Interesting Article about Insured companies being more likely to be ransomware victims

While this headline certainly sounds like you shouldn't be getting the insurance or you will be targeted more it turns out that you really should be getting the insurance and adhering to the the recommendations for increasing your security stance. We like Sophos's MDR Complete product for a more robust product for this purpose for both your workstations and your servers. When you add in some of our other tools that we recommend your protection increases considerably because of the multilevel approach we design.

Training is another key component of protection. Awareness and recognition of potential threats will go a long way to preventing malware issues. There was a time when we were asked why do people create malware but when combined as a ransomeware product the reason is plain and simple, for money! Because of the increase of company's security initiatives, there has been a significant decrease in the payment of ransoms from 85% at the beginning of 2019 to 45% in the first quarter of 2023. Companies are listening and implementing the proper backups and blocks to ransomware that seem to be helping with the need to pay out as often as they did before.

I would suggest taking a look at this article to give you more insight into the protection and insurance levels you should be considering and talk to our security design experts to work with you on developing the proper package for you.

Ransomware Attacks: How Sophos CIXA MDR Can Help You Stay Secure

Ransomware attacks are one of the most serious threats to businesses today. They can cripple your operations, damage your reputation, and cost you a fortune in ransom payments and recovery expenses. According to a recent report by Sophos, the average ransom paid by organizations in 2020 was $170,404, and the total recovery cost was $1.85 million.

To protect yourself from ransomware attacks, you need more than just antivirus software or firewalls. You need a comprehensive solution that can detect, respond, and recover from these sophisticated attacks. That's why PAconnect recommends Sophos CIXA MDR (Managed Detection and Response) to our clients.

Sophos CIXA MDR is a cloud-based service that combines advanced endpoint protection, threat intelligence, and 24/7 expert monitoring and response. It leverages artificial intelligence and machine learning to identify and stop ransomware attacks before they can encrypt your data or spread to other devices. It also provides you with a dedicated team of security experts who can help you contain, investigate, and remediate any incidents.

With Sophos CIXA MDR, you can benefit from:

 Enhanced visibility and control over your endpoints

• Reduced risk of data loss and downtime
• Improved compliance and regulatory requirements
• Lower total cost of ownership and operational complexity

 If you want to learn more about how Sophos CIXA MDR can help you protect your business from ransomware attacks, contact PAconnect today. We are a certified Sophos partner with years of experience in delivering IT solutions and services to our clients. We can help you assess your security needs, implement Sophos CIXA MDR, and provide ongoing support and guidance.

Don't let ransomware attacks ruin your business. Trust PAconnect and Sophos CIXA MDR to keep you secure.

Ransomware on the Rise

A CSO article suggests that cyberattack tactics rise up as ransomeware payouts increase. The author goes on to describe the different modes of attack and what to look out for. Worth a read!

Senior Care Providers Scramble After $14M Ransomware Attack Hits Tech Firm VCPI

Heath firms are seeing themselves as the big-ticket target more and more these days. A week ago, we saw a report of another Health Care Provider being attacked with ransomware for the tune of $14M in BitCoin to unlock their encrypted data.

For more information Click Here to see the article. But if this scares you, and it should, call us to see if you are protected from this sort of attack, and if not how we can help you stave off this type of attack!

Breaking news: here’s what we know about what could be the latest ‘Petya’ ransomware outbreak

Naked Security just posted a breaking news item on their site that they will be updating as they hear back from Sophos Labs.

A significant ransomware attack is spreading across Europe, Russia, Ukraine and elsewhere. Sophos is investigating the attack and will continue to provide updates here throughout the day.

https://nakedsecurity.sophos.com/2017/06/27/breaking-news-what-we-know-about-the-global-ransomware-outbreak/

Analysis: The Shame of Ransomware

Worth a read

Ransomware: What to do?

What to do?

Here are some links we think you’ll find useful:

• To defend against ransomware in general, see our article How to stay protected against ransomware.
• To protect against JavaScript attachments, tell Explorer to open .JS files with Notepad.
• To protect against misleading filenames, tell Explorer to show file extensions.
• To protect against VBA malware, tell Office not to allow macros in documents from the internet.
• To learn more about ransomware, listen to our Techknow podcast.

