Ransomware Gangs—What You Need To Know

A quick guide to ransomware gangs that explains who they are, how they work, and what your business can do to defend itself.

Ransomware gangs engage in criminal extortion by deploying malicious software designed to encrypt, block or destroy a computer system for money. Here’s a quick guide to ransomware gangs that explains who they are, how they work, and what your business can do to defend itself.

Booming Trillion Dollar Industry

You’ve heard of SaaS, but now RaaS (ransomware-as-a-service) is a growing trillion-dollar industry run by organized crime groups. These gangs are aggressively raising their game in terms of their business models and how they pose as corporations while making extortion demands. They offer a platform and infrastructure for a fee and promote partnership models where affiliates share the profits.

To gain mainstream acceptance, ransomware gangs are disguising themselves as legitimate businesses. They are coordinating their activities with different partners, providing 24-hour support desks staffed by representatives, and even branding themselves to boost their reputation. 

Read a related article Cyber Alert: Growth of Cyber Crime-as-a-Service.

Criminal Modus Operandi

  • Ransomware gangs are globally distributed, organized hackers that coordinate to leverage each other’s tools or talents.
  • They exchange leaked sites and victim data. One gang takes the data, while another engages in publishing and extortion.
  • Their infrastructure is shared. The command-and-control servers’ IP addresses are the same for communication between multiple gangs.
  • They exchange and share strategies. There has been evidence of a shared operating method among ransomware gangs. For instance, they all adopted the Viking Spider-invented practice of using virtual machines in victim situations.
  • They proudly claim allegiance to a cartel in press releases published on the dark web by other ransomware gangs.

 

Digital Terrorism at a Global Scale

Ransomware gangs dominated headlines early this year, infecting thousands of computers on VMware ESXi servers. Italy bore the brunt of the attacks, resulting in a nationwide outage.

“The targeted vulnerability is two years old and should have been patched, but evidently, many servers are still not protected,” Stefano Zanero, full professor of cybersecurity at Italy’s Politecnico di Milano. The agency also said that the affected countries include France, Canada, and the US.

Enterprising gangs frequently evolve into cartels by collaborating with other like-minded criminal organizations to increase reach and revenue, overthrow competition, and frighten rivals and customers. 

How Can Your Business Mitigate An Attack

Refer to the latest FBI guidance, and updates from Cybersecurity and Infrastructure Security Agency’s (CISA) stop ransomware site. Check them regularly for the latest intelligence, including new sanctions and mandatory security breach reporting legislation. Also, consider these security awareness best practices to remain vigilant and stay clear of ransomware:

1. Increase Security Awareness Training Among Teams

Phishing emails start most attacks, and studies show that social engineering training can prevent data breaches by 70%. Conduct continuous security awareness and training exercises. Train users on security principles and techniques. Also, keep them up to date with news on emerging cybersecurity risks and vulnerabilities.

Additional mitigation actions for the end-user:

    • Regularly update antivirus software on all hosts, enabling accurate time detection.
    • Disable unused ports. 
    • Add an “EXTERNAL EMAIL” label to emails delivered outside your organization.
    • Disable hyperlinks in received emails.
    • Avoid using public Wi-Fi networks. Instead, consider using a VPN with MFA.

2. Patch Systems Regularly

Cybersecurity breaches sometimes result from poor software patching, the absence of system inventories, and vulnerability testing. Install updates, and patch operating systems, software, and firmware as soon as updates or patches are released.

3. Strengthen Passwords

Use multi-factor authentication where possible. For those accounts that cannot use MFA, implement strong password complexity policies with no less than eight characters in length. Implement the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts.

4. Audit User Accounts

Examine domain controllers, servers, workstations, and active directories for new or unrecognized user accounts. Do not give all users administrative privileges. Disable admin accounts that have delegatable admin rights. Require administrator credentials to install software and remove local admin privileges for users.

5. Backup Data and Systems

Password-protect backup copies offline. Ensure copies of critical data cannot be modified or deleted by unauthorized users from the system. Perform regular backups and specifically validate backup jobs that fail and understand why they did.

6. Develop a Recovery Plan

Implement or develop a recovery plan to secure multiple copies of sensitive or proprietary data. Place servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud). 

 

If Your Business Is Attacked, Take Action!
Call 1-800-882-9919

First, don’t capitulate to the demands of digital terrorists. Get immediate assistance from UDT Security Operations Center and take the following recommended actions NOW while we get on the case:

  1. Determine which systems were impacted and immediately isolate them. 
  2. Take the network offline at the switch level or physically unplug the systems from the wired or wireless network.
  3. Immediately take backups offline to preserve them. 
  4. Scan backups with antivirus and malware tools to ensure they’re not infected.
  5. Initiate an immediate password reset on affected user accounts with new passwords no less than 14 characters in length. Do this for Senior Management accounts as well.

Accomplish More With UDT

Get your custom solution in cybersecurity, lifecycle management, digital transformation and managed IT services. Connect with our team today.

More to explore

Lost & Stolen Devices are a Serious Data Security Threat—Here’s Why

Since the pandemic, remote and hybrid work has become the norm. While mobile devices and remote workstations have empowered great flexibility, it has also led to an increase in data security problems due to lost, misplaced, or stolen devices. Find out how remote and hybrid setups are contributing to this problem and how to protect yourself and your organization.​

Smishing Attacks are on the Rise—Here’s How To Keep Your Data Safe

Smishing attacks are on the rise, posing a significant threat to data security. Originating from a blend of SMS and Phishing, these attacks have seen a drastic increase since 2020. The widespread use of smishing attacks has persisted, with a lack of awareness being a major issue. Many view these as simple spam messages, unaware of the danger they pose. This blog aims to raise awareness about smishing and provide actionable insights to protect yourself and your organization.

5 Strategic Ways to Master Your IT Budget

Enhance finance IT efficiency with UDT and Cisco. Master IT budget planning, security, and innovation in the competitive industry.

IT Compliance Training for the Finance Industry (Get Your Resource Kit Now)

Download UDT’s IT Compliance Kit for financial services – empowering IT leaders to educate staff on compliance, data protection, and security.

Trend Alert! An Insider’s Look at the Latest IT Solutions for the Finance Industry

Explore the latest IT trends in finance and how UDT’s cutting-edge cybersecurity and managed IT services redefine security for the digital age.

Streamlining IT Operations in the Finance Industry—Top 10 Strategies for IT Leaders

Unleash the power of UDT and Cisco solutions with top 10 strategies to streamline IT operations for finance—enhancing security, compliance, and efficiency.

Experiencing a security breach?

Get immediate assistance from our security operations center! Take the following recommended actions NOW while we get on the case:

RECOMMENDED IMMEDIATE NEXT ACTIONS

  1. Determine which systems were impacted and immediately isolate them. Take the network offline at the switch level or physically unplug the systems from the wired or wireless network.
  2. Immediately take backups offline to preserve them. Scan backups with anti-virus and malware tools to ensure they’re not infected
  3. Initiate an immediate password reset on affected user accounts with new passwords that are no less than 14 characters in length. Do this for Senior Management accounts as well.

Just one more step

Please fill out the following form,