Sophisticated and destructive cyberattacks show no sign of subsiding in 2024. Is your company equipped if you get hit with an attack tomorrow?

Bad actors that deploy ransomware are indiscriminate to your company’s size, vertical, or infrastructure. In 2023, 85% of companies experienced at least one ransomware attack. Variants like “snake ransomware” sneak their way into your network, access machines with administrator credentials, encrypt your data while nearly undetectable, and lie dormant until the perpetrators make their demands. Unfortunately, in 2024, it’s not a matter of “if” your organization suffers a ransomware attack, but “when”. Don’t allow yourself to be a victim of circumstance, there are ways to mitigate ransomware attacks.

Preparing your employees, infrastructure, and organization can drastically decrease the risk and impact of a ransomware infection. A company’s first line of defense against malware attacks of any kind is the employees who interface with the network. Proactively training employees to be more educated about potential attack vectors and how to safely interact with company endpoints and networks is just as much an investment in organizational security as antivirus or firewalls. However, trained employees will never be entirely foolproof. That’s why it is recommended to have a disaster recovery plan that includes several recovery methods and is regularly tested. If ransomware sleuths into your infrastructure, a DR plan can help minimize the impact.

A disaster recovery plan’s solutions – such as disaster recovery as a service, emergency hosting, and elite technical support – can reduce recovery time objectives (RTO) and give nearly instant recovery point objectives (RPO) that can make a ransomware attack much less painful.

RenovoData was featured in the 3PL Perspectives publication with this article: “Fight Ransomware with Cyber Resiliency“. 3PL Perspectives is a third-party logistics magazine provided by the Transportation Intermediaries Association.

An excerpt is below:

“Transportation organizations are not only at a higher risk of fallout from ransomware due to their 24/7 uptime requirements, but studies also show that transportation is targeted more frequently than other industries…”

You can read the complete article, “Fight Ransomware with Cyber Resiliency“.

Don’t pay ransomware. Have a recovery plan.

Once ransomware infects a network, it contaminates all the data it accesses, including system files and backup storage. Attacks like this quickly become full-blown disasters that can take days to restore, days in which business activities can be brought to a standstill.

Most ransomware comes from North Korea, Iran, and Russia. Greed is usually less of a motivation than a desire to inflict damage and sow chaos. The goal of harming people and organizations outweighs the desire to steal money.

Ransom demands are intended to stoke panic. It’s a natural reaction since data is the life’s blood of organizations. The urge to pay can be powerful, but enriching the criminals invites more extortion, and you have no assurance that they will hand over the keys to decrypt your data. Before you’ve fully recovered, you may be hit by more infections from the same source, causing yet more data loss.

So don’t give in.

Ransomware: A Growth Industry

While most types of malware attacks are leveling off in frequency, ransomware is on the rise.

• A 2020 HELPNET study cites a 39% decline in malware along with a 40% surge in ransomware globally.
• Ransomware costs for 2020 are estimated to have reached $20 billion for organizations worldwide (Purplesec).
• DATTO determined that one in five SMBs fell victim to ransomware attacks in 2020.
• 51% of the businesses surveyed by Sophos were hit by ransomware in 2020.
• Kaspersky, along with other sources, found that about one-third of companies surrender to ransom demands and pay up.
• Kaspersky also discovered that 34% of businesses hit with malware took a week or more to regain access to their data.
• Microsoft reports that purveyors of ransomware are taking full advantage of the pandemic by sending COVID-19-related phishing emails.
• In a mid-2020 survey, SONICWALL saw a 176% increase in malicious Microsoft Office file types, a 50% rise in IoT malware attacks, and a 109% ransomware spike in the US

Protection is Crucial…

Without strong firewalls and server defenses, plus up-to-date anti-virus and malware protection installed on every PC and laptop connected to your network, your data is vulnerable to attack. Although servers incur the most damage, attacks usually come via PC workstations and laptops connected to the network. Some variants infect environments without clicking, by exploiting unpatched systems or weak security.

Essential Data Protection steps

• Always have a new-generation firewall in place.
• Know your security vulnerabilities.
• Establish company policies that bring all employees into the protection process.
• Educate employees about the risk of clicking on unknown links, since malware is commonly hidden in unverified email messages.
• Upgrade your security by installing the latest-generation endpoint protection software to stop viruses and malware at the PC / laptop level.
• Incorporate email filtering to block known viruses and malware.
• Consider a security monitoring service.
• Carefully evaluate your data backup solution and upgrade your tools accordingly.

