SPAGHETTI RANSOMWARE

Ransomware and Stealer simulation service for business

Spaghetti Ransomware was born as an elaborate simulation system created with the aim of analyzing and testing a company's response to a real Ransomware threat. The Stealer module allows you to simulate the behavior of the most famous Information Stealers in circulation during the analysis, allowing you to study the behavior of the defensive mechanisms implemented against this type of threat.

Through a controlled detonation of the simulator in the corporate network, the critical areas of the system to be protected are highlighted and concrete strategies are provided to mitigate the associated risk.

The tool consists of an exfiltration server and a client agent, both written in a cross-platform language. When the agent is executed (double click) on a device belonging to the corporate network (in an Active Directory environment), it starts a series of processes typical of authentic ransomware including:

• Controlled replication – the executable copies itself within the filesystems of all machines reachable within the limits of the execution privileges and the previously declared scope;
• “Stealing” – the malware searches for potentially sensitive files and data on the infected machine and exfiltrates them, simulating the behavior of the most famous Information Stealers currently in circulation;
• Controlled data encryption – extracted files are not deleted, but encrypted with a key that will be deposited in the ransom TXT file on the machine’s filesystem; the customer has the option to choose the “safe encryption” option, preventing the replacement of potentially useful files on the systems in scope.

At the end of execution, the system is cleaned of all remnants left by the Spaghetti Ransomware simulator (such as executables and archives) except for the ransom file, which is left on the system as proof of its infection. On the remote exfiltration server, an archive containing all the sensitive files extracted and a timeline of the operations performed by the malware regarding each of the infected systems will be deposited.

Based on these timelines, the security team can generate a report that includes a graphical infection map and all the operations performed, divided by system.