Magazine menu Close Magazine menu

ransomware

Latest stories

ransomware brazil, computer screen with code

The day ransomware nearly stole thousands of young people’s data in São Paulo

  • min read
    • There's an awesome purpose behind São Paulo, Brazil's 121 youth justice centers, Fundação CASA: Every day, they work with teenagers who have committed offenses and been given a court-ordered chance to learn to change their ways. But with 5,000 teenagers accessing a network of some 10,000 devices, Fundação CASA's information security and cybernetics team must manage a tinderbox of cybersecurity risk daily. 24 hours to escape a ransomware attack is the latest film in Tomorrow Unlocked's hacker:HUNTER Behind the Screens series. Fundação CASA's cybercrime fighters tell how they foiled a ransomware attack in a day, successfully safeguarding their young clients' personal data. There's much any organization or business can learn from their winning formula. Young people sentenced to learning When young people commit a criminal offense in São Paulo, the courts may sentence them to rehabilitation through learning how to escape criminal behavior patterns. That's where Fundação CASA comes in: They deliver that education on behalf of the Department of Justice and Citizenship. Meanwhile, the private data of the 5,000 teens who attend one of Fundação CASA's 121 centers must be kept secure. Julio Signorini has worked for Fundação CASA for over 20 years. He says, "As they're taught by the state, the teens' data comes under the Child and Adolescent Statute (ECA.) There's always a risk their data may be leaked." What is ransomware? There are many ways the young people's data could be leaked, including deliberate cyberattacks. Julio says, "A constant threat for us is ransomware: Malicious software that encrypts your data and demands you pay to recover it." To spread ransomware, attackers use social engineering to find users' vulnerabilities. Then the malware can spread across the network, eventually encrypting files and demanding a ransom. Ransomware is a growing threat. Kaspersky software detected over 21,000 ransomware strains and saw attacks rise 63 percent between 2021 and 2022 as a proportion of total attacks. Rapid response foils attack Julio explains how Fundação CASA's most recent ransomware incident began. "A young person brought in a compromised USB flash drive from home." Alex Christy Rogatti, Fundação CASA's Head of Security, remembers the day well. "It was a tense time because it was our first experience with ransomware, but we addressed it in one day." Julio says their fast response started with their young client's good decision to report something unusual. "The young person noticed his device behaving strangely and contacted our service desk, who quickly escalated the case to our information security and cybernetics team." Alex explains what happened next: "We isolated the infected device and recovered encrypted data on that device and our network. We isolated the malware so it couldn't spread further." Should you pay the ransom? Not every organization responds so fast and effectively as Fundação CASA. Proving there's no low cybercriminals won't sink to, 2023 saw some particularly vicious ransomware attacks, like a ransomware gang breaching Lehigh Valley Health Network in Pennsylvania, US, then leaking stolen photos and personal details of breast cancer patients. It's the severity of cases like these that tempts some victims of ransomware to pay their captors. Fundação CASA's Chief Information Security Officer (CISO) Odenilson Dos Santos Bonfim says, "Paying the ransom should be the last option. First, there's no guarantee they'll let you unencrypt your data when you pay. Second, paying the ransom encourages more ransomware. Third, you'd share financial information they may use in a scam or financial crime in future." To help ransomware victims and deter these kinds of attacks, Kaspersky is a found partner of the No More Ransom initiative. It offers free ransomware decryption tools and advice on how to prevent and deal with ransomware attacks. Reducing business vulnerability to ransomware Odenilson thinks there's much business can do to prevent more cyberattacks of all kinds. "We maintain an always up-to-date environment, with effective solutions for monitoring data and preventing any type of attack." That a user first raised the alarm about this attack shows the importance of a cyber-aware organizational culture. Odenilson says, "It's fundamental to encourage awareness, good market practices and publicize information security and cybersecurity information to your whole team and organization." How the ransomware attack on Fundação CASA was stopped echoes the importance of their work showing young people alternatives to a life of crime. By doing the right thing thanks to knowing what to do, one young person kickstarted the process that safeguarded their peers' precious personal data. The quick thinking and coordinated action of the service desk and information security and cybernetics teams shows how strong relationships make strong cybersecurity.
enterprise cyberthreats 2022

