-edged sword. While security vendors are leveraging AI to improve threat detection, attackers are also exploring its potential. We can anticipate AI-powered ransomware that can automatically identify valuable targets, adapt to security defenses, and even generate personalized ransom notes. A report by IBM Security predicts a 300% increase in AI-powered cyberattacks in the next year.

Ransomware-as-a-Service (RaaS) Evolution

The RaaS model will continue to dominate the ransomware landscape, lowering the barrier to entry for aspiring cybercriminals. Expect to see more specialized RaaS offerings, with different groups focusing on specific niches – such as targeting healthcare or critical infrastructure. This will lead to a more fragmented and diverse threat landscape, making it harder to track and disrupt ransomware operations.

The Rise of Data Leak Sites and Extortion Tactics

Double extortion – stealing data before encryption and threatening to leak it publicly – is already commonplace. However, attackers are becoming more creative with their extortion tactics. We may see more attacks that target sensitive personal data, such as medical records or financial information, with the threat of identity theft or financial fraud. Data leak sites will continue to be a major source of pressure for victims to pay the ransom.

Protecting Your Organization: A Defense-in-Depth Approach

The evolving ransomware threat demands a proactive and layered security strategy. Here are some key steps organizations can take:

• Implement Strict Application Control: Prevent unauthorized drivers and applications from running on your systems.
• Continuous Vulnerability Management: Regularly scan for and patch vulnerabilities in your software and hardware.
• Robust Endpoint Detection and Response (EDR): Invest in EDR solutions that can detect and respond to advanced threats, including BYOVD attacks.
• Regular Data Backups: Maintain offline, immutable backups of your critical data.
• Employee Security Awareness Training: Educate your employees about phishing, social engineering, and other common attack vectors.
• Privileged Access Management (PAM): Limit access to sensitive systems and data to only those who need it.

Did you know? 83% of organizations experienced a ransomware attack in 2023, according to a recent report by Cybersecurity Ventures.

Pro Tip: Regularly test your incident response plan to ensure that you can effectively respond to a ransomware attack.

FAQ: Ransomware and BYOVD

Q: What is BYOVD?
A: Bring Your Own Vulnerable Driver. It’s a technique where attackers use legitimate, but vulnerable, drivers to gain privileged access to systems and bypass security measures.

Q: Is my EDR solution enough to protect me from BYOVD?
A: Traditional EDR solutions may not be sufficient. You need EDR solutions with advanced behavioral analysis capabilities and driver integrity monitoring.

Q: What can I do to prevent ransomware attacks?
A: Implement a defense-in-depth strategy, including application control, vulnerability management, EDR, regular backups, and employee training.

Q: How can I stay informed about the latest ransomware threats?
A: Follow reputable cybersecurity blogs, news sources, and threat intelligence feeds.

The fight against ransomware is an ongoing battle. By understanding the evolving tactics of attackers and implementing a robust security strategy, organizations can significantly reduce their risk and protect their valuable assets.

Want to learn more about strengthening your cybersecurity posture? Download our free Cyber Security Report today!