Eight years’ worth of police evidence wiped out in ransomware attack

Ransomeware is such a big problem these days causing havoc wherever it can. In this Naked Security article Sophos discusses how a Texas police force lost a year's worth of digital evidence by getting hit by ransom ware attack in December and refusing to pay the ransom. In their attempt to clean up the systems that were infected they wiped out data that they had no backups for. This digital evidence is gone forever. Had they had in place a backup system set up for disaster recovery, and/or security measures like Sophos’s Intercept X, Sophos Central Server Advanced Protection, Sophos Central EndPoint Advanced Protection they would have had a good chance of not losing anything. That wasn’t the case!

See more information on why this happened.

Ransomware that demands money and gives you back… nothing! – Naked Security

• nakedsecurity.sophos.com
• View Original
• July 13th, 2016

Ransomware isn’t a laughing matter, especially if you’re the victim.

Even if you don’t lose any data in the attack, it’s a bit like getting mugged by crooks who end up running off without your wallet.

If ransomeware by itself wasn’t scary enough!

read more

Huge uptick in Zepto ransomware spam, warn researchers

Security researchers have raised concerns that attackers are gearing up for a massive Locky-related ransomware campaign Ransomware that locks up business critical data and demands payment to release it continues to increase in popularity with cyber criminals, and a fresh campaign is underway, warn researchers. There has been a huge increase in the number of spam messages designed to infect unwary recipients’ computers with the Zepto ransomware, according to Cisco’s Talos security intelligence and research group. Zepto is a variant of Locky, which was one of the most widespread ransomware attacks in the first quarter of 2016, affecting organisations in 114 countries. Security researchers are keeping a close watch on Zepto and trying to find out as much as they can because of its close ties with Locky, its professional build and the fact that there is still no known method of decrypting the information. Talos reseachers are particularly concerned that Zepto will move into exploit kits and that attackers will move on from spam to other distribution methods, such as malvertising, according to ThreatPost. Zepto shares several technical similarities with Locky, including the use of similar RSA encryption keys and file types to infect systems. In May 2016, security researchers at Kasperky Lab and FireEye identified ransomware as the top threat to business. In April 2016, Eset reported that ransomware accounted for around a quarter of cyber threats targeting internet users in the UK. Talos researchers report that a fresh Zepto spam campaign started on 27 June 2016, with 137,731 spam messages carrying the ransomware recorded in the first four days. All use a compressed .zip archive which included a malicious javascript file used to infect the recipients computer with the Zepto ransomware. All the javascript files name start with “swift” and are followed by a set of hexadecimal characters. The spam messages use various subject lines, such as “document copies”, and various sender profiles, such as “CEO”, to encourage recipients to open the message and execute the malicious javascript. The body of the emails generally urge the recipient to look at their “requested” documentation, while the name of the attached .zip file is created by combining the recipient’s name and a random number such as pdf_copy-peter_461397. The malicious javascript uses ‘wscript.exe’ to launch HTTP GET requests to the defined command and control (C&C) domains, with some samples initiating connectivity to a single domain, while others connected to up to nine domains. Once the binary is downloaded and executed, the machine begins a process of encrypting the local files and then demands ransom in Bitcoin to decrypt the files. ---------------------------------------------------------------------------------------------- From Jude Daigle. We are receiving calls almost daily from customers getting hit with ransomware! It is not about IF you will get hit with this It's WHEN, and will you be prepared or will your organization be CRIPPLED. This is not just about having Anti Virus installed this is Ransomware and you may pay $500 or more just to release your files! Are you prepared? If you are not sure call Jude or Bob 724-838-7526 or email me at jdaigle@paconnect.com

789 East Pittsburgh Street - Greensburg, PA  15601 Call: 724-838-7526

Ransomware that’s 100% pure JavaScript, no download required

SophosLabs just alerted us to an intriguing new ransomware sample dubbed RAA.

This one is blocked by Sophos as JS/Ransom-DDL, and even though it’s not widespread, it’s an interesting development in the ransomware scene.

Here’s why.

Ransomware, like any sort of malware, can get into your organisation in many different ways: buried inside email attachments, via poisoned websites, through exploit kits, on infected USB devices and occasionally even as part of a self-spreading network worm.

But email attachments seem to work best for the cybercrooks, with fake invoices and made-up court cases amongst the topics used by the criminals to make you think you’d better open the attachment, just in case.

