Examples of Ransomware: 7 Cyber Security Trends To Fight Back

by Crystal Nichols | Jul 18, 2022

Cybersecurity threats continue to increase in sophistication and frequency. As a CIO, it is important to be aware of the latest trends, common ransomware viruses, and how to best protect your organization from these threats. Here are seven cybersecurity trends and ransomware attack examples that you should make sure to keep top of your mind in 2022.

What is Ransomware?

Ransomware is a type of malware that encrypts a victim’s files and then demands a ransom be paid to decrypt them. This type of malware is particularly dangerous because it can cause irreparable damage to a victim’s computer. Once a file has been encrypted, it can be very difficult (if not impossible) to decrypt it.

What is special about ransomware? Ransomware is a type of malware that encrypts your files and holds them hostage until you pay the ransom. This can be a very costly and stressful experience, as you may lose important work or personal files if you don’t have a backup. There are many different types of ransomware, so it’s important to be aware of the dangers and know how to protect yourself.

How Does Ransomware Work?

Ransomware usually spreads through phishing emails or by exploit kits that exploit vulnerabilities in websites. Once a victim’s computer is infected with the ransomware, it will encrypt their files and then display a message demanding a ransom be paid to decrypt them. The ransom is usually paid in Bitcoin, as it is very difficult to trace.

Understand Ransomware Attacks

Ransomware is a type of malicious software (malware) that can lock, encrypt or delete files on an affected computer. It typically infects computers through phishing campaigns, malicious websites or exploit kits. Ransomware attackers demand payment from the victim in exchange for unlocking the encrypted or locked content or restoring access to the computer. It’s important to remember that paying the ransom does not guarantee that the files will be unlocked or restored and can also lead to further attacks, so it is best to avoid paying ransom whenever possible.

The best way to protect against ransomware attacks is by implementing security measures such as regularly updating software and applications, backing up data, and deploying endpoint protection tools. It is also important to educate employees about the risks associated with ransomware and how to identify potential threats. Finally, organizations should develop an incident response plan in case of a successful attack. By taking these proactive steps, you can better protect your organization from the threat of ransomware attacks.

Examples of ransomware

Cyberattacks caused by ransomware groups have been making headlines recently. This type of malware encrypts a victim’s files with malicious software and then demands a ransom be paid to decrypt them.

Crypto ransomware is the newest trend in ransomware. While paying the ransom does not guarantee that the files will be decrypted, many organizations have no choice but to comply to regain access to their critical data.

Ransomware Attacks Becoming More Sophisticated

Interestingly, ransomware is not a new threat. It has been around for years but has only become more prevalent in recent years as cybercriminals have become more sophisticated in their attacks.

The increase in knowledge has caused significant ransomware attacks. Working with an MSSP like Cybriant will help your organization avoid devastating ransomware attacks that will destroy your computer systems.

There are many different types of ransomware variants and ransomware techniques, but some of the more common ones include:

AIDS Trojan:

The first known ransomware was the AIDS Trojan, which was created in the early 1990s. This trojan claimed to be a program that would find and delete all copies of the AIDS virus from a victim’s computer. However, once it was executed, it would encrypt all of the files on the victim’s hard drive and then display a message demanding a $189 ransom be paid to decrypt the files.

While the AIDS Trojan was largely a hoax, it demonstrated the potential of ransomware and laid the groundwork for future cyber criminals to build upon. The first ransomware attack began a long history of ransomware attacks.

Bad Rabbit:

In October of 2017, ransomware called Bad Rabbit began spreading through Russia and Ukraine. This ransomware was spread through fake Flash Player updates that were hosted on compromised websites. Once a victim downloaded and executed the update, their computer would be infected with the Bad Rabbit ransomware.

This ransomware would then encrypt the victim’s files and display a message demanding a ransom be paid to decrypt the files. Interestingly, Bad Rabbit was designed to spread quickly, similar to the WannaCry ransomware.

