Ransomware : Beware of the Blackmailer

“Ransomware is more about manipulating vulnerabilities in human psychology than the adversary's technological sophistication”

― James Scott, Sr.

In May 2017, over 300,000 organisations worldwide were affected by dangerous "WannaCry" ransomware spreading to through networks exploiting Microsoft Window. WannaCry encrypted organisations’ files and demanded $300 worth of Bitcoins to receive the decryption key. 

In March of 2021, insurance giant CNA Financial paid $40 million in bitcoin to a culprit recover their data from Phoenix CryptoLocker ransomware. In June 2021, JBS Foods paid $11 million in bitcoin to a Russian hacker group to prevent further disruption from a ransomware.

Ransomware is a malware, when infected, encrypts the data in the computer, and deny the access to the files, making to the system a hostage. The culprit demands a ransom payment in exchange for the key to decrypt files in the system.

Ransomware has become the most prominent  malware today. They spread through phishing emails containing malicious attachment or through a website link, when visited, the malware is downloaded and installed without the user’s knowledge known as drive-by downloading.

Crypto ransomware spread through social media, instant messaging applications. 

The potential negative impact of Ransomware on business can be massive. It includes temporary or permanent loss of sensitive data

• disruption of business operations,
• financial losses caused to restore files
• harm to the organization reputation

There is guarantee that the encrypted files will be released after the payment of the Ransome.

Defending against ransomware is active process.  If happened, the result could be devastating, and recovery can be a difficult. Due preparation can help you prevent or decrease the impact of a ransomware attack.

Following are the best practices to reduce the attack surface and potential exposure to ransomware.

Training and Education: 

Train your users to identify and avoid potential phishing emails that carry ransomware. Humans are the weakest link causing cyber attacks; Hence user education is crusial for preventing ransomware attacks.

Backup your data continuesly: 

Do not become a victim by paying a ransom to  the culprit. The automated, protected data backups can help you recover data with a minimum of data loss. Deploy a data backup and recovery plan for all mission critical information, and test your backups to limit a data loss and to speed up the recovery process. Networks enable fast spreading of ransomware. Therefore isolate your backups from the network for maximum protection.

Patch your systems regularly: 

Patching is critical for defending against ransomware attacks. The cyber criminals often look for the latest uncovered exploits in the systems which not yet patched. Keep the operating system and software up-to-date with 

regular patching to reduce the attack surface. 

User Authentication: 

RDP like Access Control services can be exploited by hackers with stolen user credentials  

Maintain up-to-date anti-virus software:

Scan all software downloaded from the internet prior to executing, and use a sandbox to test them.

Restrict users installing their choice of software applications at end points. Only allow use of verified and approved software installed by support staff.

Avoid enabling macros in office documents.  When a user opens an attachment with  macros, the embedded macrob code will execute the malware on the machine.

Do not enable USB drives that may have been infected with a malware, which will download and install a malware.  

Use Cloud storage to automatically synchronise local files in the system. 

Untrusted file and software downloads, peer to peer torrents, free hosting websites, freeware download sites, and unofficial web pages can be sources of ransomware. Browsing internet with administrative account is exposing your computer for ransomware.

4. Establish a recovery time objective:

The RTO is the length of time it takes to wipe the infected machine and restore it from the backup. regularly test your recovery process

Mitigating a ransomware infection

If you see the ransom message, your files are already encrypted. They are likely unrecoverable. Follow these steps in recovery process.

Quarantine the system: 

Certain ransomware variants spreads through  the network.  Disconnect the computer from the network.

Leave the Computer On: 

Although the encryption of files can make a computer unstable, the  powering off the computer reduces the probability of recovery.

Decrypted files by some ransomware can be recovered without paying the ransom. Therefore make a bit-to-bit copy of the disks. 

Check for Decryptors: 

Check the No More Ransom Project to see if there is a free decryptor is available. Try running a copy of the encrypted data to see if it can restore the files.

Ask For Help: 

Ask for help from a digital forensics expert to   recover files that may not been deleted by the ransomware.

Wipe and Restore: 

Completely wipe data and restore the machine from a clean backup or operating system installation to ensure that malware is totally removed.

Daily Ransomware News

https://portswigger.net/daily-swig/ransomware

Niranjan Meegammana