Ransomware Gangs—What You Need To Know

A quick guide to ransomware gangs that explains who they are, how they work, and what your business can do to defend itself.

Ransomware gangs engage in criminal extortion by deploying malicious software designed to encrypt, block or destroy a computer system for money. Here’s a quick guide to ransomware gangs that explains who they are, how they work, and what your business can do to defend itself.

Booming Trillion Dollar Industry

You’ve heard of SaaS, but now RaaS (ransomware-as-a-service) is a growing trillion-dollar industry run by organized crime groups. These gangs are aggressively raising their game in terms of their business models and how they pose as corporations while making extortion demands. They offer a platform and infrastructure for a fee and promote partnership models where affiliates share the profits.

To gain mainstream acceptance, ransomware gangs are disguising themselves as legitimate businesses. They are coordinating their activities with different partners, providing 24-hour support desks staffed by representatives, and even branding themselves to boost their reputation. 

Read a related article Cyber Alert: Growth of Cyber Crime-as-a-Service.

Criminal Modus Operandi

  • Ransomware gangs are globally distributed, organized hackers that coordinate to leverage each other’s tools or talents.
  • They exchange leaked sites and victim data. One gang takes the data, while another engages in publishing and extortion.
  • Their infrastructure is shared. The command-and-control servers’ IP addresses are the same for communication between multiple gangs.
  • They exchange and share strategies. There has been evidence of a shared operating method among ransomware gangs. For instance, they all adopted the Viking Spider-invented practice of using virtual machines in victim situations.
  • They proudly claim allegiance to a cartel in press releases published on the dark web by other ransomware gangs.

 

Digital Terrorism at a Global Scale

Ransomware gangs dominated headlines early this year, infecting thousands of computers on VMware ESXi servers. Italy bore the brunt of the attacks, resulting in a nationwide outage.

“The targeted vulnerability is two years old and should have been patched, but evidently, many servers are still not protected,” Stefano Zanero, full professor of cybersecurity at Italy’s Politecnico di Milano. The agency also said that the affected countries include France, Canada, and the US.

Enterprising gangs frequently evolve into cartels by collaborating with other like-minded criminal organizations to increase reach and revenue, overthrow competition, and frighten rivals and customers. 

How Can Your Business Mitigate An Attack

Refer to the latest FBI guidance, and updates from Cybersecurity and Infrastructure Security Agency’s (CISA) stop ransomware site. Check them regularly for the latest intelligence, including new sanctions and mandatory security breach reporting legislation. Also, consider these security awareness best practices to remain vigilant and stay clear of ransomware:

1. Increase Security Awareness Training Among Teams

Phishing emails start most attacks, and studies show that social engineering training can prevent data breaches by 70%. Conduct continuous security awareness and training exercises. Train users on security principles and techniques. Also, keep them up to date with news on emerging cybersecurity risks and vulnerabilities.

Additional mitigation actions for the end-user:

    • Regularly update antivirus software on all hosts, enabling accurate time detection.
    • Disable unused ports. 
    • Add an “EXTERNAL EMAIL” label to emails delivered outside your organization.
    • Disable hyperlinks in received emails.
    • Avoid using public Wi-Fi networks. Instead, consider using a VPN with MFA.

2. Patch Systems Regularly

Cybersecurity breaches sometimes result from poor software patching, the absence of system inventories, and vulnerability testing. Install updates, and patch operating systems, software, and firmware as soon as updates or patches are released.

3. Strengthen Passwords

Use multi-factor authentication where possible. For those accounts that cannot use MFA, implement strong password complexity policies with no less than eight characters in length. Implement the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts.

4. Audit User Accounts

Examine domain controllers, servers, workstations, and active directories for new or unrecognized user accounts. Do not give all users administrative privileges. Disable admin accounts that have delegatable admin rights. Require administrator credentials to install software and remove local admin privileges for users.

5. Backup Data and Systems

Password-protect backup copies offline. Ensure copies of critical data cannot be modified or deleted by unauthorized users from the system. Perform regular backups and specifically validate backup jobs that fail and understand why they did.

6. Develop a Recovery Plan

Implement or develop a recovery plan to secure multiple copies of sensitive or proprietary data. Place servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud). 

 

If Your Business Is Attacked, Take Action!
Call 1-800-882-9919

First, don’t capitulate to the demands of digital terrorists. Get immediate assistance from UDT Security Operations Center and take the following recommended actions NOW while we get on the case:

  1. Determine which systems were impacted and immediately isolate them. 
  2. Take the network offline at the switch level or physically unplug the systems from the wired or wireless network.
  3. Immediately take backups offline to preserve them. 
  4. Scan backups with antivirus and malware tools to ensure they’re not infected.
  5. Initiate an immediate password reset on affected user accounts with new passwords no less than 14 characters in length. Do this for Senior Management accounts as well.

Accomplish More With UDT

Get your custom solution in cybersecurity, lifecycle management, digital transformation and managed IT services. Connect with our team today.

More to explore

Henry Fleches on AI’s role in business and UDT’s link to Intel

UDT’s Henry Fleches discusses AI’s transformative role in business. Learn how AI shapes operations and drives innovation for a competitive advantage.

Reasons to Spend Your Year-End Budget on a Smart School Technology Refresh

Discover how smart schools technology can transform your district. Invest your year-end budget in digital learning and safety for a successful new school year.

Technology and workplace culture: An evolving partnership — Table of Experts

Discover how South Florida’s best workplaces leverage technology for culture and efficiency. Learn from experts at the forefront of innovation, including our Chief Technology Officer, Fernando Mejia.

Professional Development for 1:1 Device Initiatives in School Districts

Explore how professional development technology training for teachers can enhance K12 education. Discover the impact of 1:1 device initiatives on teaching and learning.

How To Defend Against Business Email Compromise

Business Email Compromise (BEC) attacks are causing businesses to lose 48 times more money than ransomware. Learn how to defend against these pervasive cyberthreats.

How To Prioritize Cloud Security Best Practices at Your Organization

Remember these key principles as you implement cloud security best practices at your organization for a safe and secure cloud infrastructure with minimum security issues. Whether you’re using Microsoft Azure or Amazon Web Services (AWS), cloud data security must always be a priority.

Experiencing a security breach?

Get immediate assistance from our security operations center! Take the following recommended actions NOW while we get on the case:

RECOMMENDED IMMEDIATE NEXT ACTIONS

  1. Determine which systems were impacted and immediately isolate them. Take the network offline at the switch level or physically unplug the systems from the wired or wireless network.
  2. Immediately take backups offline to preserve them. Scan backups with anti-virus and malware tools to ensure they’re not infected
  3. Initiate an immediate password reset on affected user accounts with new passwords that are no less than 14 characters in length. Do this for Senior Management accounts as well.

Just one more step

Please fill out the following form,