WannaCry:

In May of 2017, the WannaCry ransomware began spreading around the world, causing widespread damage. The biggest ransomware attack in history, this ransomware was spread through a vulnerability in the Windows Server Message Block (SMB) protocol. Once a victim’s computer was infected with the WannaCry ransomware, it would encrypt their files and then display a message demanding a ransom be paid to decrypt them.

Interestingly, the WannaCry ransomware could spread itself to other computers on the same network. This helped it to cause widespread damage, as it quickly spread through corporate networks.

Petya/NotPetya:

In June of 2017, ransomware called Petya began spreading around the world. This ransomware was spread through a vulnerability in Ukraine’s tax software. Once a victim’s computer was infected with the Petya ransomware, it would encrypt their hard drive, making it impossible to boot up the computer. It would then display a message demanding a ransom be paid to decrypt the hard drive.

Interestingly, Petya was designed to spread quickly, similar to the WannaCry ransomware. However, it did not have the same ability to spread itself to other computers on the same network.

CryptoLocker:

CryptoLocker is an example of ransomware that was first seen in 2013. This ransomware is typically spread through phishing emails. Once a victim’s computer is infected with the CryptoLocker ransomware, it will encrypt their files and then display a message demanding a ransom be paid to decrypt them.

Interestingly, the CryptoLocker ransomware will often use a public key to encrypt the files. This means that even the cybercriminals who created the ransomware will not be able to decrypt the files without the victim’s private key.

Locky:

Locky is a type of ransomware that was first seen in 2016. This ransomware is typically spread through phishing emails. Once a victim’s computer is infected with the Locky ransomware, it will encrypt their files and then display a message demanding a ransom be paid to decrypt them.

Locky is notable for its use of encryption, which makes it very difficult to remove. Even if a victim pays the ransom, there is no guarantee that their files will be decrypted.

These are just a few of the more common types of ransomware that have been seen in recent years. As you can see, ransomware is a serious threat that can cause significant damage. If you suspect that your computer has been infected with ransomware, it is important to seek professional help immediately.

TeslaCrypt:

TeslaCrypt is a type of ransomware that was first seen in 2015. This ransomware is typically spread through phishing emails or by downloading infected files from the internet. Once a victim’s computer is infected with the TeslaCrypt ransomware, it will encrypt their files and then display a message demanding a ransom be paid to decrypt them.

TeslaCrypt is notable for its use of strong encryption, which makes it very difficult to remove. Even if a victim pays the ransom, there is no guarantee that their files will be decrypted.

Jigsaw, Bitcoin Blackmailer

Jigsaw is a ransomware program that gained notoriety for its unique approach to extorting payment from victims. Unlike most ransomware programs, which simply encrypt a victim’s files and demand a ransom for the decryption key, Jigsaw includes a timer that counts down and deletes files if the ransom is not paid in time.

This unique approach has made Jigsaw one of the most effective ransomware programs in operation today. However, Jigsaw is not without its flaws. One of the most notable is its reliance on Bitcoin for payments. While this allows Jigsaw to operate relatively anonymously, it also makes it difficult for victims to track down and prosecute those responsible for the ransomware attack.

Cerber:

Cerber is a ransomware-as-a-service that has been targeting Office 365 users. The ransomware is delivered via email attachments and once opened, will encrypt the user’s files. The user is then presented with a ransom demand to regain access to their files. Cerber has been evolving since it was first released in 2016 and is now one of the most prevalent ransomware strains.

Ryuk Ransomware:

Ryuk is cybercrime ransomware that has been used in attacks against high-profile organizations and individuals. The ransomware was first identified in 2018, and it is believed to be operated by a cybercrime group known as Grim Spider.

Ryuk is typically spread through phishing emails or malicious attachments, and it uses strong encryption to lock users out of their files. Once encrypted, the ransomware displays a message demanding a ransom payment in Bitcoin. Ryuk has been used in attacks against several high-profile organizations, including the City of New Orleans and the San Francisco Municipal Transportation Agency.

In 2019, the U.S. Department of Justice indicted two members of the cybercrime group responsible for operating Ryuk, and they have been arrested. However, the group is still believed to be active, and Ryuk remains a threat to organizations and individuals around the world.

