In 2016 we saw more than 4,000 ransomware attacks every day, an unwanted statistical first. This was a 300% increase over 2015, when there were 1,000 attacks every day, and without doubt it’s going to get worse in 2017.
In the first quarter of 2016, cyber criminals used ransomware to steal £120 million from UK business (and $209 million from US businesses) and with an expected £675,00,000 (or US $1B) for the entire year – undoubtedly these are low estimates as we certainly do not know about many of the incidents which are contained and managed internally. Crypto ransomware has grown in popularity since it started with Cryptolocker in 2013, and we can expect to see increasingly sophisticated ransomware as cyber criminals try to make money in 2017.
Ransomware: No Skills Required
When ransomware first came out, it required some skill in order to create an attack. Now, with the growth of ransomware as a service (RaaS), it has become a business model that makes it easy for cyber criminals to attack without requiring technical knowledge of how to create ransomware.
To launch an attack on a group of victims, the cyber thief simply needs a credit card and a mailing list of targets that they want to attack. The user-friendly service allows criminals to download a ransomware tool for a small fee, set the ransom, and enter a deadline for the payment. For every victim that pays a ransom, the service provider gets a cut and the rest goes to the attacker. Some of the RaaS companies even provide training and support.
Ransomware Gets More Personal
“Ransomware is unique among cybercrime because in order for the attack to be successful, it requires the victim to become a willing accomplice after the fact.”
In the past, many ransomware attacks were blasted to huge lists in hopes that someone would open the email. You can expect more targeted, personalised attacks in 2017. With newer versions of ransomware, once it identifies whether it is attacking a business or personal machine, it will adapt its ransom demands to match the victim.
For example, it may choose different types of files to encrypt based upon whether it is a personal or business machine. In addition to encrypting these files, it may post your confidential data to social media or a file space if you don’t pay the ransom.
New Malware is already out there and building momentum!
Ransomworm: Ransomware That Spreads Across Your Network
In 2017, it’s likely to get worse as more ransomware is augmented with code from traditional network worms like SQL Slammer, CodeRed, and Conficker to create new ransomware that is able to spread across a network. This will effectively increase the amount of damage that can be done with ransomware.
Using this method, after infecting one computer, the malware will be able to spread to additional computers on the network. It will allow an initial machine to become infected, have a ransom paid, and then wait on other machines undetected until it is ready to attack again. This means you may end up paying ransoms multiple times to the same criminals.
Ransomworms that can infect multiple machines on a network already exist. A good example is ZCryptor. This malware does not require an email in order to infect machines. It takes advantage of attack vectors that were created by other malware and then self propagates to the network from the compromised machine.
SamSam is another example. It is spread via unpatched vulnerabilities on servers, allowing it to infect a machine and then go undetected, causing more damage on their internal network.
Preventing A Ransomware Attack
“Ransomware is more about manipulating vulnerabilities in human psychology than the adversary’s technological sophistication.” – James Scot
Becoming a victim of a ransomware attack can be time-consuming, costly, and damaging to a company’s reputation. Here at InstaDigital we engaged with 29 organisations in 2016 whom were directly attacked by ransomware, it has a major impact on organisations and their structure and even their personnel. Here are some or our tips to thwart the next ransomware attack:
Train and educate your users: Staggeringly, 11% of users will open an attachment from someone they don’t know. Infections are most often caused by end-users. They open an infected attachment or click on a link that takes them to an infected site. Are your IT guidelines and policies up to date? Do your team really know why those guidelines are in place?
Backup your data: There will never be a 100% guarantee that malware like ransomworm will not successfully infiltrate your network. Backing up your data and keeping it off site and disconnected from your network is the safest way to ensure you can recover after a ransomware attack.
Keep your software patches up-to-date: Once your users are trained to avoid opening email attachments or clicking on links, exploiting software flaws is another common way for malware to spread over your network. Keeping your software patches up to date will help prevent the spread of ransomworms that exploit a network or software flaws. Many companies simply do not know which patches are out of date, and lack the necessary knowledge to understand the risks associated with out of date systems.
Enforce the principle of least privilege: The principle of least privilege gives programs and users access to the programs they need, but no more. Combining least privilege management with application controls can allow you to revoke local administrator rights on workstations in many cases. This will minimise the spread of unwanted software. If you drop your security due to simply not wishing to upset your workforce – you will be attacked and your business will be endangered. Defend your data.
Use endpoint security software: Some people assume that if they keep security and software patches up-to-date and enforce least privilege, they will have things adequately locked down. This is not the case.
Don’t think you have to worry about security because of your company’s size? After all, only large companies are in the news saying they’ve been breached, right? Don’t fall victim to this ridiculous fallacy.
In many cases it can be a contractor or guest that opens an email that allows malware. How do you control this access on your network?
[icegram campaigns=”10107″]
Expect several new evolvements in malware threats in 2017 as cyber thieves try to increase their revenues by improving ransomware. Following our tips will help reduce the risk for your business but it really is time to ask the question – Is your business ready for the next new malware threat? Insta.Digital offer a free audit for all U.K. Organisations which pits your systems against ISO standards and all the latest data we have on new threats, isn’t it time you reviewed your cyber security before it’s too late?
Contact us for more information on our FREE Cyber Audit
