Symtrex Inc.

Cyber Security Specialist

Call - 866-431-8972 | Send an Email | Request a Quote
Visit Us On FacebookVisit Us On TwitterVisit Us On Linkedin

Profile

Ransomware – fail to prepare, prepare to fail

by

When it comes to falling victim to a ransomware attack, it’s not a case of ‘if’ but ‘when’.

By Matt Body – IT ProPortal

Ransomware has been growing in awareness for years, and its potential harm and disruption has been widely discussed across the board. However, last year, awareness peaked as ransomware caused havoc for organisations, as threats like WannaCry and NotPetya found them to be defenceless and vulnerable. In spite of attacks happening again and again, many organisations are still not able to effectively defend against them.

Recent research from Sophos, which looked at The State of Endpoint Security Today, revealed the extent to which organisation are unprepared for ransomware attacks. Findings revealed that the defence readiness and end-point security from organisations needs a lot of work – over half of organisations (54%) were hit by ransomware in the past year, and the average cost of an attack was $133,000.

When it comes to IT security, the usual consensus is that once an organisation encounters a specific threat, they learn from it, shore up their defences, and are then better prepared for the next attack. However, the research revealed that with ransomware, this approach doesn’t work as respondents said they were hit by ransomware multiple times, and expect that they’ll fall victim to it again in the future.

With ransomware, it is clear that no organisation can afford to be complacent. Cybercriminals are deploying a variety of different attack methods until they’re successful, whether using a mix of ransomware in a single campaign or taking advantage of a remote access opportunity, then infecting the server and disabling security software. With attacks only becoming more frequent and complex, it is time for organisations to prepare and protect, and avoid falling victim to the next attack.

Don’t be fooled – Ransomware needs to be treated differently

After a ransomware attack, we usually find ourselves pointing the finger at the breached organisation –  were there defenses in place? Were systems up to date? Were patches in place? However, once again this is not always the case when it comes to ransomware, as over three quarters of respondents said that they were running up-to-date software when ransomware hit.

Therefore, it is clear that traditional endpoint protection alone cannot and does not stop the latest in ransomware attacks.

Given the ingenuity, frequency and financial impact of attacks, all businesses should re-evaluate their security to include predictive security technology that has the capabilities needed to combat ransomware and other costly cyber threats.

Knowledge is key

Seeing as not all anti-ransomware technology offers equally effective protection against attacks, many organisations may find themselves investing in technologies which offer little protection when the attacks occur. And it seems the knowledge gap widens from here, as the research revealed that less than one in three respondents were able to correctly define what anti-ransomware and anti-exploit technologies do.

With this many professionals having this level of understanding, a significant number of organisations may believe that they are adequately protected against the ransomware threat, but are not. Therefore, it’s important that organisations do their research and ensure that they have the right level of protection in place.

Deep learning

The key to being protected against ransomware can be found by changing from a traditional security methodology which can only stop previously seen before threats to a predictive one.

Over the years, traditional approaches to security (i.e. anti-virus that use signatures) have focused on improving the time to stopping a threat by increasing the update increments.  Traditional security methods are very accurate and can spot and block seen before malicious software within as little as an hour after the first report.  Since we’re now seeing as much as 400,000 different malicious files a day it’s very difficult to keep up with the ever changing threat landscape using this traditional technology.  Machine learning now plays a crucial part in tackling this issue by predicting what a malicious file looks like.

Machine learning ‘learns’ using mathematical models instead of being specifically programmed to address a particular problem. Deep learning is the latest evolution of machine learning.  In the context of stopping malware, a deep learning engine is trained on hundreds of millions of previously seen before malicious and non-malicious files.  Using the features of these files, it then looks for correlations and similarities in the malicious vs non-malicious files.  By doing this grouping of similarities the deep learning engine is then able to accurately sort files into two buckets, malicious and not malicious with the anti-virus left to quarantine accordingly.  By using deep learning, you’re not just stopping a previously seen bad file, you’re stopping ones which have never been seen before as well.

Although 60 percent of respondents admitted their endpoint defenses are not enough to block the huge ransomware attacks we saw last year, only 25 percent have predictive threat technologies such as machine learning or deep learning, which leaves 75 percent vulnerable to repeated ransomware attacks.

Given the speed at which cyber threats have evolved it is not surprising that many IT departments are unable to stay ahead of the next-generation technology required for security. Yet this knowledge gap could be placing operations at risk. Organisations need effective anti-ransomware, anti-exploit, and deep learning technology to stay secure.

You’re not alone

To many organisations, the urgency and complexity of protecting against ransomware and cyber attacks in general may seem daunting. In fact, 87 percent of respondents said that the malware threat had grown more complex in the last year. In order to effectively stop ransomware in its tracks, traditional endpoint security isn’t enough.

Organisations need the strongest defense against these persistent threats, and so need to explore, learn, and adopt anti-exploit and anti-ransomware technologies in order to be fully prepared against future attacks – it’s not a case of ‘if’, but ‘when’.

New Sleeper Strain of SamSam Ransomware Bypasses AV And Stays Hidden On Your Network

by

From KnowBe4

The ransomware strain that crippled several cities and school districts in the U.S. earlier this year is back with more tricks up its sleeve to avoid detection.

If you haven’t heard of SamSam, you haven’t been paying attention. Just one example of the kind of destruction they can cause is the recent attack on the Colorado Department of Transportation which caused downtime for 2,000+ systems.

This new SamSam strain adds a human element to its already devious mix of evasive techniques to keep antivirus, endpoint, and even more advanced security software from detecting it.

SamSam avoids being discovered using sophisticated methods of constructing its payload and how it executes. In a recent blog, endpoint protection company Malwarebytes provides a detailed technical explanation of how this new variant of SamSam works.

Your Executive Summary

Your executive summary is this SamSam strain avoids detection using three advanced techniques:

  • It decrypts the payload only at run-time, making it nearly impossible to identify and analyze.
  • The loader, payload, and logs are wiped, leaving very few traces behind for any forensics or scanning tools.
  • It requires a password to be entered by the threat actor to run in the first place.

It’s that last part of the attack that makes this latest strain so dangerous. Unlike most ransomware strains which are designed to spread automatically, this new strain of SamSam is designed for targeted attacks.

By requiring a password, the payload remains encrypted (and, therefore, an absolute secret), only woken up when and where the bad guys choose to unleash it in your network, all at the same moment to create the biggest impact and damage.

Do You Want The Good News Or The Bad News?

The good news is that, should users accidentally download this strain of ransomware, or your network is compromised via an RDP brute-force attack, the payload is harmless without the password to run it. The bad news is, should the SamSam gang decide that your organization is next up to be extorted, all your users will be sitting on their hands for possibly weeks if your backups fail.

Read full Article ->

Almost all business report being hit with an email-borne attack, survey

by

The almost total pervasiveness of phishing scams and other email-based attacks can be seen in a recent survey that found almost 90 percent of the cybersecurity executives saying their company was hit with an attempted or successful email-based cyberattack in the last year.

By Doug Olenick, SC Media US

The Barracuda survey found employers are experiencing more email attacks with 81 percent seeing an increase in the last year, and 25 percent of those describing the increase as being dramatic. This is leading to the cost of mitigating costs with 81 percent seeing a jump in cost with 22 percent describing the price rising dramatically.

The price that must be paid in the wake of an attack is not just monetary. Sixty-seven percent of those surveyed said an email incident forced their IT team to divert needed resources from other priorities to deal with an attack; employee productivity was interrupted said 61 percent and 10 percent reported that their firm’s reputation took a hit.

Having sensitive corporate information stolen was judged to be the most costly kind of attack, followed by ransomware and business email compromise. When it came to recovering from a ransomware attack 12 percent of the companies decided their only option was to pay the ransom with the remaining 88 percent declining to do so. Interestingly, enterprise-size businesses were more likely to pay compared to small and medium-size operations.

“Based on how pervasive ransomware attacks have become, along with the accompanying media coverage, it’s somewhat surprising to see such a small percentage of companies paying. Perhaps it’s actually a glimmer of hope: maybe organizations had comprehensive backup solutions in place and were able to rapidly recover critical data without paying,” the report stated.

Thirty-five percent of the surveyed executives said their firm had been hit with a ransomware attack in the last year with 75 percent of those individual saying the malware was delivered via email, 32 percent from the web and 23 percent through network traffic.

Read the complete article ->

Banking Trojans replaced Ransomware as top email-based payload in Q1

by

The concept of infecting targeted users with banking trojans has been so successful in the recent past that in the first quarter of 2018, banking trojans overtook ransomware as the top malicious payload distributed through email.

By Jay Jay – SC Media UK

The concept of infecting targeted users with banking trojans has been so successful in the recent past that in the first quarter of 2018, banking trojans overtook ransomware as the top malicious payload distributed through email.
In all, banking trojans accounted for 59 percent of all malicious email payloads in the first quarter of 2018 which also saw email-based malware attacks rise significantly. A new report from Proofpoint has shown that the number of firms receiving more than 50 email-based malware attacks grew by 20 percent compared to in the last quarter of 2017.
Aside from injecting banking trojans that are designed to obtain confidential information about customers and clients using online banking and payment systems, hackers are also distributing information stealers, downloaders, remote access Trojans (RATS), and other banking malware via emails to steal credentials and to use them to commit fraud or theft.
Cyber-criminals are also leveraging sophisticated malware that are adept at defeating a majority of anti-malware protections installed on targeted systems. For example, Emotet, a polymorphic malware that has the ability to evade over 75 percent of antivirus engines, has been used in 57 percent of all banking malware attacks and 33 percent of all malicious payloads in Q1.
“Trojans are effective because they exploit weaknesses on different levels. Fraudsters often bait unsuspecting users to click on links in emails that seem to be legitimate, which lead them to a fake website or to download a malicious app,” said Gerhard Oosthuizen, CTO at Entersekt to SC Magazine UK.
“These fakes can look frighteningly real, and the emails baiting users often mimic the bank’s official communications in design and tone. It makes it very hard for users to know when an email, the site they’re clicking through to, or the app they’re downloading, is legitimate.

Read Full Article – >

Cybercriminals are after your servers too

by

It’s not just your endpoints that need protecting…

Your servers hold your most critical data, your business applications and your highest privilege accounts, so protecting them is key to protecting your whole organization.

What if a server with order processing or patient health records was maliciously encrypted and held hostage for ransom? What if an organization’s domain controller was rendered unusable? Or what if an application server slowed to a crawl because attackers had managed to take advantage of an unpatched exploit to mine cryptocurrency?

If a laptop gets infected with ransomware, the user’s productivity is affected. But if a server is attacked and unavailable, the whole organization may be impacted. You don’t have to look further than last year’s WannaCry and NotPetya ransomware attacks to see examples of this.

Merck, the global pharmaceuticals company, Maersk, the global shipping and transportation company, and FedEx were all hugely financially impacted by the NotPetya attacks.

But it wasn’t just multinational corporations who fell victim. Smaller companies, such as Nuance Communications, were also attacked. The company recently disclosed its losses in a filing with the Securities and Exchange Commission (SEC).

Nuance was unable to get its software back online completely until early August, inhibiting its ability to offer SaaS transcription services for healthcare companies. The company also mentioned that a subsequent data breach in November had occurred when “an unauthorized third party illegally accessed reports hosted on a Nuance transcription platform.”

The company expects to incur additional costs this year when it enhances and upgrades its cybersecurity software, while still providing additional resources to its health companies.

The 2018 Verizon Data Breach Investigations Report notes how ransomware has increased in prevalence because it has been, and continues to be, an effective tool for cybercriminals.

To find out how to be part of the early access program for the Server Protection products by Sophos  – Contact us.