![\"ransomware](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2019\/04\/bb-bh-Ransomware-How-to-Prevent-or-Recover-from-an-Attack.jpg\")
<\/p>\n<\/p>\n
At midnight on May 25th<\/sup>, a dormant strain of ransomware awoke and began to wreak havoc on the systems and networks it had infected. The ransomware, known as Locker, was continuing in the footsteps of its ancestors, (Cryptolocker, CTB Locker, Cryptowall<\/a>, and others) infecting systems, encrypting files, and then extorting money from people, businesses, and organizations to decrypt the affected files. For anyone who received the following message on May 25th<\/sup>, it was a very bad day.<\/p>\n <\/p>\n The first known ransomware attack was in 1989 using the AIDS Trojan\/PC Borg malware. An infected computer would display a message to the user that one of their programs had expired and they needed to pay $189 to have it restored. The creator was eventually caught and the ransomware genre went underground for several years, though it reappeared briefly in 2005 and 2006. It wasn\u2019t until 2013 with the introduction of Cryptolocker<\/a> and its subsequent variants and copycats, that ransomware became widely known.<\/p>\n Locker was unusual in that it was \u201csleeper\u201d ransomware, having been dormant on the infected systems and devices until May 25th<\/sup>. The malware could have been installed anytime in the previous weeks, while it waited to be activated. For this reason it was difficult to pin down the attack vector, although a compromised Minecraft installer was suspected.<\/p>\n The \u201ccost\u201d to recover the files encrypted by Locker was 0.1 Bitcoins (about $24 USD), a modest amount when compared with previous ransomware attacks that demanded five to 10 times as much to recover the files they encrypted. On the bright side, according to security experts, nearly everyone who made the proper payment had their files decrypted.<\/p>\n There are several different ways for malware to get on a computer. For example, Java and Adobe-based vulnerabilities are often utilized to create exploits that can be used by ransomware builders. Anti-virus vendors are in a constant battle with these hackers, trying to stop the malware they create from being successfully downloaded and installed on your computer. This is a never-ending job, but there are ways you can help. One of the most common attack vectors is a phishing email. Here\u2019s an example below that our CEO received.<\/p>\n Phishing emails came to prominence in 2003 and have been a staple of attackers since then. A good attack will look just like an email you could receive, whether at your business or at home. The email above is likely to be what is known as spear phishing, meaning the attacker tailored the attack in some way towards the person or organization receiving the email. In this case, Gleb<\/a>, as our CEO, would be a reasonable person to receive such a document, if it were real. It should be noted that the FTC does not send such emails, but I don\u2019t think it\u2019s possible for the average American to know exactly what the government doesn\u2019t do! That is the social engineering paradox of phishing emails\u2014you often don\u2019t know what you don\u2019t know.<\/p>\n Let’s look at the example of your password to an online account: your Bank, Amazon, iTunes, etc. What is the policy for how often you are required to change your password? If a change is required, how are you notified\u2014email, perhaps? What happens if you forget your password? What information do you have to enter to change\/recover your password? Can it be done online (very convenient) or will they send you an email? Now multiply these questions times the number of your online accounts that have a password. The answer equals the challenge you face in knowing whether an email from one of those online accounts is real or fake. Ignoring every email could mean losing access to a site you enjoy or need; clicking on every link is certain disaster.<\/p>\n Obviously we recognized this email as a phishing attack, but imagine what could happen if an intern or a new employee received such an email. Would they click the link just trying to be helpful? What about a curious employee? The thing we do know is that once the link is clicked, the malware\u2019s wheels are set in motion.<\/p>\n As an example of how ransomware works, let\u2019s take a look how Cryptolocker does its work.<\/p>\n If there is nothing of value on your system, be it at home or at work, then the obvious thing to do is ignore the ransom message and have the system completely reinitialized. All your data will be gone, but you will still have your money.<\/p>\n Assuming that you have something of value on your computer, you could ignore the ransomware message and restore your data from a backup copy. You may have a personal local external drive or your organization may utilize a file server. In either case, you can recover your files from these sources. Trouble is, newer versions of ransomware, CTB Locker for example, are one step ahead of you. When installed and activated, this type of ransomware will not only encrypt the files on your computer, but it will also attempt to encrypt anything else connected to the computer, such as external hard drives and file servers. Such ransomware can reach out across the network to encrypt any files in nearly any location you have permission to store files. This includes the files stored in cloud-based directories and folders on your desktop by applications such as Dropbox. Sometimes, single sign-on is a bitch.<\/p>\n While there are no guarantees, here are some tips on how to keep your computer from getting infected with ransomware. You don\u2019t have to do all of these, but the more you do, the better off you are.<\/p>\n During the first half of this year, the number of incidents of ransomware has steadily increased. In early June, the security researchers at McAfee discovered \u201cTox,\u201d<\/a> which provides neophyte cybercriminals (aka script kiddies) with everything they need to run a ransomware campaign. We\u2019ve seen this \u201cmalware-as-a-service\u201d model before as spam, phishing, spyware, and virus packages are available for sale on the black market. The malware developers do this not only to monetize their work, but also to reduce their risk of being caught. With script kiddies getting involved, you can expect a continued increase in the number of ransomware attacks for the next several months as the hacker community tries to wring as much cash out of ransomware as possible.<\/p>\n As long as ransomware continues to generate cash for its purveyors, you can expect even more virulent strains of Cryptolocker and its variants to rear their ugly heads. Your goal is to make ransomware unprofitable by never having to pay the ransom. You can accomplish this by having a good off-site backup of your files, keeping your applications and operating system up to date, and remaining vigilant as you use your computer.<\/p>\n Sites consulted:<\/strong><\/p>\n![\"Locker](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2015\/06\/blog-locker.jpg\")
<\/p>\nCourtesy of bleepingcomputer.com<\/small><\/em><\/div>\nA Very Brief History of Ransomware<\/h2>\n
The Locker Attack<\/h2>\n
Attack Vectors: How Do You Get Infected in the First Place?<\/h2>\n
![\"Phishing](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2015\/06\/blog-phishing-email.jpg\")
<\/p>\n\n
![\"Cryptolocker](\"https:\/\/www.backblaze.com\/blog\/wp-content\/uploads\/2015\/06\/blog-cryptolocker.png\")
<\/p>\nCryptolocker Ransom Screen<\/small><\/em><\/div>\nOptions to Avoid Paying the Ransom<\/h2>\n
Best Practices to Keep from Getting Infected in the First Place<\/h2>\n
\n
The Future of Ransomware<\/h2>\n
\n