Please make sure you have offline backups

June 11, 2014, Adam Sarote, Director, Coalfire

The ransomware, Cryptowall and its still active predecessor, Cryptolocker, are now running more sophisticated and dangerous attacks. For the past few months, attackers have been using the new “RIG" exploit kit to spread the ransomware. Cisco has seen RIG used in a high volume of attacks “we have so far blocked requests to over 90 domains for more than 17% of our Cloud Web Security (CWS) customers.” – Andrew Tsonchev, cisco.com.
 
For those unfamiliar with ransomware, according to Microsoft: “Ransomware is a kind of malware (malicious software) that criminals install on your computer so they can lock it from a remote location. Ransomware generates a pop-up window, webpage, or email warning from what looks like an official authority. It explains that your computer has been locked because of possible illegal activities on it and demands payment before you can access your files and programs again.”
 
This ransomware has hit not only personal computers, but also organizations, including a town in New Hampshire. This particular attack was carried out when an employee opened a seemingly legitimate email attachment, once again reminding us of the ever-present danger of social engineering.
 
New attacks are emerging every day, but they serve as a good reminder to review even the most basic IT principles. Whether it’s reviewing your company’s security training, or raising company awareness through a social engineering assessment; it is important to increase your company’s awareness of social engineering attacks.
 
Most importantly, this ransomware can infect not only the local files, but also any backups that are accessible. A common best practice is to create cold back-ups, (backups that are stored offline). If you’ve recently completed an IT risk assessment, now would be a good time to review any gaps regarding your data back-up processes.
 
Sources:
https://blogs.cisco.com/security/rig-exploit-kit-strikes-oil
http://arstechnica.com/security/2014/06/we-will-be-paying-no-ransom-vows-town-hit-by-cryptowall-ransom-malware/
http://www.microsoft.com/security/resources/ransomware-whatis.aspx
Adam Sarote

Author

Adam Sarote — Director, Coalfire

Recent Posts

Post Topics

Archives

Tags

2.0 3.0 access Accounting Agency AICPA Assessment assessments ASV audit AWS AWS Certified Cloud Practitioner AWS Certs AWS Summit bitcoin Black Hat Black Hat 2017 blockchain Blueborne Breach BSides BSidesLV Burp BYOD California Consumer Privacy Act careers CCPA Chertoff cloud CoalfireOne Compliance credit cards C-Store Cyber cyber attacks Cyber Engineering cyber incident Cyber Risk cyber threats cyberchrime cyberinsurance cybersecurity danger Dangers Data DDoS DevOps DFARS DFARS 7012 diacap diarmf Digital Forensics DoD DRG DSS e-banking Ed Education encryption engineering ePHI Equifax Europe EU-US Privacy Shield federal FedRAMP financial services FISMA Foglight forensics Gartner Report GDPR Google Cloud NEXT '18 government GRC hack hacker hacking Halloween Health Healthcare heartbleed Higher Higher Education HIMSS HIPAA HITECH HITRUST HITRUST CSF Horror Incident Response interview IoT ISO IT JAB JSON keylogging Kubernetes Vulnerability labs LAN law firms leadership legal legislation merchant mobile NESA News NH-ISAC NIST NIST 800-171 NIST SP 800-171 NotPetya NRF NYCCR O365 OCR of P2PE PA DSS PA-DSS password passwords Payments PCI PCI DSS penetration Penetration Testing pentesting Petya/NotPetya PHI Phishing Phising policy POODLE PowerShell Presidential Executive Order Privacy program Ransomware Retail Risk RSA RSA 2019 Safe Harbor Scanning Scans scary security security. SOC SOC 2 social social engineering Spectre Splunk Spooky Spraying Attack SSAE State Stories Story test Testing theft Virtualization Visa vulnerability Vulnerability management web Wifi wireless women XSS
Top