In 2015, most ransomware arrived in Word documents containing what are known as macros: script programs that can be embedded in documents to adapt their content in real time, usually as part of your company’s workflow.

The problem with macros, however, is that they aren’t limited to adapting and modifying just the document that contains them.

Macros can be full-blown programs as powerful as any standalone application, and they can not only read and write files on your C: drive and your local network, but also download and run other files from the internet.

In other words, once you authorize a macro to run, you effectively authorize it to install and launch any other software it likes, including malware, without popping up any further warnings or download dialogs.

You can see why cybercrooks love macros!

Click here to read more…

Should you pay to get your data back after a Ransomware Attack?

Here is an interesting discussion about whether it is ever ok to pay of the Ransomware Hackers. The discussion revolves around whether it is just an incentive to be attacked again. With all the recent news about Medical and Financial Institutions being attacked this is something that you may want to consider or prepare for.

Petya Ransomware

Follow this article from Arstechnica about a new Ransomware attack being found primarily in Germany, but I'm sure we will be seeing instances of it here soon. Take a look at the full article here! 

CryptoWall ransomware cost US victims at least $18 million, FBI says

by John Zorabedian on June 25, 2015

Malware that encrypts all of a victim's files and holds them for ransom - what's commonly called crypto-ransomware or cryptoware - continues to be hugely successful in making money for the criminal gangs who perpetuate it.

According to a public service announcement from the FBI's Internet Crime Complaint Center (IC3), the CryptoWall variant of crypto-ransomware cost US businesses and consumers at least $18 million between April 2014 and June 2015.

That figure is based on complaints from 992 CryptoWall victims, and includes related damages such as the cost of network mitigation, loss of productivity, legal fees, IT services and credit monitoring services.

It's not clear how much of the $18 million was paid out in ransom fees to the CryptoWall criminals, but the FBI said that the ransom demanded typically ranged from $200 to $10,000.

The FBI called CryptoWall the "most current and significant ransomware threat" in the US.

Although the FBI's report of financial damages caused by CryptoWall is significant, it's likely those figures represent only a tiny minority of the cost to victims worldwide.

It's difficult to determine the exact number of crypto-ransomware victims, in part because many businesses caught in the ransomware trap don't want to come out and say so (public sector organizations like police departmentshaven't had the same luxury).

Equally hard is figuring out how much money the crooks have hauled in from their ransomware enterprises.

What we do know is that crypto-ransomware is highly effective, and lucrative enough for criminals to keep coming up with new forms of it - one survey found that 3% of UK citizens had been victims, and 40% of those had paid the ransom.

CryptoWall's predecessor, CryptoLocker, was extremely successful - the crew behind CryptoLocker raked in an estimated $27 million in the first two months after it was unleashed in September 2013.

Although CryptoLocker was fatally damaged by a law enforcement take-down of its server infrastructure in May 2014, cybercriminals soon began spreading other dangerous forms of ransomware based on CryptoLocker's successful model.

We began seeing CryptoWall in April 2014, along with another similar variant called CryptoDefense.

Since then, other copycats have emerged that have proved to be just as dangerous, some even borrowing the CryptoLocker name.

Recently we even saw crypto-ransomware that borrowed themes and imagery from the popular television series "Breaking Bad."

The crooks have figured out some fiendish ways to get people to pay up: by making their illicit software "consumer-friendly" with easy-to-follow instructions on how to pay with bitcoins or other forms of untraceable e-payment, and offering "user support."

Crypto-ransomware crooks have also figured out that they can earn their victim's trust (more or less) by offering to decrypt one file for "free" - so you'll know the crooks will follow through on their promise to decrypt the rest of your files once you pay them.

If the crooks have implemented the encryption process properly - and they often have - you're left with a choice of losing your files, or paying for a copy of the decryption key.

It presents an ethical dilemma - one which Sophos security expert and fellow Naked Security writer Paul Ducklin captured well in his excellent post "Ransomware - should you pay?"

His spot-on and simple advice is summed up here:

1. Don't pay if you can possibly avoid it, even if it means some personal hassle.
2. Take precautions today (e.g., backups, proactive anti-virus, web and email filtering) so that you avoid getting into a position where you ever need to pay.