Ransomware gangs engage in criminal extortion by deploying malicious software designed to encrypt, block or destroy a computer system for money. Here’s a quick guide to ransomware gangs that explains who they are, how they work, and what your business can do to defend itself.

Booming Trillion Dollar Industry

You’ve heard of SaaS, but now RaaS (ransomware-as-a-service) is a growing trillion-dollar industry run by organized crime groups. These gangs are aggressively raising their game in terms of their business models and how they pose as corporations while making extortion demands. They offer a platform and infrastructure for a fee and promote partnership models where affiliates share the profits.

To gain mainstream acceptance, ransomware gangs are disguising themselves as legitimate businesses. They are coordinating their activities with different partners, providing 24-hour support desks staffed by representatives, and even branding themselves to boost their reputation. 

Read a related article Cyber Alert: Growth of Cyber Crime-as-a-Service.

Criminal Modus Operandi

• Ransomware gangs are globally distributed, organized hackers that coordinate to leverage each other’s tools or talents.
• They exchange leaked sites and victim data. One gang takes the data, while another engages in publishing and extortion.
• Their infrastructure is shared. The command-and-control servers’ IP addresses are the same for communication between multiple gangs.
• They exchange and share strategies. There has been evidence of a shared operating method among ransomware gangs. For instance, they all adopted the Viking Spider-invented practice of using virtual machines in victim situations.
• They proudly claim allegiance to a cartel in press releases published on the dark web by other ransomware gangs.

Digital Terrorism at a Global Scale

Ransomware gangs dominated headlines early this year, infecting thousands of computers on VMware ESXi servers. Italy bore the brunt of the attacks, resulting in a nationwide outage.

“The targeted vulnerability is two years old and should have been patched, but evidently, many servers are still not protected,” Stefano Zanero, full professor of cybersecurity at Italy’s Politecnico di Milano. The agency also said that the affected countries include France, Canada, and the US.

Enterprising gangs frequently evolve into cartels by collaborating with other like-minded criminal organizations to increase reach and revenue, overthrow competition, and frighten rivals and customers. 

How Can Your Business Mitigate An Attack

Refer to the latest FBI guidance, and updates from Cybersecurity and Infrastructure Security Agency’s (CISA) stop ransomware site. Check them regularly for the latest intelligence, including new sanctions and mandatory security breach reporting legislation. Also, consider these security awareness best practices to remain vigilant and stay clear of ransomware:

1. Increase Security Awareness Training Among Teams

Phishing emails start most attacks, and studies show that social engineering training can prevent data breaches by 70%. Conduct continuous security awareness and training exercises. Train users on security principles and techniques. Also, keep them up to date with news on emerging cybersecurity risks and vulnerabilities.

Additional mitigation actions for the end-user:

• • Regularly update antivirus software on all hosts, enabling accurate time detection.
  • Disable unused ports. 
  • Add an “EXTERNAL EMAIL” label to emails delivered outside your organization.
  • Disable hyperlinks in received emails.
  • Avoid using public Wi-Fi networks. Instead, consider using a VPN with MFA.

2. Patch Systems Regularly

Cybersecurity breaches sometimes result from poor software patching, the absence of system inventories, and vulnerability testing. Install updates, and patch operating systems, software, and firmware as soon as updates or patches are released.

3. Strengthen Passwords

Use multi-factor authentication where possible. For those accounts that cannot use MFA, implement strong password complexity policies with no less than eight characters in length. Implement the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts.

4. Audit User Accounts

Examine domain controllers, servers, workstations, and active directories for new or unrecognized user accounts. Do not give all users administrative privileges. Disable admin accounts that have delegatable admin rights. Require administrator credentials to install software and remove local admin privileges for users.

5. Backup Data and Systems

Password-protect backup copies offline. Ensure copies of critical data cannot be modified or deleted by unauthorized users from the system. Perform regular backups and specifically validate backup jobs that fail and understand why they did.

6. Develop a Recovery Plan

Implement or develop a recovery plan to secure multiple copies of sensitive or proprietary data. Place servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud). 

If Your Business Is Attacked, Take Action!
Call 1-800-882-9919

First, don’t capitulate to the demands of digital terrorists. Get immediate assistance from UDT Security Operations Center and take the following recommended actions NOW while we get on the case:

1. Determine which systems were impacted and immediately isolate them. 
2. Take the network offline at the switch level or physically unplug the systems from the wired or wireless network.
3. Immediately take backups offline to preserve them. 
4. Scan backups with antivirus and malware tools to ensure they’re not infected.
5. Initiate an immediate password reset on affected user accounts with new passwords no less than 14 characters in length. Do this for Senior Management accounts as well.