Please make sure you have offline backups

June 11, 2014, Adam Sarote, Director, Coalfire

The ransomware, Cryptowall and its still active predecessor, Cryptolocker, are now running more sophisticated and dangerous attacks. For the past few months, attackers have been using the new “RIG" exploit kit to spread the ransomware. Cisco has seen RIG used in a high volume of attacks “we have so far blocked requests to over 90 domains for more than 17% of our Cloud Web Security (CWS) customers.” – Andrew Tsonchev, cisco.com.
 
For those unfamiliar with ransomware, according to Microsoft: “Ransomware is a kind of malware (malicious software) that criminals install on your computer so they can lock it from a remote location. Ransomware generates a pop-up window, webpage, or email warning from what looks like an official authority. It explains that your computer has been locked because of possible illegal activities on it and demands payment before you can access your files and programs again.”
 
This ransomware has hit not only personal computers, but also organizations, including a town in New Hampshire. This particular attack was carried out when an employee opened a seemingly legitimate email attachment, once again reminding us of the ever-present danger of social engineering.
 
New attacks are emerging every day, but they serve as a good reminder to review even the most basic IT principles. Whether it’s reviewing your company’s security training, or raising company awareness through a social engineering assessment; it is important to increase your company’s awareness of social engineering attacks.
 
Most importantly, this ransomware can infect not only the local files, but also any backups that are accessible. A common best practice is to create cold back-ups, (backups that are stored offline). If you’ve recently completed an IT risk assessment, now would be a good time to review any gaps regarding your data back-up processes.
 
Sources:
https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil
http://arstechnica.com/security/2014/06/we-will-be-paying-no-ransom-vows-town-hit-by-cryptowall-ransom-malware/
http://www.microsoft.com/security/resources/ransomware-whatis.aspx
Adam Sarote

Author

Adam Sarote — Director, Coalfire

Recent Posts

Post Topics

Archives

Tags