Five indispensable cyberthreat insights for enterprises

  • min read
    • Cyberthreats and cybercriminals' methods change all the time. Each year, we see things we've never seen before. Understanding what cyber researchers are finding can help your enterprise stay ahead of evolving cyberthreats, preventing costly data breaches and malicious damage. Kaspersky has the biggest global network of cybersecurity research and analyst teams, collaborating closely with product research and development. With expert researchers distributed across the globe, we see can escalate and respond to local situations fast. Here, we share some of our recent observations your business can act on today. 1. Ransomware is stepping it up a notch Fabio Assolini, Senior Security Researcher, Global Research and Analysis Team (GReAT,) Latin America, says: "This year, ransomware is no less active. Cybercriminals keep threatening retailers and enterprises worldwide. Watching these tendencies gives us threat intelligence to fight cybercrime today and helps us prepare for what we may see in the months to come. "Our research groups ransomware into three big trends: Ransomware that adapts to be able to infect different platforms, ransomware becoming more "industrialized" and cybercriminals taking sides in geopolitical conflicts. But despite its ever-increasing sophistication and targeting, there's still much enterprises can do to stay safe." What to do: Find out about the five best steps your business can take to fight ransomware – from keeping software up to date, to ensuring your Security Operations team has access to the latest threat intelligence. 2. Advanced Persistent Threats are coming out of the woodwork An Advanced Persistent Threat (APT) involves sneaky, sophisticated hacking techniques. It may hide malicious software in your system for a long time, stealing information or waiting for the moment to cause maximum damage. Kaspersky tracks more than 900 groups of APTs. David Emm, Principal Security Researcher, GReAT Global, says: "We became aware of a firmware-level APT compromise through our firmware scanner logs. The attackers had modified a single component to intercept the machine's boot sequence and introduce a sophisticated infection chain. The chain leaves no traces on the hard drive, as its components operate in memory only – a fileless attack with a small footprint." The researchers named the new ATP MoonBounce and have linked it to a known threat actor. What to do: Arm employees with the knowledge they need to protect your organization. Get APT threat reports on SecureList. 3. Apps can make Internet of Things devices even more vulnerable The Internet of Things (IoT) is a fast-growing ecosystem – forecasts predict we'll use more than 75 billion IoT devices by 2025. Among these, companion apps for internet-connected cars have attracted special attention. In early 2022, a 19-year-old hacker shared how he had accessed and controlled more than a dozen Tesla cars through their apps. The vulnerability of IoT devices, increasingly part of manufacturing and industry processes, has long been known. Our interest in transparency recently spurred Kaspersky analysts to look at car-controlling apps, finding their security and openness often lacking. What to do: Dan Demeter, Senior Security Researcher, GReAT Europe, Middle East and Africa says: "For an ongoing well-established security perimeter, we recommend periodic checks and updates for all applications used withing the perimeter, whether it's a consumer or a business environment. Remove any obsolete or not used apps from these environments as soon as possible." Demeter also highlights better practice among some vehicle companion apps. "Some use specially designed solutions from automakers, which, for example, make it impossible to unlock the doors remotely. With access to the vehicle's data through the manufacturer's website, there's no need to give credentials to an app, and users can revoke access any time." 4. Geopolitical tensions are raising denial-of-service risk Distributed Denial of Service (DDoS) attacks are cybercriminals' go-to targeted attack. They overwhelm a server, service or network with a flood of traffic, so you can't give your customers reliable online service. The Russia-Ukraine conflict has triggered a spate of DDoS attacks in both countries, targeting critical infrastructure, media and state-run services. Hacktivist groups have instigated some of these attacks, distributing apps, software and even games which can teach cybercrime skills to those with other aims, like extortion. Kaspersky researchers have noted a sharp rise in DDoS attacks across the board. What to do: Researchers advise businesses and nation states to prepare for DDoS attacks before they happen, through investing in suitable security controls and preparing defensive strategies with national internet service providers (ISPs.) Maher Yamout, Senior Security Researcher, GReAT Middle East, Turkey and Africa, says: "Deploy cyber defenses in advance. When an attack comes, it's too late. You never know when an emergency will happen, so today's the day to take care of your anti-DDoS protection." Threat intelligence also plays an important role in preventing DDoS attacks. Kaspersky is the only global threat intelligence provider with a major presence and expertise in Russia, where most advanced persistent threats and attacks originate. Security teams should subscribe to Kaspersky SecureList to stay up-to-date. 5. Malware keeps upping the ante Malware is common and costly. Over the past year, Kaspersky software prevented at least one malware attack on 20 percent of our users. Recently we've seen plenty of new and rehashed techniques aimed at disguising malware or letting it do more damage. Dr Amin Hasbini, Unit Head of GReAT Middle East, Turkey and Africa, says: "Since its discovery in 2014, we've seen the malware Emotet – originally designed to steal banking credentials – in many other forms, like as a delivery system for other malware and and botnet executable, using small employee mistakes to create big incidents. It mostly spreads nowadays through malicious email spam." What to do: Malware attacks often start with an employee making a small error of judgment, like clicking a link in a dodgy email, so one of the best ways to stay safe is to thoroughly educate all your staff in cybersecurity. Kaspersky research in partnership with Longitude, a Financial Times company, found leaders whose cybersecurity training programs can keep pace with the threat landscape say their companies are better prepared for a cyberattack. Immersive cybersecurity training is a powerful way to engage your workforce with learning in an age when there is much competition for their attention. Advanced cyberthreats are common. They have a big impact on business reputation and bottom line. When business leaders take cybersecurity action, they avoid spending more time later mopping up a cyberattack's damage. When choosing your cybersecurity vendor, look for those that participate in third-party tests and reviews, win awards and achieve top scores in independent tests. What's clear is that advanced threats are ever-changing, so having the most up-to-date threat intelligence will always be crucial for your business.
heathcare emotet

