Table of Contents
ToggleLast week, less than a month after the WannaCry ransomware attacks infected more than 250,000 computers in 150 countries, security experts announced new revelations about a new attack, which originated in the Ukraine and spread to Russia, Poland, Italy, Germany, France, Spain, and the United States, along with nearly 60 other countries.
This attack began with a specific target: 12,500 machines running older versions of Microsoft Windows and software owned by M.E.Doc, a tax-accounting company based in Ukraine. Several private companies, including the American pharmaceutical giant Merck, the Danish shipping company AP Moller-Maersk, the British advertising firm WPP, and TNT Express, a global subsidiary of FedEx, were subsequently struck with a message featuring red text on a black screen: “Oops, your important files have been encrypted. If you see this text then your files are no longer accessible because they have been encrypted. Perhaps you are busy looking to recover your files but don’t waste your time.”
What made this attack significantly different than past ones, however, was that “waste of time” part — within hours, the hackers’ email address used to collect Bitcoin payment required as ransom was shut down, eliminating their ability to communicate with victims and restore access to encrypted data. As many baffled security experts speculated, if the hackers launched their attack to make money, they failed spectacularly.
Instead, some theories now hold that the attack was disguised as ransomware but meant to permanently wipe as much data on as many hard drives as possible. Researchers at Kaspersky Lab speculated that it was a “wiper” attack that used the media frenzy surrounding ransomware as a ploy to drum up attention. Still, that attention is needed to stem the tide of ransomware, one of the most tried and true vehicles for cyberattack.
Ransomware relies on locking a victim out of his or her own files until they pay a certain amount for a decryption key. Last year, security researchers estimate that cybercriminals made more than $1 billion via ransomware attacks, with targets ranging from Fortune 500 corporations to independently owned small businesses and even private individuals. But the WannaCry attack and this most recent one, alternately identified as Petya, NotPetya, ExPetr, and GoldenEye, took in only $100,000 combined.
Both spread by combining traditional ransomware assaults with an operating system vulnerability left open when software updates for Microsoft Windows were not installed. That allowed the attacks to grow quickly, exploiting lone unprotected machine to then infect devices across any connected network. WannaCry’s global spread was stymied by a rogue security expert who registered a domain name for $10 and halted the attack in its tracks. Last week, a German email provider shut down the address associated with ransom payments, stopping the so-called Petya assault within a day.
Whether ransomware is intended to make money or just wreak havoc, stopping it is the number-one goal for businesses small and large. Chipin Corp has extensive experience protecting its clients from such incidents, and our 24/7 monitoring and maintenance solutions sprang into action last Tuesday to immediately deploy protections for any clients at risk of infection. Here’s what we suggest to keep your business safe:
Ransomware attacks are not just for big businesses anymore. Because cybercriminals know that companies rely on their digital data and their IT infrastructure, businesses of all sizes are being attacked.
Using ransomware, cybercriminals have figured out how to bring a company to a complete standstill by encrypting critical files, blocking access to system and placing a monetary demand for the decryption of the data. The financial loss is only the beginning. A business can lose customers to a trust loss, sustain damage to their reputation and face compliance consequences.
Most Small and Medium Businesses (SMBs) do not have the advanced security resources to either sustain the continuous monitoring or backup their data. Ransomware is now a business risk for SMBs.
Ransomware is a business risk for other enterprises and organizations too. Consider the other devices you connect to the Internet and network. Those devices are now a risk too.
To keep ransomware’s impact to a minimum, strengthen endpoint protection, offer ongoing employee training, and backup your data regularly. The threat of ransomware will always be changing. Remain vigilant.
To stop the threat of ransomware, know the risks. Cybercriminals have many ways to enter business networks.
1. Phishing
Cybercriminals have to get their victims to do something. One popular method is phishing attacks. The phishing email will look legitimate and contain either a link or attachment that is infected with malware.
The threat can be eliminated with proper training and the right email protection.
2. Poor Passwords
The use of weak or the same passwords will make systems and accounts of businesses that much easier to attack and access.
Utilizing strong passwords and multi-factor authentication (MFA) can insulate accounts from unauthorized access.
3. Systems and Software That are Outdated
Offensive systems and software leave security gaps that adversaries may leverage.
System protection is improved with regular updates and the application of security patches.
4. Remote Access That is Not Secured
As remote working solutions proliferate, unsecured remote access is becoming a cybercrime target.
Secure VPNs, access control, and the use of monitoring tools can defend remote access.
5. Low Cybersecurity Knowledge Within the Workforce
Insufficient cybersecurity awareness makes employees vulnerable to threats through the unintentional opening of malicious files and/or leaking protected information.