Having a well-planned cybersecurity system is your first line of defense against all forms of malware, with ransomware at the top of the list.

Only robust disaster recovery can help you rebound quickly when ransomware breaches your defenses.

Malware developers are constantly creating new and more damaging ransomware. Even the best-defended system can be penetrated from time to time, and the ability to rapidly restore data and repair system damage is the only path to continuing operations and eliminating losses.

Follow our guidelines to develop a plan that identifies solutions and tools that are both thorough and cost-effective. Keep in mind that every organization’s disaster recovery needs are different.

Optimum disaster recovery coverage can appear costly, but not in comparison with the potential losses that significant downtime and system rebuilding bring on. The key to minimizing your downtime from natural or manmade disasters is your recovery solution. If you have a file backup solution but no protection for your server or PC operating systems now is the time to evaluate which computers and data sets are the most critical to your business and upgrade your protection to minimize your downtime.

The Logistics Journal ran an article, written by RenovoData. The article provides expert-level details on ransomware as a service (RaaS) and how it can affect 3PL and Trucking companies.

Excerpt:

Would-be extortionists can now order easy-to-implement ransomware kits on the Dark Web. Just over a decade ago, IT users began experiencing attacks of ransomware, and in the intervening years it has become the most widespread and damaging variety of malware, gaining international notoriety as a thread to individuals and organizations large and small. Ransomware enters systems through fake emails or other notifications, capturing data and holding it captive until a ransom is paid…
To view and read the whole article, please choose from the following options:

Read Article

New do-it-yourself cyber-extortion kits make it easy.

Since its invention in the mid-2000s, ransomware has become the world’s premier cyber-security threat. Typically gaining entry to a system via bogus emails or notifications, this malware enables criminals to capture a system’s data and demand payment for its release.

Now Ransomware has a new distribution model: Ransomware as a Service.

Extortion software is for sale as an end-to-end service, just like a conventional business product. Even the rankest IT amateur can go to the Dark Web and obtain kits for building effective ransomware. With little skill, effort or expense, one crook can target thousands of individuals and businesses.

These turnkey RaaS kits are available for little or no up-front fee, with payments made as percentages of the extorted proceeds. Some RaaS developers have built significant name recognition for their products while others offer blandly generic software that can be easily customized and branded.

The proliferation of ransomware has been explosive.

A prime example is the infamous CryptoLocker, which first appeared in 2013. Relying on encryption as a central element, CryptoLocker soon became the most feared breed of ransomware. Variations immediately sprang up, under such names as Xorist, CryptoBit, CryptoDefense, Cryptowall and more.

Crypto crooks soon became the target of operations by the FBI and international law enforcement agencies. These efforts have met with considerable success, but the fight goes on. Ransomware keeps popping up in new and increasingly diabolical forms like a larcenous game of Whac-A-Mole.

This kind of proliferation paved the way for the booming outlaw industry that produced RaaS.

The most notorious current RaaS threat is aptly named Satan. Complex and sophisticated, Satan is packed with code designed to stymie malware detection and removal software. As new protective tools are developed, Satan’s masterminds respond with new blockers. Their product even comes with detailed instructions in the arts of online theft.

Satan has a legion of imitators, many of which have their own business models. Differentiation enables hackers to create ransomware targeted at specific industries and companies. Some versions require an up-front fee, with the percentage of ransom required ranging from 5% to 30% and higher. At least one product is actually a ransomware-blocking package that was pirated and altered for unlawful use.

Certain ransomware vendors also sell other kinds of malware that can be combined with ransomware to perform even more kinds of mischief.

Ransomware never stops evolving, and new strains continue to appear. Law enforcement agencies worldwide are fighting the ransomware epidemic every day, but as with any organized criminal enterprise, the war goes on.

Solid system security will always be the first line of defense against ransomware. Like Dracula, malware that penetrates systems via emails and other kinds of messaging can’t enter without being invited in, so everyone who uses a system should know not to open unsolicited or unknown messages or email attachments.

Pop-up warnings can be enticing, along the lines of, “IMPORTANT! Microsoft has detected a serious problem with your browser! Click here within 30 seconds or your computer will explode!”

Once wise and cautious user practices are in place, you need to establish solid data backup and recovery programs.

Begin with familiarizing yourself with the essentials of dealing with ransomware, so you’ll know what to do in case of an attack and you can establish a robust defense.

The key data protection tool is cloud backup, which allows you to always maintain malware-proof copies of all your data. Be aware that although cloud backup has found virtually universal acceptance, there is a lot of misinformation on the subject.