How could hospitals be better protected from cyberattacks?

  • min read
    • "In wartime, a red cross on a hospital's roof protects it from bombing. But in cyberwar, there's no convention to protect hospitals," says Professor Dr. Harald Dormann, Head Emergency Room Physician at Germany's Klinikum Fürth hospital. With thousands of networked computers and medical devices crucial to patient care, Klinikum Fürth's quick thinking turned a malware attack into an unlucky day for cybercriminals. Tomorrow Unlocked's video, Malware: A New Virus in the Hospital, tracks how Klinikum Fürth's actions stopped the ransomware attack in its tracks and likely saved lives. How do cybercriminals use malware against hospitals? The first hint of an attack was when Klinikum Fürth's IT support team started receiving strange emails from users – a hallmark of the dangerously effective malware Emotet. Emotet also uses Wi-Fi networks to spread. If infected, a wirelessly connected device scans nearby networks and infects other devices using a password list. Klinikum Fürth found 65 systems infected with computer viruses and malware. Thanks to acting fast, they isolated the malware before it encrypted data and held it for ransom – usually the Emotet attack's goal. Malware is common. From March to June 2021, Kaspersky software blocked 1.7 billion malware attacks. It's also becoming more dangerous, with cybercriminals using particularly damaging malware like Emotet for fraud and ransomware attacks. The hospital's surgical cyberdefense Professor Dr. Dormann recounts how hospital staff stepped up when they learned of the cyberattack. "When our CEO told us what had happened, some were nervous. Some were pale. But all were motivated to act." First, they began diverting new patients to nearby hospitals. Then they disconnected the hospital from the internet to reduce the risk of infecting other institutions. They put together taskforces of clinicians, administrators and IT staff to analyze the problem. Then, prioritizing the most critical medical devices, they checked for malfunctions. Extra staff were brought in to help switch to paper-based working. How to stop and prevent malware attacks Klinikum Fürth's story offers many lessons. Their fast response shows why organizations should plan what they'll do if attacked. Cybersecurity education can help staff get wiser to threats like Emotet's use of spoofed emails. Strong passwords help defend against malware that uses Wi-Fi networks to spread. Read more about how to prevent and reduce the impact of ransomware attacks.
managed-endpoint detection response

