Ransomware victims thought their backups were safe. They were wrong: The 'holy grail' of ransomware

The UK's cybersecurity agency has updated its guidance on what to do after a ransomware attack, following a series of incidents where organisations were hit with ransomware, but also had their backups encrypted because they had left them connected to their networks.

"We've seen a number of ransomware incidents lately where the victims had backed up their essential data (which is great), but all the backups were online at the time of the incident (not so great). It meant the backups were also encrypted and ransomed together with the rest of the victim's data," the agency warned.

Ransomware victims thought their backups were safe. They were wrong

Download File

Select a backup or backups that were made prior to the date of the initial ransomware infection. With Extended Version History, you can go back in time and specify the date to which you would like to restore files.

As ransomware continues to be among the dominant cyber threats organizations face this year, businesses have responded by ensuring they are backing up their data. Although data backups are part of the layered approach to protecting your business, many organizations are improperly backing up their data, and these backups must be protected and kept safe from ransomware attacks.

That means they're looking for potential victims who have valuable data on their devices or network. Any device that contains banking information, social security numbers for customers or employees, or other sensitive data is a top target for cybercriminals to spread ransomware.

Social engineering attackers have become more innovative over time. The Guardian wrote about a situation where new ransomware victims were asked to have two other users install the link and pay a ransom in order to have their files decrypted.

After ransomware encrypts files, it shows a screen to the user announcing files are encrypted and the amount of money that must be paid. Usually, the victim is given a specific amount of time to pay or the ransom increases. Attackers also threaten to expose businesses and announce that they were victims of ransomware publicly.

The WannaCry ransomware took advantage of a Microsoft Windows vulnerability to spread quickly across the internet and encrypt files to hold them hostage. It encrypts files with cryptographically secure algorithms so that targeted victims are forced to pay the ransom in Bitcoin to obtain the private key or recover from backups. The files cannot be decrypted, so many organizations were forced to pay the ransom.

The COVID-19 pandemic also contributed to the recent surge in ransomware. As organizations rapidly pivoted to remote work, gaps were created in their cyber defenses. Cybercriminals have exploited these vulnerabilities to deliver ransomware, resulting in a surge of ransomware attacks. In Q3 2020, ransomware attacks increased by 50% compared to the first half of that year.

Mid 2011 - The first large scale ransomware outbreak, and ransomware moves into the big time due to the use of anonymous payment services, which made it much easier for authors to collect money from their victims. There were about 30,000 new samples detected in each of the first two quarters of 2011.

July 2017 - F-Secure labs uncovered chat sessions in which a ransomware support agent claimed they were hired by a corporation for targeted operations. Later analysis/metadata research confirmed that this tactic was used with another variant, and the follow-up attack targeted IP lawyers that was seemingly aimed at disrupting their business operations.

Park DuValle Community Health Center paid a $70,000 ransom when the medical records of almost 20,000 patients encrypted by ransomware. The attack locked providers out of their system for almost two months, impacting their medical records system and appointment scheduling tool. It wasn't the first time the health center had been hit, back in April another attack left their computer systems locked for about three weeks. After the first attack, they rebuilt their systems by using offsite backups and didn't pay the ransom, the second time they weren't so lucky. Four clinics resorted to writing down all patient information and storing it in boxes, operating as walk-in clinics, and asking patients for medical history from memory for seven weeks. Officials say this attack has cost the provider upwards of $1 million.

After a deadline was missed for receiving a ransom payment, the group behind Maze Ransomware has published almost 700 MB worth of data and files stolen from a security staffing firm. With this escalated attack, ransomware victims now need to not only be concerned about recovering their encrypted files, but what would happen if their stolen unencrypted files were leaked to the public, and the fact that ransomware infections by now probably should be disclosed as a data breach with all related consequences.

Travelex, a foreign-currency exchange company, was hit by the REvil/Sodinokibi actors on New Year's Eve. Its network data was encrypted and their customers were unable to take orders. REVil is said to exfiltrate data before encrypting the network as an added extortion incentive for victims to either pay or have the possibility of their data going public. A resulting cascade of nasty consequences for the victims include disclosure of PII, thus triggering data breach reporting requirements and the resulting governmental and third party legal headaches, potential crashing stock prices, fines, and the consequences of disclosure of confidential or proprietary information. REVil knows that large data breaches have sometimes resulted in crashing stock prices of up to 6%. Travelex later had to warn its customers to be on the lookout for phishing scams in an update on its corporate holdings website.