Zcryptor

Zcryptor ransomware is a type of cybercrime that has been increasingly used by nation states in recent years. The ransomware works by encrypting a victim’s files and then demanding a ransom be paid to decrypt the files. Zcryptor has been used in attacks against both individuals and organizations, and it is believed to be highly effective.

In addition, Zcryptor is unique in that it uses an advanced form of encryption that makes it very difficult to decrypt the files without the ransom being paid. As a result, victims of Zcryptor ransomware attacks often have no choice but to pay the ransom to regain access to their files. Unfortunately, this cybercrime is becoming increasingly common, and individuals and organizations need to be aware of the risks.

More Examples of Ransomware

• Reveton
• GandCrab
• Troldesh
• SimpleLocker
• Spora
• Samas
• KeRanger
• Hatzee

Cybersecurity professionals and law enforcement agencies have their work cut out for them when it comes to ransomware operators. To protect your organization from ransomware, it is important to have a comprehensive cybersecurity solution in place. More examples.

If you think your organization may be at risk for a ransomware attack, or if you have already been attacked, it is important to seek professional help immediately. Especially if attackers demand a reward so you can receive the encryption key, it’s vital to find an incident response professional. A qualified cybersecurity professional can help you assess the situation and take steps to protect your data.

Security Issues Examples

Security issues can take many forms, from data breaches to malicious code scripts. Some of the most common security issues include:

1. Phishing attacks – A type of social engineering attack in which attackers fool victims into revealing sensitive information such as passwords or credit card numbers.

2. Malware – Short for “malicious software”, malware is designed to damage or gain access to a computer system without the user’s permission. Examples of malware include viruses, worms, and Trojan horses.

3. Data breaches – Unauthorized access to sensitive data stored on a company’s computers or networks. This can be caused by both malicious and non-malicious actors.

4. Distributed Denial of Service (DDoS) attacks – A type of attack that floods a server or network with requests, preventing users from accessing the system or service.

5. SQL injection attacks – An attack that takes advantage of weaknesses in web applications by injecting malicious code into a database.

6. Man-in-the-middle attacks – A type of attack in which the attacker intercepts communications between two parties and can modify or steal data as it passes through the connection.

7. Cross-site scripting (XSS) attacks – An attack that takes advantage of vulnerabilities in websites to inject malicious code that is then executed by the user’s browser.

8. Password attacks – A type of attack in which an attacker attempts to gain access to a system or service using guessable passwords. This includes a dictionary, brute force, and rainbow table attacks.

9. Social engineering – A type of attack in which an attacker attempts to gain access to a system by exploiting the trust relationship between users. Examples of social engineering attacks include phishing, pretexting, and baiting.

10. Wireless network security vulnerabilities – Weaknesses in wireless networks that allow attackers to gain unauthorized access or control over the system. Examples include weak encryption methods, unencrypted traffic, and open access points.

These are just a few of the most common security issues faced by organizations today. By staying aware of these threats, you can take steps to protect your data and systems from potential attacks.

Cyber Ransomware Removal

Cyber ransomware removal can be a tricky business.

The security firm Symantec reports on a new ransomware-type virus called.777, which is file-encrypting ransomware. This example of malware encrypts files using asymmetric encryption. .777 ransomware generates two keys: public and private (public to encrypt files, private to decrypt). It’s worth noting that without this key, file recovery is impossible.

Ransomware Decrypt Tools

Ransomware decrypt tools can sometimes be found online for free. However, it’s important to note that these only work sometimes – and there’s no guarantee that they will work for .777 ransomware.

The best way to protect yourself from ransomware is to have a good backup strategy in place. This way, if your files do get encrypted, you can simply restore them from backup.

There are a few different ways to backup your data. One popular method is to use an online backup service, such as Carbonite or Mozy. These services automatically back up your files to their servers, so even if your computer is infected with ransomware, you can still access your backed-up files.

Another option is to use a portable hard drive or USB flash drive. You can manually copy your files to these devices, or you can set up automatic backups. One advantage of using portable storage devices is that you can unplug them and store them in a safe place (such as a safety deposit box) when you’re not using them, so even if your

What messenger service does ransomware use? There is no one messenger service that all ransomware uses. However, some of the more common ones include WhatsApp, Facebook Messenger, and Telegram.

