Last year may well be remembered as the year that the ransomware cyber attack came of age. Against a background of high profile attacks reported by the National Health Service, FedEx, and Telefonica, Kaspersky has confirmed that the number of ransomware attacks on businesses tripled in the year, jumping from one attack every two minutes in Q1 to one every 40 seconds by Q3.
What is ransomware?
Ransomware is malicious software that upon infecting a target system, threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid. While some simple ransomware may lock the system in a way which is not difficult for a security expert to fix, advanced malware uses a technique called cryptoviral extortion, in which it encrypts the victim’s files, making them inaccessible.
Unprecedented global scale
In May, the WannaCry ransomware attack spread through the Internet, using an exploit vector named EternalBlue, which was stolen from the U.S. National Security Agency. Unprecedented in scale, WannaCry infected more than 230,000 computers in over 150 countries, using 20 different languages to demand money from users using Bitcoin cryptocurrency.
In October, users in Russia and Ukraine reported a new ransomware attack, named “Bad Rabbit”, which follows a similar pattern to WannaCry and Petya by encrypting the user’s file tables and then demands a Bitcoin payment to decrypt them. ESET believed the ransomware to have been distributed by a bogus update to Adobe Flash software which runs on many internet browsers.
The role of Bitcoin
Extensive coverage in the UK national press has significantly raised the awareness of the risks associated with ransomware and indeed highlighted the rather dubious role played by Bitcoin. ZDNet reported in December that many UK companies are stockpiling Bitcoin to ensure the payoff of ransomware attacks rather than face a loss of reputation and possibly customers. Ransomware also plays on the international political stage with President Donald Trump’s US administration publicly blaming North Korea for the global distribution of WannaCry.
How can you protect your organisation from ransomware?
- Keep macros disabled and treat ActiveX with caution
- Keep your OS and software up to date (patch management)
- Secure your web browsing with a secure DNS service
- Maintain secure backups (old fashioned but crucial in helping UK local authorities in 2017)
- Use Next Generation antivirus and firewalls
- Create an incident response plan
Free ransomware protection software
In addition to the basic hygiene measures above, I can also recommend that you consider a dedicated ransomware protection software. Cybereason RansomFree watches the way applications interact with files, and when it detects ransomware behaviour, it stops it immediately before the files are encrypted. Its only runs on Windows machines at present time but works well and is free to use.
Ransomware protection is also a key feature of our recently launched CYBERSHIELD MDR-ENDPOINT service package. Focused on the vulnerability of individual desktop and mobile devices, this software combines traditional signature detection and artificial intelligence to identify master boot record, shadow copy and ‘non-malware’ file-less attacks.