Period security training improves the employee’s ability to identify threats and serves to circumvent the potential of a ransomware attack.
Ensure All Software Patches and Security Updates Are Properly Deployed
WannaCry and Petya both took advantage of a publicly acknowledged vulnerability in older versions of Microsoft Windows. Any business with a trusted IT partner by its side would have had that patch deployed earlier this spring. After WannaCry, extra precautions were taken, as well. But in Petya’s case, even one vulnerable system could have taken down any protected ones that were connected on the same network, which makes comprehensive security so critical.
Avoid Clicking Suspicious Links or Downloading Unknown Attachments
Although the two most recent global ransomware attacks were not spread via the standard phishing email method, all it takes is one errant click on one illicit link or malicious file to put an entire business’ computers at risk. Training your employees to quickly identify and avoid suspicious emails is a baseline for online security.
Always back up your data.
Creating regular, redundant, and remote backups of your critical business data is one of the most important security measures you can take for continued success. While free solutions exist on the open market that may indicate they’re backing up your entire computer, reliable data backup performed on a regular basis by a trusted IT provider is the safest way to prevent any ransomware attack, virus infection, or data breach from knocking your business out of commissions. Oh, and make sure your backup retrieval procedures are well vetted and regularly tested — if your data is lost, you want to be able to quickly restore it in the event of a cyberattack or natural disaster.
Inadequate protection against ransomware may bankrupt firms. Security strategies should incorporate the prevention and detection of threats, with the ability to respond to threats in a timely manner.
Employ Endpoint Detection and Response (EDR)
Threats that are detected through EDR can be responded to by security teams in a timely manner, and afford protection against ransomware.
Ransomware protection can be improved from a network vantage by the visibility EDR affords to secure endpoints.
Deploy Multi-Factor Authentication (MFA)
Authentication of users through multiple verification methods is an additional layer of security provided by MFA.
MFA makes it significantly more difficult for attackers to penetrate company systems, even if they manage to get their hands on user passwords.
Keep Safe and Unchangeable Backups
A good backing up policy protects businesses from ransomware. Safe backups enable a company to bring back their information without having to negotiate with criminals.
Implement Zero Trust Security
Zero Trust security uses the saying “never trust, always verify”. To access any company resource, each and every user, device, and application must be verified.
This policy protects from unauthorized access and also restricts the activities of attackers on the network.
Do Frequent Security Evaluations
Evaluating security frequently helps to find weaknesses in a system before cybercriminals find and exploit them.
Evaluations of this kind enable businesses to refine and enhance their defensive policies and systems.
After a successful ransomware attack, valuable and essential company files become inaccessible and may be permanently lost if a proper backup policy is missing.
To defend against cyber attacks, companies may use Cloud backup as a secure way to store and recover data. With a reputable backup, the company may continue their daily activities after restoring files and avoiding payment of the ransom.
An ideal cloud-based backup solution should consist of:
Using cloud backup with advanced cybersecurity services can help businesses secure information even more, as well as decrease the time to recover from an attack.
At Chipin Corp, we keep businesses in the UAE safe from cyber threats by protecting valuable data, software, and IT systems by using advanced, cutting edge cybersecurity solutions.
To do this, we focus on protection from ransomware and malware as well as prevention from unauthorized access.
Our services include:
When we combine the correct security technology with prevention and protection services, we significantly decrease the threat of cyber attack and keep businesses safe, secure, and operational.
To best prevent a ransomware attack, it's important to implement a combination of secure backups, strong passwords, multi-factor authentication, employee education, endpoint protection, and continuous security monitoring.
Yes, ransomware can be removed without paying if secure data backups and a proper incident recovery plan are in place.
Yes, cloud backup with encryption, access controls, along with recovery options, offers strong protection from ransomware.
Businesses in the UAE can safeguard their data using endpoint protection, cloud backup, and network security. They can strengthen their security posture by training and educating their staff on cyber threats, as well as having their systems monitored and managed proactively.
Yes. If backups are directly connected to the infected network or have weak access controls, ransomware can potentially affect them too. Businesses should use isolated or immutable backups, strong authentication, and regular backup testing to improve recovery protection.
Immediately isolate affected devices from the network to help prevent further spread. Avoid deleting evidence, notify the appropriate IT/security team, and assess available clean backups before starting recovery. Businesses should also investigate how the ransomware entered the environment and strengthen the affected security controls.
Your goals. Our expertise. Perfect solutions.
Years in Dubai
Clients Served
Google Rating