A reliable disaster recovery program begins with a plan. While developing a plan, it is important to keep in mind that while there are many solutions available, vendors are not all alike, and every company should be careful in choosing the right disaster recovery tools.

These are a few highlights from our extensive data protection blog. Take a few moments to identify topics that may be useful as you consider your current strategies and tools.

RenovoData again was featured in the leading publication of the Transport Intermediaries Association, The Logistics Journal. The article, written by our own Chuck Cook, provides critical and detailed information on the immense risk that all 3PL and trucking companies face: Ransomware.

Excerpt:

Ransomware is a particularly vicious kind of malware that has existed for several years. Recently, both the number and sophistication of ransomware attacks are escalating. Not only does ransomware capture information and wreak havoc with IT systems, it also steals the victim’s money through cyber-extortion. Hackers are able to break into a system, encrypt the data it contains to prevent its use, and then demand payment to release the data.

Read PDF

A sophisticated new generation of ransomware is rolling across North America. It doesn’t just steal your information and wreak havoc with your IT systems. It steals your money.

Several versions of ransomware are at large. They go by different names, such as Crypto locker, Crypto wall and others. They usually propagate as Trojans, entering networks via innocent-looking links in emails or innocuous messages from unknown websites.

Without up-to-date anti-virus and malware protection installed on every PC and laptop connected to your network, you are vulnerable to attack.

Although servers incur the most damage, attacks usually come via PC workstations and laptops connected to the network. Some variants infect environments without clicking, by exploiting unpatched systems or insufficient security.

Once ransomware infects a network, it encrypts any and all data that it has permission to access, including system files and backup storage.

The demand.

A ransom attack can quickly become a data disaster that takes days to remediate and restore. When an infection takes hold, a window may pop up or a folder labeled “decrypt help” may be created, saying that the files will be returned if you pay a ransom.

Don’t give in.

Paying the criminals invites more extortion, and you have no assurance that they will hand over the keys to decrypt your data. Before you’ve fully recovered, you may be hit by more infections, causing yet more data loss.

Here’s how to guard against ransomware:

1. Establish a company policy.

• Educate employees about the risk of clicking on unknown links. This is imperative for avoiding ransomware attacks, but it is only part of the picture.
• Malware links are usually hidden in unverified email messages. Prohibit users from clicking links from any unknown source unless authorized by a manager or your IT department.

2. Upgrade your security.

• Install the latest-generation endpoint protection software to stop viruses and malware at the PC / laptop level before infection occurs.
• Incorporate an email filtering solution to block known viruses and malware before users have a chance to click on them.
• Always have a new-generation firewall in place.
• Consider a security monitoring service.

3. Upgrade your backup tools.

• Evaluate your data backup solution. Do you have multiple version rollback capability?
• In addition to Data Backup, you need a Server Recovery Solution that captures a snapshot of the entire server image for rapid server recovery. As some malware corrupts the OS files.
• For organizations with no tolerance for downtime, consider a DRaaS Solution to recover in minutes.

4. Check your backup emails.

• Each morning, someone at your company should get an email notification from your backup system. If the email contains an error message, forward it to your vendor for verification.  Error messages can help identify file system problems caused by malware.

The objective of ransomware is simple: using invasive encryption to extort money by holding an organization’s network and data hostage. But ransomware technology is far from simple, and it can inflict severe damage on businesses and institutions of any size.

Your best strategy?

Be sure that your network is well-protected before the vandals have broken down your gates. If they strike before you’ve hardened your defenses, you can take steps to minimize the damage while you make repairs.

• Don’t pay the ransom. If you do, the crooks have no incentive to let you off the hook. You have shown that you will give in to threats, so you can expect more demands, with no guarantee of a good outcome. Even if the hackers are satisfied with one payment, they can attack again.
• If you can, find out which strain of ransomware you’re up against. Hackers work constantly to counter the latest safeguards, so it’s worth the effort to find accurate information about your particular intrusion.
• Isolate the infected systems. Removing the infected machine(s) from your network may leave you temporarily hobbled, but the threat will be contained and you can get to work on removing the malware.

To prevent attacks, take decisive measures to protect your network and your data. If you have anti-malware defenses installed, you may want to check them for vulnerabilities.

• If yours is a small business, set up a scale-appropriate data protection process.
• Whatever your organization’s size, create a disaster plan.
• Be sure that your security solutions cover every aspect of your network and workstations.
• Look at potential single points of failure.
• Guard against endpoint penetration.

The proliferation of network-integrated smartphones and tablets provides convenient back-door entry opportunities for hackers. Endpoint devices may not be as well-protected as their vendors claim.