More new features have been added to the Ryuk strain, it now uses the Wake-on-Lan feature to turn on powered-off devices on a large compromised network to have greater success in encrypting them. In conversations with BleepingComputer, Vitali Kremez, Head of SentinelLabs, stated that this evolution in Ryuk's tactics allow a better reach in a compromised network from a single device and shows the Ryuk operator's skill traversing a corporate network. It's also now able to hack Active Directory and infect a larger number of machines. Ryuk Stealer, another version of this malware, uses new keywords and filetypes to automatically find an organization's most valuable data that they can extort and get their ransom.

Some ransomware gangs are now cold-calling victims on their phones if they suspect that a hacked company tried to restore from their backups to avoid paying ransom demands. Ransomware groups that have been seen calling victims in the past include Sekhmet (now defunct), Maze (now defunct), Conti, and Ryuk, a spokesperson for cyber-security firm Emsisoft told ZDNet on Thursday. These phone calls are another escalation in the tactics used by ransomware gangs to put pressure on victims to pay ransom demands after they've encrypted corporate networks.

According to a recent report by OODA Loop, "Mandiant claims to have detected a 422% increase in victim organizations announced by ransomware groups via their leak sites year-on-year between the first quarter of 2020 and Q1 2021." Mandiant also discovered that victims across 600 European organizations were widespread across several different types of industries.

Security vendor Venafi recently published survey data that shows 83% of all successful ransomware attacks include double and triple extortion. Many attacks either threaten to use stolen data to extort customers or to expose the data on the dark web. They also found that victims that paid the ransom in some cases still had their data exposed on the dark web or were unable to retrieve their data.

Internet-exposed Remote Desktop Protocol (RDP) sessions are another very common means of infecting networks. RDP sessions are used to remotely log in to Windows computers and allow the user to control that computer as if they were sitting in front of it. The technology typically uses port 3389 to communicate, and many organizations allow traffic from the internet through their firewall, so people can remotely access the computer. Hackers have become increasingly skilled at attacking these exposed computers and using them to spread malware within a network. RDP is exploited either due to an unpatched vulnerability or due to password guessing because the victims chose very weak passwords and/or did not enable account lockout protections.

Ransomware was originally introduced to target individual systems such as the personal computers of ordinary citizens. Nevertheless, attackers realized its full potential when they began to target organizations that were willing to pay to retrieve and protect their employee and customer data. Nowadays, most ransomware attacks happen to businesses and other organizations, including small and medium organizations who lack the resources to fully shield themselves from such attacks.

Ransomware is the de facto threat organizations have faced over the past few years. Threat actors were making easy money by exploiting the high valuation of cryptocurrencies and their victims' lack of adequate preparation.

In 2021, 54 percent of all ransomware attacks were successful.9 However, 39 percent of attacks were intercepted before they could encrypt any data. This means that anti-ransomware software, like what Acronis Cyber Protect Home Office uses, is stopping a significant number of attacks.

