Global Ransomware ATT&CK Techniques Matrix Reveals Industrial-Scale Cyber Intrusion Patterns

Ringkasan

Analisis ini memetakan MITRE ATT&CK® techniques terhadap ekosistem ransomware global yang terdiri dari puluhan kelompok aktif.

Model operasional yang terlihat bersifat:

multi-stage intrusion
credential-driven compromise
lateral movement berbasis domain
data exfiltration + encryption

Kelompok yang tercakup:

LockBit
ALPHV / BlackCat
Black Basta
Cl0p
Conti
REvil
Hive
RansomHub
Qilin
Medusa / MedusaLocker
Rhysida
Royal
DarkSide
BlackMatter
Akira
BianLian
Hunters International
BlackLock
IncRansom
BlackForge
Prinz Eugen (ransomware generasi baru)
“Gentlemen Ransomware” (EDR-disabling variant)

ATT&CK Execution Layer

T1047  Windows Management Instrumentation (WMI)
T1059  Command and Scripting Interpreter
T1059.001 PowerShell
T1059.003 Windows Command Shell
T1059.006 Python
T1106  Native API Execution
T1569  System Services Execution

Persistence Techniques

T1053 Scheduled Tasks / Cron Jobs
T1547 Registry Run Keys / Startup Folder
T1543 System Services
T1547.001 Boot / Logon Autostart Execution

Credential Access Layer

T1003.001 LSASS Memory Dumping
T1003.003 NTDS.dit Extraction
T1555 Credential Dumping (Passwords / Stores)
T1552 Unsecured Credentials Exposure
T1110 Brute Force

Lateral Movement

T1021.001 RDP
T1021.002 SMB / Admin Shares
T1021.004 SSH Remote Services
T1133 External Remote Services

Defense Evasion Techniques

T1027 Obfuscation / Encoding
T1027.002 Software Packing
T1070 Indicator Removal
T1070.001 Event Log Clearing
T1070.004 File Deletion
T1036 Masquerading
T1027.007 Dynamic API Resolution

Discovery Phase

T1083 File and Directory Discovery
T1018 Remote System Discovery
T1046 Network Service Scanning
T1016 System Network Configuration Discovery
T1069 Permission Group Discovery
T1007 System Service Discovery

Impact Layer

T1486 Data Encrypted for Impact
T1485 Data Destruction
T1490 Inhibit System Recovery
T1561 Disk Wipe
T1489 Service Stop

Analisis Operasional

Pola serangan menunjukkan struktur berikut:

Initial access via credential compromise / phishing / firewall credential theft (FortiBleed)
Execution menggunakan LOLBins (PowerShell, WMI)
Persistence melalui registry & scheduled tasks
Privilege escalation via token abuse
Domain-wide credential harvesting
Lateral movement via RDP/SMB
Data staging & exfiltration
EDR/AV disabling (tren baru: “Gentlemen Ransomware”, Prinz Eugen)
Encryption / destruction

Evolusi Initial Access: FortiBleed Case Study

Juli 2026 mencatat pergeseran signifikan dalam vektor initial access ransomware. Kampanye FortiBleed membuktikan bahwa firewall — yang seharusnya menjadi pertahanan pertama — bisa menjadi titik masuk utama:

# FortiBleed → Ransomware Attack Chain
[FortiBleed] Kredensial admin FortiGate dicuri
     ↓
[Access Broker] Kredensial dijual di dark web
     ↓
[Ransomware Affiliate] Membeli akses, masuk ke network internal
     ↓
[Reconnaissance] AD mapping, privilege escalation
     ↓
[Execution] Deploy ransomware + data exfiltration

Evolusi Defense Evasion: EDR-Disabling Ransomware

Grup ransomware terbaru seperti “Gentlemen Ransomware” dan Prinz Eugen mengadopsi taktik agresif:

Menonaktifkan EDR/XDR sebelum enkripsi dimulai
Memprioritaskan enkripsi file bisnis-kritis yang baru dimodifikasi (Prinz Eugen)
Menggunakan kernel-level techniques untuk bypass user-mode detection

Risiko Utama

Domain compromise
Full AD takeover
Data exfiltration sebelum encryption
Backup destruction
Operational shutdown

Status Matriks

Hingga analisis ini disusun (diperbarui Juli 2026):

[+] Coverage Scope     : 50+ Threat Groups
[+] Technique Mapping  : Full MITRE ATT&CK Lifecycle
[+] Execution Model    : Validated Across Ransomware Families
[+] New Entry Vectors  : FortiBleed credential theft, FortiOS SSRF
[+] New Evasion Tactics: EDR-disabling pre-encryption, kernel-level bypass
[+] Threat Level       : High / Critical

Rekomendasi Keamanan

[+] Enable MFA (Privileged Accounts)
[+] Monitor LSASS Access Attempts
[+] Harden RDP / Disable Exposure
[+] Segment Active Directory
[+] Deploy EDR Behavioral Detection
[+] Centralized Logging (SIEM)
[+] Immutable Backup Strategy

Catatan

Artikel ini disusun untuk analisis threat intelligence berdasarkan pemetaan MITRE ATT&CK terhadap ekosistem ransomware global. Seluruh data bersifat agregasi teknik, bukan atribusi insiden spesifik.