AI
The Ransomware-as-a-Service Ecosystem and Negotiation Reality
Ransomware-as-a-Service splits the work between developers who build payloads and affiliates who run attacks. The motivation is financial: ransom payments, insurance payouts, extortion. Most operators work 9-to-5 shifts. Ransomware Live catalogs victim reports and ransom chats publicly; the chats are instructive. Victims beg. Attackers ignore it.
Contact changes the math. Once a victim opens a chat with the group, active attacks typically stop. Attackers assume payment is coming and won’t burn time on a paying target. One colleague used that window to delay payment for five or six weeks, rebuilt the infrastructure, recovered the backups, and never paid.
“an experienced crisis negotiator or a professional incident response team can often reduce the initial ransom demand by 50% or more.” — Iulian Schifirnet
Common Initial Access Vectors Ransomware Operators Actually Use
“70% of ransomware attacks start with email fishing. It’s still the most common entry point.” — Iulian Schifirnet
Phishing leads the list, followed by credential reuse against VPNs, cloud services, and internal portals. After those come exposed remote services — a Censys search for non-default-port RDP returned nearly 1 million results. Busterlord picked CVE-2018-13379 for FortiVPN, scanned country IP ranges with a Russian mass scanner, then ran Busterlord’s FortiVPN CVE-2018 mass exploitation (08:11) to dump cleartext credentials in bulk. Unpatched internet-facing software and supply-chain access round out the five vectors.
OSINT and Credential Recon Before the Breach
Before touching the network, attackers build a target list. Phone Book harvests corporate email addresses. Intelix searches breach databases for matching passwords. Shodan maps exposed VPN endpoints. Leaks surfaces vulnerable services and leaked files. Email patterns matter beyond phishing: Active Directory usernames often mirror them exactly, so one harvested pattern maps the entire user base.
None of that is needed when default credentials still work. Busterlord brute-forced a Cisco VPN where an admin had left the username “test” and password “test.” A tip from an insider gave him WSV credentials with the password “2128” into a $25 billion company. He got in. No MFA blocked him. No alert fired on failed logins. The five-year-old FortiVPN CVE-2018-13379 exploit still returns cleartext credentials in 2025, with more hits than ever.
Internal Recon and Privilege Escalation After VPN Entry
Once inside the VPN, Busterlord ran Softperfect scanner with stolen credentials pre-loaded, targeting SMB, RPC, and Synology backup storage on port 5000. He ran the EternalBlue + Metasploit internal network sweep (16:37): vulnerable hosts got a red flag in the UI, he pasted the IPs into Metasploit, and background sessions opened giving local admin on each machine.
From there he dumped password hashes, ran AS-REP roasting against accounts missing Kerberos pre-auth, and cracked them offline. Pre-Windows-2000 computer accounts handed over a free credential: machine name in lowercase. Any valid account then unlocked LDAP queries and BloodHound graph mapping toward domain admin.
Lateral Movement, Zerologon, and Persistence
With local admin on multiple machines from the EternalBlue sweep, Busterlord cracked a local administrator hash and reused the password across the network. Rescanning confirmed access to more hosts. Then he ran the Zerologon DC-sync to dump all domain hashes (23:05): Zerologon reset the domain controller’s machine account to an empty string, Secretsdump performed a DC-sync, and every domain user hash dropped out. Most went straight into pass-the-hash rather than cracking. To stay hidden, he created a user named “support,” activated it, added it to local administrators, then promoted it to domain admins.
“in 40% of the cases domain admin credentials uh are working” — Iulian Schifirnet
Detection, Monitoring, and Incident Response Playbook
AD and LDAP logs catch ransomware operators earlier than any other source. Every attacker inside a network runs enumeration queries, so anomalous LDAP activity is a reliable signal. Endpoint telemetry should flag process creation, lateral movement tools, and file encryption, the same activity visible in the Babuk ransomware builder encrypt-decrypt demo (28:32). Backup logs should catch snapshot deletions and out-of-hours access.
“don’t detect the tool but to focus on how the adversaries operate” — Iulian Schifirnet
Tools get obfuscated. Behavior does not. Alert on new local admin accounts promoted to domain groups and Windows Defender disabled. When containment starts, isolate without powering off. A powered-off machine corrupts recovery files and voids the decryption key.
Q&A
Ransomware now comes with data exfiltration, not just encryption. How can we effectively protect against data exfiltration? Complete prevention is not realistic — attackers can photograph screens, encode files to Base64, or upload via legitimate platforms like WeTransfer — so monitoring outbound traffic for anomalies like 100 GB transfers at night is the most effective control. ▶ 32:57
Will ransomware work on post-quantum encryption, for example on backups? Current ransomware groups like LockBit or Akira have no access to quantum computers, and nation-state actors who might have such access would target credentials and sensitive documents rather than encrypting backups. ▶ 35:03
How can someone delay a ransomware payment by six weeks? What words or channels do they use to make the group accept the delay? Opening the ransomware group’s negotiation chat is enough — groups stop active attacks once contact is made because they assume the victim intends to pay and risk their own reputation if they keep attacking after negotiations begin. ▶ 36:43
If a company uses sensitivity labels with encryption for confidential files or has DLP policies, will that help prevent exfiltration? Sensitivity labels add friction but can be bypassed by encoding a protected PDF to Base64 in PowerShell and decoding it on an attacker-controlled machine, so they reduce risk without eliminating it. ▶ 38:26
What is the best strategy to limit lateral movement in the network? Network segmentation slows attackers, but monitoring LDAP queries and flagging one IP connecting rapidly to many others is the most reliable way to detect and interrupt lateral movement before critical assets are reached. ▶ 40:09
Notable Quotes
70% of ransomware attacks start with email fishing. It’s still the most common entry point. Iulian Schifirnet · ▶ 6:46
an experienced crisis negotiator or a professional incident response team can often reduce the initial ransom demand by 50% or more. Iulian Schifirnet · ▶ 4:15
in 40% of the cases domain admin credentials uh are working Iulian Schifirnet · ▶ 27:11
don’t detect the tool but to focus on how the adversaries operate Iulian Schifirnet · ▶ 30:06
Key Takeaways
- Patch VPN appliances and enforce MFA before attackers use five-year-old CVEs to walk straight in.
- Engage the ransomware group’s chat immediately — contact typically halts active attacks while you rebuild.
- Alert on behavioral patterns like new domain-admin accounts and anomalous LDAP queries, not just known tool signatures.
About the Speaker
Iulian Schifirnet
Iulian Schifirnet is a Senior Penetration Tester and Offensive Team Lead with over five years of hands-on experience in Offensive Cybersecurity. His core focus areas include red teaming, APT emulation, and malware development, with a strong emphasis on adversary simulation and security posture assessment through realistic offensive operations. Throughout his career, Iulian has actively contributed to the Cybersecurity community by winning prestigious contests, delivering impactful presentations, and speaking at numerous industry events. His practical knowledge and passion for teaching led him to found Disruption Academy - an online platform dedicated to teaching real-world red teaming concepts, techniques, and procedures. For Iulian, offensive security is not a role or a hobby - it’s a continuous pursuit of knowledge and refinement.