Introduction to Physical Security Commonly Asked Questions Policy Issues Physical Security Countermeasures Physical Security Checklist Introduction to Physical SecurityMost people think about locks, bars, alarms, and uniformed guards whenthey think about security. While these countermeasures are by nomeans the only precautions that need to be considered when trying tosecure an information system, they are a perfectly logical place to begin.Physical security is a vital part of any security plan and is fundamental to allsecurity efforts--without it, information security (Chapter 6), softwaresecurity (Chapter 7), user access security (Chapter 8), and networksecurity (Chapter 9) are considerably more difficult, if not impossible, toinitiate. Physical security refers to the protection of building sites andequipment (and all information and software contained therein) fromtheft, vandalism, natural disaster, manmade catastrophes, and accidentaldamage (e.g., from electrical surges, extreme temperatures, and spilledcoffee). It requires solid building construction, suitable emergencypreparedness, reliable power supplies, adequate climate control, and appropriate protection from intruders. Commonly Asked QuestionsQ.How can I implement adequate site security when I am stuck in anold and decrepit facility?A.Securing your site is usually the result of a series of compromises--what you need versus what you can afford and implement. Ideally, oldand unusable buildings are replaced by modern and more serviceablefacilities, but that is not always the case in the real world. If you findyourself in this situation, use the risk assessment process described inChapter 2 to identify your vulnerabilities and become aware of your preferred security solutions. Implement those solutions that you can, withthe understanding that any steps you take make your system that muchmore secure than it had been. When it comes time to argue for newfacilities, documenting those vulnerabilities that were not addressed earliershould contribute to your evidence of need.Q.Even if we wanted to implement these physical security guidelines,how would we go about doing so?A.Deciding which recommendations to adopt is the most important step.Your risk assessment results should arm you with the informationrequired to make sound decisions. Your findings might even show that notevery guideline is required to meet the specific needs of your site (andthere will certainly be some variation based on need priorities). Oncedecided on, however, actually initiating a strategy is often as simple asraising staff awareness and insisting on adherence to regulations. Somestrategies might require basic &quot'handyman&quot' skills to install simple equipment(e.g., key locks, fire extinguishers, and surge protectors), while othersdefinitely demand the services of consultants or contractors with specialexpertise (e.g., window bars, automatic fire equipment, and alarmsystems). In any case, if the organization determines that it is necessaryand feasible to implement a given security strategy, installing equipmentshould not require effort beyond routine procedures for completing internalwork orders and hiring reputable contractors.Determining countermeasures often requires creativity: don't limit yourself to traditional solutions. Q.What if my budget won't allow for hiring full-time security guards?A. Hiring full-time guards is only one of many options for dealing withsecurity monitoring activities. Part-time staff on watch duringparticularly critical periods is another. So are video cameras and the use ofother staff (from managers to receptionists) who are trained to monitorsecurity as a part of their duties. The point is that by brainstorming a rangeof possible countermeasure solutions you can come up with severaleffective ways to monitor your workplace. The key is that the function isbeing performed. How it is done is secondary--and completely up to theorganization and its unique requirements. Guidelines for security policy development can be found in Chapter 3. Policy IssuesPhysical security requires that building site(s) be safeguarded in a way thatminimizes the risk of resource theft and destruction. To accomplishthis, decision-makers must be concerned about building construction, roomassignments, emergency procedures, regulations governing equipmentplacement and use, power supplies, product handling, and relationshipswith outside contractors and agencies.The physical plant must be satisfactorily secured to prevent thosepeople who are not authorized to enter the site and use equipment fromdoing so. A building does not need to feel like a fort to be safe. Well-conceivedplans to secure a building can be initiated without adding undueburden on your staff. After all, if they require access, they will receive it--as long as they were aware of, and abide by, the organization's statedsecurity policies and guidelines (see Chapter 3). The only way to ensurethis is to demand that before any person is given access to your system,they have first signed and returned a valid Security Agreement. Thisnecessary security policy is too important to permit exceptions.As discussed more completely in Chapter 2, a threat is any action, actor, or event that contributes to risk Physical Threats (Examples)Examples of physical threats include:Natural events (e.g., floods, earthquakes, and tornados)Other environmental conditions (e.g., extreme temperatures, high humidity, heavy rains, and lightning)Intentional acts of destruction (e.g., theft, vandalism, and arson)Unintentionally destructive acts (e.g., spilled drinks, overloaded electrical outlets, and bad plumbing) A countermeasure is a strp planned and taken in opposition to another act or potential act. Physical Security CountermeasuresThe following countermeasures address physical security concerns thatcould affect your site(s) and equipment. These strategies arerecommended when risk assessment identifies or confirms the need tocounter potential breaches in the physical