How to know what level of endpoint protection you need

  • min read
    • Endpoints – meaning, any end of a digital communications connection, like servers, laptops and mobile devices – are cybercriminals' favorite way to get inside your infrastructure. Market data analysis firm IDC's 2019 study found 70 percent of breaches started on an endpoint. There are a few types of threats: traditional, complex or advanced, and targeted or advanced persistent threats (APTs.) Classic Endpoint Protection Platforms (EPPs) do a great job at protecting against traditional threats like malware, but complex or advanced threats are becoming more common as more cybercriminals get hold of advanced tools. Those digitizing their https://www.kaspersky.com/enterprise-security/endpoint-productbusiness also often want to add a few more security strings to their bow. And these days, cybercriminals aim advanced and complex threats at all kinds of businesses, not just household-name companies and nation states. That's why adding Endpoint Detection and Response (EDR) to your EPP is fast becoming the standard. And then, Managed Detection and Response (MDR) offers a way to achieve the same protection in a different way. We'll cover what these advanced options do, their benefits and which types of organizations need them. What is endpoint detection and response (EDR) and when do you need it? Once you've got an EPP you're happy with, think about whether you need EDR on top. EDR offers organizations of all sizes greater ability to protect themselves against complex and advanced threats. Although they're less common than traditional threats, they're costly and disruptive to business. EDR gives you better visibility of and instant response to complex threats. It continually monitors endpoints, aiming to identify, investigate and respond. Your EDR may include tools like advanced detection engines, real-time analytics and the ability to hunt, investigate and centrally respond to evasive threats across the protected infrastructure. There should be applied threat intelligence and visibility into endpoints. Level up your endpoint protection with detection and response gives a full list of what to expect. EDR gives you tools for visibility, investigation and response. Your team can see what's happening on all endpoints and understand the scale of the threat. Investigation capabilities let you understand the root cause of a threat. Threat-hunting tools let your cybersecurity experts actively seek out any threats hiding in your infrastructure. After detecting and analyzing the threat, a fast response matters. Each organization is different. While some might have extensive cybersecurity expertise, others need a simpler solution. If your business has in-house cybersecurity expertise, you may benefit from better threat discovery, threat hunting and centralized incident response, such as Kaspersky Endpoint Detection and Response, also available as part of Kaspersky Anti-Targeted Attack Platform. Alternatively, Kaspersky Endpoint Detection and Response Optimum is a simpler solution for the IT department without cybersecurity specialists on hand. When do you need managed detection and response (MDR?) EDR provides advanced defensive capabilities, but you need to have your own cybersecurity experts to use it. MDR, on the other hand, means external experts manage your defense. With MDR, skilled professionals give you continuous protection 24 hours a day, seven days a week. It's ideal for organizations that struggle to find expertise or with limited in-house resources. Many organizations that opt for MDR are small- to medium-sized. For large organizations, MDR means you can outsource detecting, validating and prioritizing incidents rather than having as many cybersecurity specialists in house. If you're not sure whether EDR or MDR is best for your business, this infographic lays out the benefits of each. Endpoints are often vulnerable because they're what we use to create, communicate and store information. Our people using them can be manipulated by social engineering or make the wrong decision during moments of inattention, so security awareness training will help strengthen your endpoint. But as threats increase, your EPP may not be strong enough. That's why EDR is fast becoming the new standard. If you don't have the cybersecurity expertise in house, or want to free them up, MDR lets you bolster your security without the struggle of bringing new people on board.
endpoint detection response automation

