The cybersecurity landscape is ever-changing, and the emergence of new threats is a constant challenge for professionals in the field. In April 2023, Check Point Research introduced Rorschach, a fast and highly customizable ransomware strain encountered in an attack against a US-based company.
A Lightning-Fast Ransomware
One notable aspect of Rorschach was its encryption speed in Check Point Research's testing. In five controlled tests involving 220,000 local-drive files on a system with 6 CPUs, 8192MB of RAM and an SSD, Rorschach averaged approximately four and a half minutes, compared with seven minutes for LockBit 3.0—about 36% less time. These are historical benchmark results, not a universal performance guarantee or a current ranking. The analyzed sample encrypted only portions of each file, rather than the entire contents. See Check Point Research's original analysis and test results.
The Patchwork of Techniques
Check Point's analysis described a mix of familiar and distinctive techniques: automatic propagation through Group Policy when executed on a Windows domain controller, hybrid cryptography suspected to draw on Babuk, and ransom notes resembling those of other families. These similarities did not establish a shared operator. The researchers' assessment illustrates why Rorschach stood out as a formidable, customizable threat.
Key Takeaways and Action Steps
The following defensive steps align with the joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide:
- Maintain regular backups: Ensure that you have up-to-date, encrypted backups of your critical data stored offline. Regularly test their integrity and your ability to restore them.
- Implement robust cybersecurity measures: Deploy a comprehensive cybersecurity solution, including advanced threat detection and response capabilities.
- Keep software and systems updated: Regularly update your operating systems, software, and firmware.
- Educate employees: Ensure that your employees are aware of the risks associated with ransomware and know how to recognize and report suspicious activity.
- Develop an incident response plan: Have a well-defined incident response plan in place, and exercise it regularly.
Rorschach ransomware is a stark reminder of the relentless evolution of cyber threats. By taking a proactive approach to cybersecurity, organizations can better protect themselves against this sophisticated menace.