security of your system. Countermeasures come in a variety of sizes, shapes, and levelsof complexity. This document endeavors to describe a range ofstrategies that are potentially applicable to life in educationorganizations. In an effort to maintain this focus, thosecountermeasures that are unlikely to be applied in educationorganizations are not included here. If after your risk assessment,for example, your security team determines that your organizationrequires high-end countermeasures like retinal scanners or voiceanalyzers, you will need to refer to other security references andperhaps even need to hire a reliable technical consultant. Create a Secure Environment: Building and Room Construction:17Don't arouse unnecessary interest in your critical facilities: A secureroom should have "low" visibility (e.g., there should not be signsin front of the building and scattered throughout the hallwaysannouncing "expensive equipment and sensitive informationthis way").Select only those countermeasures that meetpercuived needs as indentified during riskassessment (Chapter 2) and supportsecurity policy (Chapter 3). Maximize structural protection: A secure room should have fullheight walls and fireproof ceilings.Minimize external access (doors): A secure room should only haveone or two doors--they should be solid, fireproof, lockable, andobservable by assigned security staff. Doors to the secure roomshould never be propped open.Minimize external access (windows): A secure room should nothave excessively large windows. All windows should have locks.Maintain locking devices responsibly: Locking doors and windowscan be an effective security strategy as long as appropriateauthorities maintain the keys and combinations responsibly. Ifthere is a breach, each compromised lock should be changed.Investigate options other than traditional keyhole locks for securingareas as is reasonable: Based on the findings from your riskassessment (see Chapter 2), consider alternative physical security strategies such as window bars, anti-theft cabling (i.e., an alarm sounds when any piece of equipment is disconnected from the system), magnetic key cards, and motion detectors. Recognize that some countermeasures are ideals and may not be feasible if, for example, your organization is housed in an old building.Be prepared for fire emergencies: In an ideal world, a secure roomshould be protected from fire by an automatic fire-fightingsystem. Note that water can damage electronic equipment, socarbon dioxide systems or halogen agents are recommended. Ifimplemented, staff must be trained to use gas masks and otherprotective equipment. Manual fire fighting equipment (i.e., fireextinguishers) should also be readily available and staff should beproperly trained in their use.Maintain a reasonable climate within the room: A good rule ofthumb is that if people are comfortable, then equipment isusually comfortable--but even if people have gone home for thenight, room temperature and humidity cannot be allowed toreach extremes (i.e., it should be kept between 50 and 80degrees Fahrenheit and 20 and 80 percent humidity). Note thatit's not freezing temperatures that damage disks, but thecondensation that forms when they thaw out.Be particularly careful with non-essential materials in a securecomputer room: Technically, this guideline should read "no eating,drinking, or smoking near computers," but it is quite probablyimpossible to convince staff to implement such a regulation.Other non-essential materials that can cause problems in asecure environment and, therefore, should be eliminated includecurtains, reams of paper, and other flammables. Don't say it if you don't mean it--instituting policies that you don't bother to enforce makes users wonder whether you're serious about other rules as well. Locking critical equipment in secure closet can bean excellent security strategy findings establish that it is warranted. Guard Equipment:Keep critical systems separate from general systems: Prioritizeequipment based on its criticality and its role in processingsensitive information (see Chapter 2). Store it in secured areasbased on those priorities.House computer equipment wisely: Equipment should not be ableto be seen or reached from window and door openings, norshould it be housed near radiators, heating vents, airconditioners, or other duct work. Workstations that do notroutinely display sensitive information should always be stored inopen, visible spaces to prevent covert use.Protect cabling, plugs, and other wires from foot traffic: Trippingover loose wires is dangerous to both personnel and equipment.Keep a record of your equipment: Maintain up-to-date logs ofequipment manufacturers, models, and serial numbers in asecure location. Be sure to include a list of all attachedperipheral equipment. Consider videotaping the equipment(including close-up shots) as well. Such clear evidence ofownership can be helpful when dealing with insurancecompanies.Maintain and repair equipment: Have plans in place foremergency repair of critical equipment. Either have a technicianwho is trained to do repairs on staff or make arrangements withsomeone who has ready access to the site when repair work isneeded. If funds allow, consider setting up maintenancecontracts for your critical equipment. Local computer suppliersoften offer service contracts for equipment they sell, and manyworkstation and mainframe vendors also provide such services.Once you've set up the contract, be sure that contactinformation is kept readily available. Technical supporttelephone numbers, maintenance contract numbers, customeridentification numbers, equipment serial numbers, and mail-ininformation should be posted or kept in a log book near thesystem for easy reference. Remember that computer repairtechnicians may be in a position to access your confidentialinformation, so make sure that they know and follow yourpolicies regarding outside employees and contractors who accessyour system. Who needs a Maintenance Contract? 2ff7e9595c