Malware vs Ransomware

Cyber security experts define ransomware as a type of malicious software designed to extort money from victims by blocking access to systems or encrypting data.

Ransomware can be spread as a link or attachment in emails, as an advertisement, or via other malicious websites, and is usually written with various coding languages. To create ransomware, attackers may need programming knowledge, experience using encryption protocols, and an understanding of basic techniques such as obfuscation or reverse engineering to help hide source code from the anti-malware scanner.

Ransomware should not be confused with malware which is designed only to disrupt functions or steal information without asking for payment in return. As software developers continue to refine their detection methods for both malware and ransomware, it is important for businesses and individuals to maintain effective security practices in order to remain safe online.

Ransomware-As-A-Service

Ransomware attacks have become increasingly common in recent years, as criminals have grown more sophisticated in their use of malware. In a ransomware attack, criminals encrypt a victim’s files and demand a ransom to decrypt them. These attacks can be extremely costly, as victims may be unable to access their critical data. Ransomware-as-a-service (RaaS) platforms have made it easy for even amateur hackers to launch these attacks, as they provide tools and support for launching and managing an attack.

Managed security services can help organizations to protect themselves against ransomware attacks by continuously monitoring for threats and quickly responding to incidents. By investing in managed security services, organizations can reduce their risk of becoming a victim of ransomware attacks.

Typical Ransomware Timeline

The typical ransomware timeline looks like this:

1. A victim’s computer is infected with ransomware. This can be done in a variety of ways including phishing emails, downloading infected files from the internet, or through a malicious website.
2. The ransomware begins to encrypt the victim’s files. Be aware that if your organization uses an AI-based threat detection program, security analysts will be able to stop the threat before it can do any damage and may use decryption tools to deactivate the computer virus.
3. Once the files are encrypted, the ransomware will display a message demanding a ransom be paid to decrypt them. The amount of the ransom varies depending on the type of ransomware but can range from a few hundred dollars to several thousand.
4. If the ransom is not paid within the specified time frame, the ransomware will often delete the encryption key, making it impossible to decrypt the files. In some cases, the ransomware will also delete the files themselves.
5. If the ransom is paid, there is no guarantee that the victim will get their files back. Many victims that provide ransom payments never receive their decryption key even after paying the ransom.

Evolution of Ransomware

Ransomware has evolved significantly since it first appeared on the internet in 1989 and has caused some of the most devastating ransomware attacks in history. Early versions of ransomware were relatively simple and easy to remove. However, newer versions are much more sophisticated and can be very difficult to remove.

One of the biggest changes is in the way that ransomware is spread. In the early days, ransomware was typically spread through floppy disks or CDs. However, today it is most often spread through phishing emails or malicious websites.

Another change is the way that ransomware is delivered. In the early days, ransomware would typically encrypt a victim’s hard drive, making it impossible to boot up the computer. Today, ransomware will often only encrypt specific files, making it possible to still use the computer.

Finally, the ransom itself has changed over time. In the early days, ransomware would typically demand a few hundred dollars to decrypt the files. Today, ransomware will often demand several millions of dollars or cryptocurrency.

2022 Cyber Security Trends

As cybercriminals become more sophisticated in their attacks, organizations must also become more sophisticated in their defenses. Here are seven cybersecurity trends that you should make sure to keep top of mind in 2022 to protect your critical infrastructure:

#1. Artificial intelligence (AI) and Machine Learning

Organizations are increasingly using AI and machine learning to detect and respond to cybersecurity threats. These technologies can be used to automatically identify malicious activity and then take action to mitigate the threat.

AI and machine learning are becoming increasingly important in cybersecurity. They can be used to automatically identify malicious activity and then take action to mitigate the threat. AI and machine learning can also be used to improve security posture by identifying vulnerable areas and recommending solutions.

#2. XDR

Extended Data-Recovery (XDR) is a technology that can be used to protect files from ransomware and other types of malware. XDR can be used to create a backup of all of the files on a computer, making it possible to restore them if they are encrypted by ransomware.

XDR can also be used to detect ransomware before it encrypts files. This is done by analyzing the behavior of the ransomware and looking for signs that it is about to encrypt files.

#3. Endpoint Security

With more and more devices being connected to the internet, it is important to make sure that each one is properly secured. Endpoint security refers to the practice of securing all of the devices that are connected to a network.

Some examples of endpoint security include next-generation firewalls, intrusion detection systems, EPP, and EDR. Endpoint detection and response (EDR) is a technology that can be used to detect and respond to ransomware and other types of malware. EDR can be used to monitor all of the devices that are connected to a network for signs of malicious activity.

#4. SOAR

SOAR is an acronym for Security Orchestration, Automation, and Response. SOAR is a technology that can be used to help organizations respond to cyber threats. It can be used to automate the process of identifying and responding to threats. This can help to speed up the process of mitigating a threat and reduce the amount of time that it takes to resolve an incident.

#5. User Behavior Analytics

User behavior analytics (UBA) is a technology that is used to detect anomalous behavior by users. This can be used to identify malicious activity, such as ransomware attacks. UBA works by analyzing the behavior of users and looking for patterns that are indicative of malicious activity.

User behavior analytics is used to detect anomalous behavior by users. This can be used to identify malicious activity, such as ransomware attacks. UBA works by analyzing the behavior of users and looking for patterns that are indicative of malicious activity.

#6. Cyber Insurance

Organizations are increasingly purchasing cyber insurance to financially protect themselves in the event of a successful cyberattack.

Typical cyber insurance programs provide coverage for a wide range of cyber risks, including ransomware attacks. The program also includes coverage for the costs of investigating and responding to a cyberattack.

#7. Multi-factor authentication

Organizations are using multi-factor authentication to make it more difficult for cybercriminals to gain access to sensitive data. This is because it requires the use of multiple factors, such as a password and a security token, to authenticate a user.

Multi-factor authentication is a security protocol that requires the user to provide multiple pieces of information to authenticate. This can include a password, a security token, and a biometric identifier. Multi-factor authentication makes it more difficult for cybercriminals to gain access to sensitive data.

Data recovery tool from locky ransomware

If you have been infected with the Locky ransomware, you may be wondering how you can go about recovering your files. Unfortunately, there is no guaranteed way to do this, as the encryption used by Locky is very strong. However, there are a few things that you can try that may be successful.

First, if you have a backup of your files, you may be able to restore them from that. This is the best-case scenario, as it will allow you to avoid paying the ransom and losing your files altogether.

If you don’t have a backup, you can try using a data recovery tool. These tools are designed to scan your hard drive for traces of deleted files and attempt to recover them. They may not be successful in all cases, but it’s worth a try if you don’t have any other options.

Finally, you can try contacting the ransomware creators and see if they are willing to provide you with a decryption key. This is often unsuccessful, but it’s worth a try if you have no other options.

If you are unable to recover your files, the best thing to do is to ensure that you have a backup going forward. This way, if you are ever infected with ransomware again, you will be able to restore your files without having to pay the ransom.

There are a few different ransomware decrypt tools that are available, but not all of them may be effective against the Locky ransomware.

You may have to try a few different decryptors before you find one that is able to successfully decrypt your files. It is also important to note that even if you are able to decrypt your files, they may be damaged and may not be able to be opened. For this reason, it is always best to have a backup of your files before attempting to decrypt them.

Cybersecurity Threats, Malware trends, and Strategies

Cybersecurity threats are on the rise, and ransomware schemes are becoming increasingly difficult to detect and protect against. With malware trends continually evolving, organizations must be proactive in protecting their networks from malicious attacks. A multi-layered approach is needed for an effective cybersecurity strategy that includes antivirus protection, updated software, and employee training on how to recognize a potential threat. Additionally, web filtering should be implemented to help keep malicious websites and ads at bay. Companies should also consider backup solutions to ensure data continuity and integrity in the event of any breach. Taking these steps will ensure thorough protection against ransomware schemes, viruses, phishing scams, malware, and other cyber-attacks.

Ransomware Schemes

Ransomware schemes are particularly difficult to detect and prevent due to the sophisticated tactics used by criminals. Ransomware attacks involve malicious software that encrypts data on a computer, making it inaccessible until payment is made. It’s important for organizations to have secure backup solutions in place so they can quickly restore data if their systems become compromised. Additionally, antivirus software should be kept up to date and users should be trained on how to recognize potential threats.

How to Prevent Locky Ransomware Attacks

Locky ransomware is one of the most common and dangerous ransomware variants. Locky encrypts files on the infected computer and typically requires a payment in the form of cryptocurrency to unlock them. Companies should take steps to protect themselves against Locky ransomware by implementing antivirus software with real-time scanning, restricting user access to sensitive data, setting up proper firewalls, and creating backup solutions. Additionally, web filtering should be used to block malicious websites and ads.

How Fast Does Ransomware Work?

Ransomware is one of the most concerning forms of malicious software today. It’s a particularly powerful type of attack because, once a ransomware group has gained access to stolen data, the process works very quickly.

Usually, within a matter of minutes, the stolen data is encrypted and held for ransom by the attackers. Keeping security measures up to date is essential for reducing potential damage from ransomware. Doing so can help protect against ransomware groups breaching stolen data, and ultimately guard against irreparable harm and financial loss caused by their fast-working attacks.

Conclusion

While ransomware and other cyber security threats are on the rise, there are ways to protect your business by fighting ransomware. Managed Security Services can help you stay ahead of these threats and keep your data safe, and even ransomware strains protection. If you’re not sure where to start or want more information about how our team can help, contact us today. We would be happy to discuss your specific needs and how we can work together to protect your business from cybercrime.

Top Cyber Security Websites of 2022

FBI Reports Rise in PYSA Ransomware Attacks

by Crystal Nichols | May 26, 2021

In a bulletin posted in March of 2021 on its ic3.gov website, the Federal Bureau of Investigation warned of an increase in the number of PYSA ransomware attacks being perpetrated against K-12 schools, seminaries, and universities in the U. S. and the United Kingdom.

What is PYSA Ransomware?

PYSA, also known as Mespinoza, is a type of malware composed of tools used to scan networks, then exfiltrate and encrypt their targets’ critical data. Attackers then demand payment to restore their victims’ access to the information. PYSA attacks have also been used to target governmental agencies, private industry, and healthcare providers. The FBI first became aware of this ransomware variant in March of 2020.

Attack methodology

Attackers typically use social engineering, particularly phishing, as well as other tactics to obtain Remote Desktop (RDP) credentials they then leverage to access their targets’ systems. Once inside a victim’s network, they analyze the environment using port scanning and open source tools including Advanced Port Scanner, Mimikatz, Koadic, and PowerShell Empire.

These applications allow the attackers to find open ports they can use to access servers, identify programs, stage their malicious payloads, capture passwords from volatile memory, run scripts, and perform other operations in preparation for data exfiltration and encryption. They may also run commands to deactivate malware protection on their victims’ networks.

Once the prep work is completed, the cybercriminals will use the secure file transfer application component of the PYSA malware package, WinSCP in many cases, to exfiltrate copies of the critical files they’ve identified, then use an encryption algorithm to encrypt the original data on the victims’ systems.

Next, the malware will cause ransom demand messages to be displayed on victims’ login/lock screens. These messages may be very detailed, even including frequently asked questions sections. The messages will provide email addresses victims’ can use to contact the attackers along with specific ransom demands that, if met, will supposedly result in restoration of access to the encrypted files. The messages usually include threats to sell the exfiltrated data on the dark web if ransom demands are not met. Anonymous, encrypted email accounts, most obtained from ProtonMail.com and OnionMail.org, are used by the perpetrators of these attacks, thus concealing their identities and making it more difficult to track them down.

Forensic investigations of these attacks have revealed that the PYSA malware package is typically placed in a user folder on the C: drive of compromised systems. The malware file is sometimes given a name like svchost.exe, the name used for generic Windows processes, in an attempt to disguise it. Attackers sometimes remove the malware installation files after the applications are deployed. After encryption, the victims’ files typically have a .pysa file extension.

Types of data and systems typically targeted

The FBI bulletin does not indicate why the number of these attacks targeting educational institutions is on the rise, but it does provide information about the type of data attackers are targeting. They typically look for applications not accessible to average users, thus indicating to attackers that the data being accessed by these applications is sensitive or confidential. They also seek out backup files and databases where high-value data is stored. Per the FBI, attackers have focused on employment records and other files containing personally identifiable information (PII), payroll tax files, and anything else that, if stolen or rendered inaccessible, could provide victims with a great deal of incentive to pay a ransom.

Payment of ransoms is not recommended

In general, the FBI does not recommend that victims of ransomware attacks pay their attackers. In some cases, the attackers simply disappear with the ransom without restoring their victims’ access to the encrypted data. Additionally, an organization’s willingness to pay may identify it as an easy mark for future attacks by the same or other cybercriminals. Although not recommended, the payment of ransoms is also not prohibited. Organizational managers must evaluate each situation and make the decision regarding payment based on operational continuity, what is best for their employees and shareholders, and other pertinent factors relating to that particular attack.

Basic security measures help ward off PYSA attacks and mitigate their impacts

Many of the same security controls used to protect against other attacks and malware also work to prevent PYSA attacks from succeeding or at least mitigate the resulting damages.

Antivirus and anti-malware applications should be installed and regularly updated. Installing operating system and application security patches and updates as soon as possible to ensure any known vulnerabilities are eliminated is recommended. Configuring email systems to disable hyperlinks and include a warning banner on messages received from external senders will reduce the possibility that employees will inadvertently download malware from malicious sites or be taken in by phishing attempts (often the first step in PYSA attacks).

Multi-factor authentication should be implemented wherever available. Requiring strong passwords and regular mandatory password resets for all users is a must. Password sharing and reuse should be prohibited and user account privileges need to be regularly reviewed. Role-based access privileges should be applied, thus ensuring that users have only the minimum level of access required to perform their duties.

Because PYSA attackers routinely utilize Remote Desktop Protocol to access targeted systems, disabling RDP wherever possible is recommended. Any unnecessary remote access ports should be disabled as well. Remote access logs should be monitored to identify and investigate any suspicious activity.

Segmenting networks to the extent possible will make it more difficult for attackers to freely traverse the environment if access is gained. Regular data backups are recommended, as is storing backups on air-gapped storage systems separated from the rest of the environment.

Because phishing and other forms of social engineering are often used in these attacks, user training is critical. Simulation and role-playing are effective training methods because they require user participation. Consider utilizing a service that can actually send simulated phishing emails to users and track their responses.

Finally, if all else fails, organizations should have an enterprise continuity and recovery plan in place to aid in the recovery from a successful attack. The plan needs to be tested regularly and updated when necessary to ensure that it is continuously improved and remains current.

Recommendation

The number one way to mitigate the damage from any attack to your system is to prevent it from happening in the first place. It’s vital to protect your organization from all points of entry, and ensure that organizations are aware of all the points of entry that are being utilized by employees.

With CybriantXDR, you will have increased visibility along with the right technology, and security analysts watching that technology around the clock. With machine learning and artificial intelligence, our team is able to stop any bad actors before they execute.

Learn more about CybriantXDR here. 

Conclusion

Foreign and domestic cybercriminals are, according to the FBI, responsible for a growing number of PYSA ransomware attacks targeting educational institutions in the U.S. and U.K. These attacks have also been directed at governmental agencies, the healthcare sector, and private companies. Because they often begin with phishing and other forms of social engineering, training your organization’s user community to recognize the signs of a potential attack is critical. Beyond that, implementing many of the same technical controls used to prevent other forms of attack will also help to prevent PYSA attacks from being successful. Placing special emphasis on running regular backups and isolating and protecting backup files along with implementing continuity and recovery plans could significantly mitigate the impacts should a successful attack occur.

The FBI requests that any suspected or verified attacks be reported via their site at ic3.gov or by contacting a local FBI office.