Petya/NotPetya: What It Is, and What You Can Do Right Now
June, 2017, Mike Weber, Vice President, Coalfire Labs
Just when we thought there were no more tears left in the wake of WannaCry, it’s time to pull out the tissues yet again for the latest global cyber incident: introducing “NotPetya,” the most recent ransomware variant to creep across continents and affect companies across many industries. Please read on for helpful information on how to prevent a NotPetya attack, as well as minimize propagation across the network.
Ransomware: the anatomy of paying a ransom to decrypt hostage files
May, 2017, Bryce Bearchell, Security Consultant
Ransomware is on the rise and clients seeking to understand the process can learn from this client’s story about being a victim of ransomware as to what can be expected and how to handle a ransomware attack. Recently a company facing a malware infection approached us to help them deal with the encryption of most of their servers across their domain. This also included systems that held online backups - and there was no offline backup solution (that’s a topic for a whole different blog post). The company had discovered a ransom note on their affected systems, along with data files that had been deleted and new files created in the format of <original_filename>.whereisyourfile that appeared to be encrypted.
Information and guidance for dealing with WannaCry
May, 2017, Mark Lucas, Vice President, Chief Information Security Officer, Coalfire
Coalfire continues to closely monitor the WannaCry ransomware attack. Much has been written over the past few days about the attack. For those of you who may not have had time to review in detail and assess appropriate actions for your organization, we wanted to provide summary information.
What does the FBI have to say about ransomware
October, 2016, Tom Glaser, Healthcare Solutions Architect, Coalfire
The FBI provided guidance on ransomware at a recent FBI/US Secret Service/ISAC event. They defined ransomware as a type of malware that is commonly transmitted through malicious email, which is disguised to look normal. Once the email link has been clicked on, or an email attachment has been opened, the malware installs on the computer. After installation is completed, files on the computer become locked using encryption and cannot be opened without the key. A ransom message is then displayed with information on how to pay the ransom.