Evitare il Ransomware Cover Giacomo Lanzi

Avoid Ransomware: That’s why it’s best not to take any risks

Estimated reading time: 4 minutes

ransomware gangs have been targeting businesses in recent times, demanding larger payments than they can extort from consumers. The plan was very successful. According to the new data, 70% of the attacked companies paid the ransom to get their data back. Avoiding ransomware is a necessity, these figures implicitly prove it. If such a large number of companies pay, it is because the risk is too great in terms of reputation and collateral economic losses.

Researchers from IBM Security’s X-Force interviewed executives of 600 companies of all sizes and found that organizations affected by ransomware choose to pay in most cases.

Data shows that 20% of compromised organizations paid ransoms of more than $ 40,000 and 25% paid between $ 20,000 and $ 40,000. These numbers are much higher than that. that consumers typically pay, which is usually around $ 500-1,000, depending on the variant of the ransomware.

When targeting businesses, hacking groups aim to paralyze organizations by encrypting financial data , customer databases, sales data and other vital information .

Avoid ransomware – the risks of attacks

In the past year, a number of organizations have been hit by severe ransomware attacks, including hospitals, universities and others. For example, the San Francisco Municipal Transportation Authority was hit by a ransomware attack during the weekend of Thanksgiving, a very important holiday in the US. The attack paralyzed desktops within the agency and forcing officials to shut down the automatic ticket machines. Needless to say, this attack resulted in a huge loss of assets and a ransom demand.

Getting malware into public organizations isn’t as difficult as you might think, and is often done with a single email .

In their attacks on networks, cybercriminals seek out the servers that keep the business running and encrypt critical assets rather than working on enterprise-wide endpoints.

The access point is usually a phishing email with a malicious attachment, sent to the mailbox of a employee . In most cases, the attachment is a Microsoft Office document asking the victim to enable macros . Clicking the macro enable button is often a trivial matter for those uninformed users who just want to get rid of the warning at the top of the document . The malware runs as soon as the user allows the macros to run. The ransomware can also arrive through any other attachment or through exploit kits which facilitate infection without any special action on your part.

Economic losses

The amount of money businesses have paid to get their data back shouldn’t come as a surprise considering the alternative. As is increasingly the case, the attack doesn’t just put key the data until payment of the requested amount. The threat continues with the release of data if you do not agree to pay a second ransom. In the end two ransoms will be paid and in any case there is no certainty that the data will not be disclosed. (It is said double extortion attack).

Many organizations keep these attacks under wraps to avoid public humiliation and loss of customer confidence . Data from the IBM survey shows that 29% of executives in large corporations would pay more than $ 50,000 to retrieve financial data.

Law enforcement, including the FBI, and security experts advise ransomware victims not to pay, for a variety of reasons. First, there is no guarantee for the attacker to deliver the decryption key. Second, the ransomware’s profits help fund other cybercrime operations.

How to defend yourself to avoid ransomware

Phishing remains one of the key methods by which a ransomware attack is attempted. With the recent increase in remote working, it is imperative to reiterate the importance of being careful when opening emails and attachments . If employees are suspicious of something, they should report it.

Organizations should also make sure they have a good patching strategy and apply the latest security updates . This prevents cybercriminals from taking advantage of known vulnerabilities to distribute malware.

Regularly updating backups should be a priority , because if the worst happens and your organization falls victim to a ransomware attack, your network can be restored without paying the ransom.

SOD provides solutions for the situations listed through the SOCaaS service. You can ensure the protection of a Security Operation Center without having to invest in its initial funding .

The system controls the actions of the computers connected to the network using an artificial intelligence. As soon as a suspicious, even legitimate, action is detected, the technicians are alerted who can investigate the nature of the fact . The new generation SIEM systems and behavioral analysis via UEBA , work together to offer 360 ° security.

SOD also provides intelligent anti-ransomware backup systems via Acronis Cyber Protect Cloud . With this tool at your side, business and customer data are safe. Any attack attempt is identified and mitigated immediately, meanwhile, thanks to dynamic backups, the data is immediately restored .

Avoiding ransomware can be relatively easy – just pay attention to every operation you perform on your computers. Unfortunately, sometimes this is not enough. This is the time when having invested in a quality safety system will make a difference.

For questions or requests do not hesitate to contact us, we will be happy to answer your questions and propose a solution tailored to your needs.

