River Bank Ransomware Incident: Detecting Data Wiping and Encryption Tactics

Introduction

River Bank, a prominent bank holding company, recently confirmed that it suffered a significant encryption-based cyber incident in June. The investigation remains active, but a critical detail has emerged: the threat actors not only exfiltrated data but subsequently deleted it from their staging environments. This behavior complicates the incident response lifecycle, as it removes the ability for victims to verify the scope of the breach via data leak sites, while simultaneously signaling a shift toward pure disruption or anti-forensic tactics. For defenders, this reinforces the need for real-time detection of both encryption and data-wiping behaviors, rather than relying solely on external leak monitoring.

Technical Analysis

While the specific ransomware family (e.g., LockBit 2026 variant, BlackCat 3.0) has not been publicly disclosed in the initial reporting, the attack vector aligns with modern "encryption-based" payloads prevalent in the financial sector.

Affected Products: Windows-based infrastructure (standard for banking operations).
CVE Identifiers: No specific CVE was identified in the initial reporting regarding the initial access vector. However, modern ransomware groups often exploit vulnerabilities in edge devices or unpatched services from 2025/2026.
Attack Chain:
1. Initial Access: Likely via phishing or exploitation of a public-facing service.
2. Privilege Escalation: Utilization of tools like Mimikatz or LaZagne to harvest credentials.
3. Lateral Movement: SMB/WMI exploitation across the network.
4. Data Exfiltration: Use of tools like Rclone or WinSCP to move data to attacker-controlled infrastructure.
5. Data Deletion (The Key TTP): The attackers sanitized the stolen data, likely using built-in utilities or custom wipers to destroy evidence of the exfiltration.
6. Encryption: Deployment of the ransomware payload to encrypt local and network shares.
Exploitation Status: Confirmed active exploitation. The deletion of exfiltrated data suggests a sophisticated actor prioritizing operational security or destruction over extortion.

Detection & Response

Detecting the dual threat of encryption and data wiping requires monitoring for suspicious process execution and file system changes.

SIGMA Rules

YAML

---
title: Potential Ransomware Data Wiping Activity
description: Detects the use of native tools like cipher or sdelete to wipe data securely, often used by attackers to delete exfiltrated data or hamper forensics.
id: 8a4b2c91-7d6e-4f3a-9b12-1c2d3e4f5a6b
status: experimental
references:
  - https://attack.mitre.org/techniques/T1485/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.impact
  - attack.t1485
logsource:
  category: process_creation
  product: windows
detection:
  selection_wipe:
    CommandLine|contains:
      - 'cipher /w:'
      - 'sdelete'
      - 'sdelete64'
      - 'fsutil file zerodata'
  condition: selection_wipe
falsepositives:
  - Legitimate disk wiping by IT staff
level: high
---
title: Volume Shadow Copy Deletion via VssAdmin
description: Detects commands used to delete Volume Shadow Copies, a common precursor to ransomware encryption to prevent recovery.
id: 9c5d3e02-8e7f-5g4b-0c23-2d3e4f5a6b7c
status: experimental
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  condition: selection_vss
falsepositives:
  - System administrator maintenance
level: high

KQL (Microsoft Sentinel / Defender)

KQL — Microsoft Sentinel / Defender

// Hunt for suspicious data wiping activity and shadow copy deletion
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "cipher.exe", "sdelete.exe", "sdelete64.exe", "wbadmin.exe")
| where ProcessCommandLine has_any ("delete", "wipe", "shadow", "zerodata")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for processes associated with data wiping and ransomware preparation
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "vssadmin" 
   OR Name =~ "cipher" 
   OR Name =~ "sdelete"
   OR CommandLine =~ "delete shadows"

Remediation Script (PowerShell)

PowerShell

# Remediation Script: Verify VSS Health and Enable Auditing for Wipe Tools
# Run as Administrator on critical endpoints/servers

Write-Host "Checking Volume Shadow Copy Service status..."
$vssService = Get-Service -Name VSS -ErrorAction SilentlyContinue
if ($vssService.Status -ne "Running") {
    Write-Warning "VSS Service is not running. Attempting to start..."
    Start-Service -Name VSS
}

Write-Host "Verifying presence of common wiping tools..."
$wipingTools = @("sdelete.exe", "sdelete64.exe", "cipher.exe")
$systemPaths = @("C:\Windows\System32\", "C:\Windows\SysWOW64\", "C:\Tools\")

foreach ($tool in $wipingTools) {
    foreach ($path in $systemPaths) {
        if (Test-Path ("$path$tool")) {
            if ($tool -eq "cipher.exe") { continue } # Ignore native OS tool
            Write-Warning "Potential wiping tool found at: $path$tool. Investigate immediately."
        }
    }
}

Write-Host "Enabling Advanced Audit Policy for Process Creation..."
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
Write-Host "Remediation checks complete."

Remediation

Isolation: Immediately isolate affected systems from the network to prevent the spread of encryption or further deletion of backups.
Credential Reset: Force a reset of all privileged credentials (Domain Admins, Service Accounts) used during the incident window. Assume kerberoasting or credential dumping occurred.
Data Integrity Check: Since attackers deleted the stolen data, traditional "dark web" monitoring for this specific breach is ineffective. Focus on internal log analysis (Firewall, Proxy) to reconstruct data flows (egress traffic) to identify what might have been taken.
Backups: Verify the integrity of offline backups. Attackers often attempt to delete or corrupt backups before encryption. Restore from a clean, immutable snapshot if necessary.
Hunting: Utilize the provided Sigma and VQL queries to hunt for remnants of the wiping tools or ransomware droppers on other endpoints.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub