Having a clear understanding of what ransomware is and how it works can make the difference between a successful clean up and a disastrous mess. Taking the time to learn how it works is important, because it could help you protect your computer and keep your data safe from a devastating attack.
Enterprise ransomware
Using a comprehensive enterprise ransomware protection strategy can protect your business from data loss, lost revenue, and reputation damage. You can also minimize the impact of future attacks and minimize the cost of future restoration and recovery efforts.
Enterprise ransomware has been a growing problem for organizations in recent years. This type of attack requires expert intervention to fully understand the cause and remedy the issue.
A ransomware attack is initiated by a malicious attachment or link. The link could be in an email or software download. Once the attachment is opened, the malicious code is installed and the system is compromised.
The first step in preventing ransomware is to educate employees about the threat. They should also know the common entry points.
In many cases, a personal computer infected with malware can then infect network connected business machines. Then, a software application is installed on the victim’s computer and starts encrypting files. The ransomware displays a message that the files will not be recoverable unless the payment is made. This is usually a request to pay via bitcoin. However, the payment method may vary from country to country.
A common entry point for a ransomware attack is a system running remote access services (RAS). RAs are undermanaged assets that can be exploited silently.
In addition to the usual malware and virus attacks, enterprise ransomware attacks are more sophisticated. They use different methods of encrypting data. They also have obfuscation technologies that make it hard to reverse engineer the software.
Newer variants of ransomware have worm-like capabilities. These worms will encrypt files and demand payment via cryptocurrency. Some ransomware issuers will re-encrypt the data after the payment has been made.
Cryptomining malware
Using the computing power of victims’ devices, cryptomining malware mines cryptocurrencies like bitcoin. It performs complex mathematical calculations and adds blocks to the blockchain. It also serves as a vehicle for more sophisticated threats.
Detecting cryptomining malware is more difficult because it’s hidden in code. These programs can remain undetected for months or years. However, using ad-blockers and security software can help.
In the fourth quarter of 2018, the use of cryptocurrency mining malware increased 4,000%. The occurrence of cryptomining malware is expected to increase further.
It’s important to understand what it is, how it operates, and how to detect it. It’s also important to educate users about the risks of downloading files from unknown sources.
Detecting cryptomining malware involves using security software to identify malicious scripts. It’s also important to check for suspicious web page changes. The malware is often delivered through malicious landing pages and email attachments.
A malicious cryptomining script can be downloaded from a malicious website or web browser. It then runs in the background, using CPU or GPU power to mine cryptocurrencies. It’s a fairly common practice. It’s also important to remember that these types of malware can run on IoT devices, smartphones, and other devices.
Unlike ransomware, cryptomining malware does not explicitly steal data. It uses the CPU or GPU of the victim’s device to mine cryptocurrencies. But it can affect a business’ entire operations.
It’s important to monitor CPU and system speed to detect cryptomining malware. You can do this with the Task Manager or Activity Monitor.
To detect cryptomining malware, you may also need to install ad-blockers or security software. These programs can detect and block malicious cryptomining scripts.
Bad Rabbit
Initially targeting Russian corporate networks, the Bad Rabbit ransomware has spread to Ukraine, Poland and the Czech Republic, among other locales. It encrypts your files, restricts your access to your computer and demands a ransom in the form of a bitcoin.
The EternalRomance exploit from the shadowbroker leak has been used by the likes of NotPetya, and is now functional against fully patched Windows 7 and Windows 10. It has been found that the NSA has a similar exploit in the works that is capable of enabling remote code execution on Windows systems, and can be found in the wild. It’s a shame that it was not more widely released, as it may have prevented the Bad Rabbit from wreaking its havoc on more Windows PCs.
While the Bad Rabbit is not yet attributed to any known threat group, it has the same characteristics as the NotPetya variant. It also uses the same DiskCrytor driver that the aforementioned worm does, and it uses lateral movement to spread across networks.
It is also worth noting that the Bad Rabbit does not use EternalBlue, the worm’s cryptographic key. The best way to prevent the Bad Rabbit is to simply disable WMI on Windows systems, as this will stop it from digging its aforementioned hole in your network. In addition, a malware prevention tool such as MalwareBytes’ Endpoint Security can be useful, as it can block malware before it gets a chance to get to your valuable data.
The Bad Rabbit worm may be the best of the lot, but it’s no slouch, mainly because the malware has been used to target systems of all sizes and operating systems, including Windows XP, Vista and Windows 7. It’s also worth noting that the malware is not a direct copy of NotPetya, but instead uses a similar code base.
Maze
Initially known as ChaCha ransomware, Maze is a type of ransomware that encrypts all of the files on your local machine. It then demands a ransom to decrypt your files. It uses the RSA cipher to do so. Alternatively, it uses the ChaCha20 encryption algorithm. It then displays a ransom note on your desktop.
The ransom note tells you how to pay for the decryption process, and tells you what the ransom amount is. If you refuse to pay, then the malware will release the data. This data may be valuable to other hackers, and the threat of data release makes it difficult to ignore the ransom demand.
Maze ransomware also attempts to steal user and service accounts. Initially, it used an exploit kit, but later it shifted to using known security vulnerabilities. During this period, Maze ransomware used the Spelevo exploit kit to target a CVE-2018-15982 vulnerability in Adobe Flash Player.
Once it is inside your network, Maze will use Windows interfaces to perform remote code execution and exfiltrate data. It will also use LLMNR/NBT-NS Poisoning to steal network packets. It will then use Mimikatz to discover credentials.
The malware will also try to brute force passwords, using the most common attack methodologies. It will also attempt to use passwords stored in local drives. The malware has also been known to employ the Pass-the-Hash method of obtaining credentials.
Maze has been responsible for data leaks and data breaches. It has targeted big name companies such as Tesla parts supplier Visser, cybersecurity insurance firm Chubb, and defense contractor Kimchuk. It has also been distributed to organizations in Germany, Canada, and the United States.
Several other ransomware groups have followed Maze’s strategy. They have also set up websites on the dark web. Some of these websites have technical support sections, and other sections are dedicated to cryptocurrency. Some of these websites contain samples of data stolen by Maze. They also have trial decryption methods.
Ryuk
Known to be the top reported variant of the year, Ryuk ransomware is delivered by cyber threat actors. This type of infection often uses phishing emails and social engineering tactics to infect users.
The first stage of infection typically occurs after a user clicks on a phishing email. This email introduces a trojan into the host system. Once the trojan is installed, it is used to download a malicious payload.
Once the payload is downloaded, the Trojan will collect administrative credentials. These credentials can be used to steal more important information. The Trojan will also disable critical system processes and AV-related services. The Trojan will also allow the threat actor to move laterally within the network.
Ryuk will then encrypt files and data on infected network shares. Once the files have been encrypted, they will be appended to a list. The victim is provided with a ransom note that usually appends “.ryk” to the encrypted file. The note warns the victim that the system is compromised and that the only way to recover the files is to pay the ransom.
After encrypting the files, Ryuk ransomware will then delete the RSA key pair that was generated for each victim. This prevents investigators from locating the source of the infection.
The first stage of infection typically occurs when a user clicks on a phony phishing email. This email introduces the TrickBot Trojan into the host system. The Trojan then downloads a malicious payload. The Trojan is used to spread the infection.
Ryuk ransomware is distributed by a bot network called TrickBot. This bot network distributes the infection through spam emails. The emails are sent from spoofed email addresses. These emails are often phishing emails that mimic a legitimate email service.