Level up your endpoint protection with detection and response

  • min read
    • Effective – and cost-effective – cybersecurity is an art of balance. Complex cyberthreats are becoming more common, but every organization faces different risks. How likely are you to be attacked and by which threats? How should you use your time, money and resources to address these? How much expertise do you have, and how much could you expand it? Getting these answers right is where minimizing cybersecurity risk and improving efficiency begins. Recently, having more employees working from home has highlighted the importance of endpoint protection. The growing incidence of more disruptive advanced and complex threats adds further concern. Organizations of every size need safe and reliable ways to communicate and share information. But that's not all. Many businesses now find they're at greater risk now attacks are more complex and frequent so they're looking for a more advanced security tool: Endpoint Detection and Response (EDR.) All EDR products aim to better identify, investigate and respond to advanced and complex threats like ransomware and fileless threats. It's an extra layer on top of endpoint protection that's continuously looking for and responding to advanced threats. What does EDR do? EDR can have a range of capabilities, depending on the product and vendor. There may be a detection engine, for example, analyzing threats using machine learning and executing possible threats in a sandbox. It may include a real-time analytics engine, monitoring memory and searching for behavior patterns. The most important EDR feature may be visibility into your endpoints. With visibility, you can investigate past attacks or current threats on endpoints. You can involve cybersecurity experts in threat hunting using advanced tools. And once you've identified and analyzed threats, you can respond fast, preferably in an automated way, saving time and resources. EDR doesn't replace your Endpoint Protection Platform (EPP.) If you feel your EPP isn't up to the job, upgrade it before you add EDR into the mix. Multi-layered threat response saves time Cyberthreats are best addressed with multiple layers. As the threat enters the host, an endpoint protection engine uses approaches like structural machine-learning models and behavior analysis to identify and neutralize traditional threats. EDR comes into play after EPP has filtered out most malware through these automated processes. It lets you concentrate resources on the more dangerous complex and advanced threats. Using EDR's investigation, threat hunting and response capabilities, your cybersecurity team can efficiently address these more serious threats. For example, when a threat is detected, a cybersecurity officer can perform a root cause analysis to see if it's a complex threat and find out where it came from. If it is a complex threat, they can respond right away and set up a task to search for similar threats, automatically applying the same response. According to Kaspersky's IT Security risks survey, 28 percent of companies using EDR could detect cyberattacks immediately after or within a few hours of an incident. How EDR saves time and resources Automating and simplifying processes saves time and resources, and improves security. Even partial automation leads to faster responses, which could be crucial to mitigate a more serious impact for cases like ransomware. Together with a more simplified workflow, less will get missed because of 'alert fatigue' from dealing with many similar incidents. You can then give more attention to incidents that need human intervention, using EDR's enhanced visibility, investigation and response capabilities. You should see a happier IT team, freed from routine tasks and able to work better. They can deal with complex incidents quickly and efficiently, significantly improving your security and preventing business disruption. Choosing the right EDR for your business All EDR tools on the market are different. Some provide better threat hunting, while others focus on streamlining workflow and better integration. Here are some examples of Kaspersky products that could help. For better threat visibility, investigation and response capabilities when your IT department doesn't have access to highly skilled security officers, use Kaspersky Endpoint Detection and Response Optimum. For better threat discovery, threat hunting and centralized incident response when you have a specialized security team, try Kaspersky Endpoint Detection and Response, perhaps as part of Kaspersky Anti-Targeted Attack Platform. The broadening landscape of advanced and complex attacks has made many companies reexamine their endpoint protection. These businesses realize they need to do more to reduce the risk from cyberattacks. In a market where there's strong competition for cybersecurity skills, EDR capabilities help make the best use of your team's abilities. Investigation tools and visibility into all endpoints are intelligent additions to your endpoint security.
how to ransomware factory