Share


RSS

More Articles…

Categories …

Tags

RSS Unknown Feed

RSS Full Disclosure

  • CyberDanube Security Research 20221124-0 | Authenticated Command Injection Hirschmann BAT-C2 November 29, 2022
    Posted by Thomas Weber on Nov 29CyberDanube Security Research 20221124-0 -------------------------------------------------------------------------------                title| Authenticated Command Injection              product| Hirschmann (Belden) BAT-C2   vulnerable version| 8.8.1.0R8        fixed version| 09.13.01.00R04           CVE number| CVE-2022-40282               impact| High            ...
  • Exploiting an N-day vBulletin PHP Object Injection Vulnerability November 29, 2022
    Posted by Egidio Romano on Nov 29Hello list, Just wanted to share with you my latest blog post: http://karmainsecurity.com/exploiting-an-nday-vbulletin-php-object-injection Best regards, /EgiX
  • Win32.Ransom.Conti / Crypto Logic Flaw November 29, 2022
    Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/99e55ce93392068c970384ab24a0e13d.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Win32.Ransom.Conti Vulnerability: Crypto Logic Flaw Description: Conti ransomware FAILS to encrypt non PE files that have a ".exe" in the filename. Creating specially crafted file names...
  • Ransomware Deception Tactics Part 1 November 29, 2022
    Posted by malvuln on Nov 29Did you know? some Ransomware like CONTI and others will FAIL to encrypt non PE files that have a ".exe" in the filename. Test.exe.docx Test.exe.pdf Conti MD5: 9eb9197cd58f4417a27621c4e1b25a71 ATOMSILO MD5: 5559e9f5e1645f8554ea020a29a5a3ee
  • Trojan.Win32.DarkNeuron.gen / Named Pipe Null DACL November 29, 2022
    Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/d891c9374ccb2a4cae2274170e8644d8.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Trojan.Win32.DarkNeuron.gen Vulnerability: Named Pipe Null DACL Family: DarkNeuron (Turla Group) Type: PE32 MD5: d891c9374ccb2a4cae2274170e8644d8 Vuln ID: MVID-2022-0661 Disclosure: 11/24/2022...
  • Backdoor.Win32.Autocrat.b / Weak Hardcoded Credentials November 29, 2022
    Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/4262a8b52b902aa2e6bf02a156d1b8d4.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.Autocrat.b Vulnerability: Weak Hardcoded Credentials Description: The malware is packed with PeCompact, listens on TCP port 8536 and requires authentication. However, the password...
  • Backdoor.Win32.Serman.a / Unauthenticated Open Proxy November 29, 2022
    Posted by malvuln on Nov 29Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022 Original source: https://malvuln.com/advisory/f312e3a436995b86b205a1a37b1bf10f.txt Contact: malvuln13 () gmail com Media: twitter.com/malvuln Backup media: infosec.exchange/@malvuln Threat: Backdoor.Win32.Serman.a Vulnerability: Unauthenticated Open Proxy Family: Serman Type: PE32 MD5: f312e3a436995b86b205a1a37b1bf10f Vuln ID: MVID-2022-0659 Disclosure: 11/22/2022 Description: The...
  • Open-Xchange Security Advisory 2022-11-24 November 29, 2022
    Posted by Martin Heiland via Fulldisclosure on Nov 29Dear subscribers, we're sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX AppSuite, Dovecot and PowerDNS at HackerOne and soon at YesWeHack. Yours sincerely, Martin Heiland, Open-Xchange […]
  • [CVE-2022-33942] Intel Data Center Manager Console <= 4.1.1.45749 ”UserMgmtHandler" Authentication Logic Error Leading to Authentication Bypass November 29, 2022
    Posted by Julien Ahrens (RCE Security) on Nov 29RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Intel Data Center Manager Vendor URL: https://www.intel.com/content/www/us/en/developer/tools/data-center-manager-console/overview.html Type: Authentication Bypass by Spoofing [CWE-290] Date found: 2022-06-01 Date published: 2022-11-23 CVSSv3 Score: 10.0 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) CVE:...
  • crashing potplayer again November 29, 2022
    Posted by houjingyi on Nov 29I disclosured a crash in potplayer last year : https://seclists.org/fulldisclosure/2021/Mar/76 And I found a new one this year, this time is a mid file. Again I contacted Korea Internet & Security Agency(first-team () krcert or kr), they shared report to the onwer of the potplayer, Kakao Corp as they said. […]

Customers

Newsletter