Emulating the RansomHub Affiliate Attack Chain

The Varonis Threat Research team recently published an in-depth investigation into a breach attributed to a RansomHub affiliate. The full article is available here: https://www.varonis.com/blog/varonis-prevents-ransomware-disaster

This case is particularly illuminating because it breaks down the intrusion into distinct phases of the Kill Chain, each of which contains observable technical indicators. In this incident, the attacker was only detected at a very late stage, when an anomalous spike in CPU usage was observed during large-scale data exfiltration activities. However, numerous earlier indicators were visible in the telemetry and should have enabled earlier detection.

This article describes how such behaviours can be reproduced using BlackNoise in order to evaluate and optimise defensive capabilities, validate SOC procedures, and train analysts to recognise early signs of a security breach.

This first stage involved several « automated reconnaissance and initial command-and-control activity, including enumerating Active Directory users and computers, querying key local system information, searching for credentials in memory, and various other discovery techniques.« 

These behaviours relate to various MITRE ATT&CK techniques from the Discovery a tactic for gaining knowledge about systems and the internal network. For example:

• T1087: Account Discovery
• T1069: Discovery of Permission Groups
• T1018: Remote System Discovery
• T1033: System Owner/User Discovery

The BlackNoise R&D provides granular events that simulate early-stage reconnaissance (accounts, groups, password policies, networks, services executed, remote sessions, security software installed, etc.) as well as some designed to test the Credential Access tactic with the T1003 - OS Credential Dumping technical, including an attempt to access LSASS memory.

The report also states that attackers « deployed a recurring Scheduled Task for persistence«. We provide an event to test that T1053 - Scheduled Task/Job technical issue when attempting to create a user.

Note: Three ready-to-use BlackNoise scenarios are available to focus on rapid testing of visibility, alerting logic and the quality of SOC triage in relation to early-stage attacker reconnaissance in this step: System discovery, Persistence, and MITRE CTID «Active Directory enumeration».

During the 2^nd step, the adversary began « searching for credentials and opportunities to escalate privileges within the customer’s network. This included scanning network shares for files containing credentials« .

We may refer to the T1046 - Network Service Discovery technical, by using some File Share Take the BlackNoise scan event, for example, and also Network Share Discovery event.

Furthermore, Varonis states that the attacker then attempts to « identify credentials stored in browsers » by using the « Data Protection API (DPAPI) to decrypt passwords stored in browsers from files« .

The BlackNoise event library includes events for testing the T1555 - Credentials from Password Stores: Credentials from Web Browsers a technique capable of targeting Chrome, Firefox and Edge. These events enable defenders to validate their detection logic against common infostealer workflows (DPAPI Master Key access, WebData file extraction, credential blob decryption patterns).

Note: To provide our customers with a simple way of testing them against these behaviours, we have developed a specific scenario called Theft of Local Credentials by Infostealer.

In the 3^rd In the report, Varonis states that the attacker attempts to « controlling a Domain Admin account«. This is a common target for attackers, as they wish to gain full access to the entire network by obtaining administrative privileges on this key component.”.

Here again, BlackNoise R&D has developed several scenarios to gain an overview of the domain configuration and to steal Active Directory credentials.

We might mention, for example, T1078 - Valid Accounts: Domain Accounts and T1558 - Steal or Forge Kerberos Tickets.

Note: Would you like to test your own detection system and procedure against such behaviours? Consider using Domain discovery and Domain Credential Theft scenarios for quick and efficient answers. These help to verify whether your detection pipeline correctly identifies abnormal Kerberos activity, the unauthorised movement of authentication artefacts, and the misuse of privileged accounts.

The report indicates that the threat actor then moved around the network to deploy « additional information and scripts for gathering credentials«. We have already addressed such behaviours during the previous stages through a number of Discovery events and scenarios.”.

The adversary finally chose to achieve « mass data exfiltration«. The report mentions the installation of the AzCopy utility to upload files to a Microsoft Azure Storage instance that is linked to the T1567 - Exfiltration via Web Service MITRE ATT&CK technique. We carry out multiple tests of this type of data exfiltration to cloud services such as Amazon S3, GitHub, Mega, Pixeldrain and others.

But we might also consider the T1048 - Exfiltration via an Alternative Protocol technique for testing the exfiltration of files using basic protocols such as DNS, HTTPS, SSH, etc.

Note: 14 selected events are included in the Data exfiltration via web services or alternative protocols BlackNoise scenario to test those actions at the end of the Kill Chain.

BlackNoise provides targeted scenarios that accurately replicate each phase observed in the RansomHub affiliate intrusion. By running these simulations, security teams can quickly assess the effectiveness of their defensive controls, from early-stage detection through to visibility of lateral movement and monitoring of data exfiltration. These tests reveal potential blind spots, missing correlation rules and configuration gaps that could allow an attacker to operate undetected.

As well as assessing specific technical controls, BlackNoise also provides a comprehensive Kill Chain simulation, based on these Varonis insights, which combines reconnaissance, credential theft, privilege escalation, lateral movement and data exfiltration. This scenario is called RansomHub Affiliate Attack Chain.

Importantly, these scenarios serve not only as a validation tool but also as a training platform for SOC and CERT/CSIRT teams. By simulating realistic attacker behaviour in a controlled environment, analysts can practise:

• Investigating early weak signals
• Carrying out rapid triage
• Responding to simulated incidents to test escalation procedures and containment protocols

This operational training enables teams to refine their detection logic, improve their investigation workflows, and strengthen their incident response readiness. Through repeated exposure to adversary-like activity, SOC and CERT/CSIRT analysts gain experience that directly enhances their ability to recognise and neutralise real-world threats.