Ransomware usually enters a network through innocent-seeming emails, so your users and employees should be part of your defense process.

• Take steps to make your web browsers safe.
• Educate your users and employees about malware and what can be done to block threats.
• Be careful in granting users access to vulnerable areas. If an infection strikes a user’s workstation, it may penetrate network areas that the user has permission to enter.

Take advantage of powerful defensive tools.

• Protect your email. Conventional password protection is not enough.
• Malware can invade your network invisibly via email, but a solid authentication system makes it easier to see.
• Back up the data on all your servers and workstations using the strongest and most reliable tools. If you don’t already have well-protected backup software in place, be sure to routinely copy your data to removable storage.
• The key to lowering hacker-driven downtime is DRaaS
• Look at best practices that promote redundancy
• Cloud backup is the key component of effective data protection.
• But be aware that cloud backup systems are not alike. If you have cloud backup in place, it may be time to reevaluate it.

These are some of the basics. To discuss best practices that promote redundancy and protection of your company’s infrastructure contact us below.

Back in February 2016, it was reported that Hollywood Presbyterian Hospital had become the latest high-profile victim of a cyber-attack. Hackers had gained control of the hospital’s network and encrypted all patient records. Doctors and staff were also prevented from utilizing their email applications and had to rely on instead upon fax, phone or face-to-face communication. While hospital representatives stated that the quality of patient care had not been affected, others voiced their frustration over the inability to access health records and test results in the timely manner to which our modern healthcare industry has become accustomed.

The method of attack in this case was a form of Ransomware. Ransomware has existed for several years, with the number of attacks escalating yearly. Recently, hackers have shifted their focus away from individuals to large corporations. Why? If an individual is willing to pay $300 in bitcoins to recover their data, then surely a large company would be able to pay out much, much more. In the case of Hollywood Presbyterian, it was initially reported that hackers were seeking $3.4 million dollars worth of bitcoins. The actual amount paid, $17,000, was considerably lower, but still illustrates a perilous precedent.

In truth, any company can be a victim of a ransomware attack.  All it takes is a seemingly harmless or everyday email with an attachment.  At first glance, everything appears normal but it is actually carrying an executable program that in turn encrypts files and the only way to get the key to unlock the encryption is to pay the ransom. This is likely why hospital officials considered the attack to be random rather than malicious.

So, what can corporations and institutions do to safeguard against these kinds of attacks? One of the first lines of defense is the authentication system. By moving towards risk-based profile authentication or layering authentications, companies can make it harder for a hacker to go unnoticed. Other recommendations include backing up corporate data, taking advantage of cloud storage and redundancy, plus keeping antivirus and anti-malware software up-to-date.

New Breeds of Ransomware…

Last year, the FBI in the United States, and other authorities worldwide, took down the infrastructure used to distribute CryptoLocker—thereby disrupting the effectiveness of the malware. Soon after, new breeds of ransomware were born.

This time, the targets now range from grandmother’s family photos stored on the hard drive to smartphones and database backups. The latest incarnations of ransomware, such as CTB-Locker or Critroni are delivered via spam messages with a variety of lures to get people to click a link.

For example, the Malwarebytes blog recently detailed a spam message posing as Google Security Center warning users that their version of Chrome could be vulnerable. When users click the link they become infected with the ransomware.

Again, we’re not talking about a suspicious attachment that most users know to stay away from. That’s what makes it so easy to spread. For example, another batch of fake emails claimed to be from the IRS. And the list goes on… The latest round of ransomware, targeting individuals, companies, and smartphones has a reported average ransom of 2 Bitcoins, which is approximately $500 USD.

This can be devastating to some, of course. However, paying the ransom does not even guarantee that users will regain access to their files. So what should you do? Back up your data. Take advantage of cloud storage. Keep your antivirus and antimalware software up-to-date.

With respect to smartphones and tablets, we have the following suggestions:

• Protect your phone with a passcode.
• Use virus protection software.
• Be careful what you download and where you download it from. Download apps through an official app store and always read reviews.
• Keep your security software current on all devices.
• Be careful when using public Wi-Fi. Need to look something up on Yelp!? Ok. Check sale prices at your local grocery store? No problem. Do your banking or your taxes while sipping in a latte in the downtown café? Don’t even think about it.

Again, awareness and good safety practices can go a long way in protecting your data from a ransomware attack. We’ll have more to say about ransomware in the coming weeks. If you have a question about protecting your company’s data from threats such as ransomware, feel free to send us an email or give RenovoData a call!