Ransomware: The common attack you can stop in its tracks

  • min read
    • Holding a business's systems and information for 'ransom' is an increasingly common form of cyberattack. Kaspersky research shows this type of malware attack has risen 25 percent in the past three years. Verizon's investigations agree. Their 2019 Breach Investigations Report notes, "Ransomware has become so commonplace that it is less frequently mentioned in the specialized media unless there is a high-profile target." This 'so common it's boring' phenomenon means ransomware can slip off the radar. Now's the time to plan for what your business will do to prevent and handle these common attacks. What is business ransomware? It's not those spam messages that claim to have your personal data. Ransomware is a sophisticated attack that involves a series of steps. First, a cybercriminal finds a way into an endpoint, usually using social engineering or phishing to get account credentials, or by infecting a USB memory stick. Next, they insert malware, which encrypts files and directories. Finally, the malware warns the user their machine is infected and demands a ransom to decrypt data. The attacker has often studied the target's infrastructure to understand which databases and directory services are most critical. They tie together malware products and hack in a determined order. Attackers not immediately paid now sometimes publicly post data they've taken. Industries especially vulnerable to ransomware Breach by ransomware is not usually an isolated incident. Often, there have been a series of IT security errors or less-than-ideal practices. If your business isn't offering enough cybersecurity awareness training or you have delays in patching and system updates, your risk may be higher. High-profile ransomware attacks Cybercriminals have used ransomware to attack some prominent organizations in recent years. Worming the data away Estimated to be the most costly ransomware attack to date, NotPetya (also known as ExPetr) hit both Maersk and FedEx, taking down their systems for weeks. It worked by way of a worm that wiped data, causing hundreds of millions of US dollars of damage. Now you see it; now you don't File-encrypting ransomware LockerGoga attacked Norwegian aluminum and renewable energy company Norsk Hydro. The malware had advanced features such as deleting itself when it detected virtual machines to prevent researchers analyzing it. Norsk Hydro said their good backups meant the attack wasn't as bad as it could've been, but it still cost them around 90 million US dollars. A tale of 174 cities, and counting Ransom attacks on city governments are on the increase. In 2019, cybercriminals attacked some 174 municipal organizations with ransomware – about 60 more cities than the year before. The City of Baltimore suffered two attacks in 2018 and 2019 that together cost an estimated 18 million US dollars. One of the Baltimore attacks took down the city's emergency response dispatch system. Not all patients recover Californian healthcare provider Wood Ranch Medical announced it was going out of business in late 2019, as a direct result of a ransomware attack. The ransomware had encrypted both patient records and backups. How to avoid a ransomware attack 1.  Have the right tools to understand your vulnerabilities Your IT security practice needs tools to investigate what happened in an attack and what parts of your infrastructure need updating or replacing. Are you running a rogue app or access point? Do you have unmonitored and open network ports? Are privilege escalations being tracked? Are they expected and appropriate? Understanding root causes like these means you can know your defensive posture (the security status of your networks and information, and your capability to defend it and react to changes) and monitor your incident response. 2.  Be vigilant about patching and installing updates Attackers now scour the internet looking for outdated servers and applications. Many ransomware attacks happen within days of discovering a vulnerability. To delay is to invite exploitation. Make sure your patching program covers all endpoints, both on-premises and in the cloud. 3.  Regularly test your data recovery and emergency response procedures Back up critical data and ensure backups are intact and recoverable. Practice recovery and develop the correct order for restoring data. Identify your most valuable assets and make sure they're backed up. Regularly review the list to make sure you haven't missed something. Data backups and recovery drills should be the start of an overall emergency response plan. The plan should include regular, scheduled practice exercises, both 'table top' (organized meetings with role-playing) – to iron out organizational issues, and attack simulations – to find weak links and show-stoppers that could prevent infrastructure coming back online. 4.  Start or improve your cyber awareness program and improve your overall password portfolio Weak passwords might have caused a third of 2019's ransomware attempts. Conducting regular cybersecurity awareness training helps users improve their password hygiene. Install a business-wide password manager or single sign-on tool, and put in place multi-factor authentication (MFA) for users handling private data and money-related tasks. What to do if ransomware hits your business By strengthening your cybersecurity, you'll make it harder to be held to ransom. But you can do your business a favor by planning for if it happens. 1.  Plan alternative communications Ransom victims are often immobilized because communications like corporate email, phone calls or texts may not be available. Include using alternative communication such as WhatsApp, Skype and group SMS as part of recovery drills, but bear in mind these systems may be less secure. 2.  Decide if you will pay a ransom The case for paying In the US, the FBI has softened its earlier "don't pay, ever" position in its most recent guidelines. Two cities in Florida voted to pay ransoms of 500,000 to 600,000 US dollars – likely less than the cost of restoring its systems. The case against paying Your attacker may not honor their promise. You may receive further demands. The virus may already be installed in your system. While the term 'ransom' suggests physical threat, unless you're operating critical care facilities, it's unlikely ransomware will lead to loss of life. And it may be cost-efficient the first time, but it increases the likelihood you'll be hit again. The No More Ransom project, whose members include Europol and Kaspersky, advises those attacked with ransomware not to pay. It works to reduce ransomware's impact by providing free decryption tools. Despite the growing threat, with tight security and planning, you can avoid the worst impacts of ransomware, or even getting hit in the first place. Understanding ransomware's dimensions and having regular planning exercises will mean you'll know your protective measures are up to scratch. This article was published in March, 2020.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries