Information Technology

Image: WhatsApp
WhatsApp has said it is starting to slowly roll out the encrypted backups feature it detailed in September. “Starting today, we are making available an extra, optional layer of security to protect backups stored on Google Drive or iCloud with end-to-end encryption,” the company said in a blog post. “No other global messaging service at this scale provides this level of security for their users’ messages, media, voice messages, video calls and chat backups.” Users will have a choice for how the encryption key used is stored. The simplest is for users to keep a record of the random 64-digit key themselves, akin to how Signal handles backups, which they would need to re-enter to restore a backup. The alternative would be for the random key to be stored in WhatsApp’s infrastructure, dubbed as a hardware security module-based Backup Key Vault that would be accessible via a user-created password.For redundancy purposes, WhatsApp said the key would be distributed through multiple data centres that operate on a consensus model.

WhatsApp said it would only know that a key exists in its vault, but would not know the key itself. The backups would store message text, as well as photos and videos received, WhatsApp said. Related Coverage More

Missouri governor Mike Parson is facing criticism from technologists and journalists after he issued a scathing, technologically inaccurate statement threatening to arrest a reporter for discovering that the social security numbers of school teachers, administrators and counselors across Missouri were vulnerable to public exposure due to flaws on a website maintained by the state’s Department of Elementary and Secondary Education.St. Louis Post-Dispatch reporter Josh Renaud wrote a story on Thursday indicating that the newspaper discovered issues with a web application that allowed anyone to search through a database of certifications and credentials belonging to more than 100,000 of the state’s teachers. Payment data and social security numbers were also vulnerable due to the issue. The newspaper contacted the department and the pages were removed. All of this was done before the story was published to give the state time to rectify the vulnerability. The newspaper also held off on publishing the story to allow other state agencies to fix similar vulnerabilities in other web applications. State officials said they were investigating how long the data was exposed. But later in the day, Parson held a press conference where he bashed Renaud and the newspaper, threatening legal action for their decision to notify the state about the issue. He then doubled down on the threats in a Twitter thread that drew widespread ridicule and outrage from technology experts who questioned whether the governor and his team truly understood what they were discussing.Parson claimed that “an individual took the records of at least three educators, decoded the HTML source code, and viewed the SSN of those specific educators.” He said his office notified the Cole County prosecutor and the Highway Patrol’s Digital Forensic Unit and ordered them to investigate what happened. 

“Upon receiving this notice, DESE immediately contacted the Missouri Office of Administration ITSD, who programs and maintains the web application, to remove public access to the portal and update the code. This matter is serious,” Parson wrote. “The state is committing to bring to justice anyone who hacked our system and anyone who aided or encouraged them to do so — in accordance with what Missouri law allows AND requires. A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert and decode the code.” Parson went on to say that Renaud committed an offense because it is a crime to “access, take and examine personal information without permission.””This data was not freely available and had to be converted and decoded. The state does not take this matter lightly and we are working to strengthen our security to prevent this incident from happening again,” Parson said. “The state is owning its part, and we are addressing areas in which we need to do better than we have done before. We will not rest until we clearly understand the intentions of this individual and why they were targeting Missouri teachers.”Other local news outlets noted that Parson has long expressed a deep hatred for the state’s major news outlets over their coverage of his handling of the COVID-19 crisis and his penchant for doling out no-bid contracts. Even members of Parson’s own party criticized him for his statements, with Republican Rep. Tony Lovasco writing on Twitter that it was “clear the Governor’s office has a fundamental misunderstanding of both web technology and industry standard procedures for reporting security vulnerabilities. “Journalists responsibly sounding an alarm on data privacy is not criminal hacking,” Lovasco said. The St. Louis Post-Dispatch defended Renaud in a statement and said he did the right thing by reporting his findings to DESE before it could be exploited.”For DESE to deflect its failures by referring to this as ‘hacking’ is unfounded,” said the newspaper’s lawyer,  Joseph Martineau, in a statement provided for Renaud’s story. 
Governor Parson
The governor’s statements were thoroughly bashed by experts who noted that what Renaud did was as simple as pressing the F12 key on certain devices. BreachQuest CTO Jake Williams told ZDNet that organizations should be careful not to shoot the messenger when security vulnerabilities are disclosed. “This is certainly not hacking in any sense of the word. It appears that the reporter used a publicly available web application intended to facilitate searching for teacher certifications. When the results were displayed, the reporter simply viewed the source code of the web page and found the social security numbers,” Williams said.”While Governor Parson said the reporter ‘decoded the HTML source code’ in reality they simply used the feature built into every web browser since the dawn of the Internet. Because HTTP is stateless, many web applications store their status in hidden form fields so they can be passed from the browser back to the server with every request. It seems likely that these hidden form fields included the social security number of the teacher. The question of whether this was a crime might be more black and white if the reporter had enumerated all records before reporting the issue.” Williams noted that even Parson’s mention of only three records taken seems to contradict any malicious intent. He added that instead of focusing on this so-called hacking, Parson should be concerned about the security of the state’s applications, particularly those that are available for public use. Renaud’s story noted that the state has previously faced criticism for its data collection practices. “Finding a flaw like this in 2021 should frankly be embarrassing for the state. It wouldn’t be the first time that a politician has fired on all cylinders claiming that accessing publicly available information was hacking,” Williams said. “Threatening a reporter with legal action is almost always a bad idea and usually creates an unintended Streisand Effect.”Vectra technical director Tim Wade said the situation underscored the need to protect security researchers operating in the public good and the backlash they typically face for discovering vulnerabilities. The outrage directed toward those who discover data loss and vulnerabilities needs to be redirected to the root causes of why these security failures continue to occur to the detriment of individual safety, Wade added.  He noted that most courts recognize limits to protections from unlawful search when activities occur clearly in a public context and explained that it’s hard to imagine that the low-technical sophistication of the behaviors described, with a tool as common as a web browser, constitutes anything but the digital equivalent of observations made in a public context.John Bambenek, principal threat hunter at Netenrich, said government leaders should be thanking people who notify their government of problems, not threatening them.”Throughout human history, emperors have responded to those telling them they were wearing no clothes by lashing out in anger at the audacity of those who’d dare say such a thing,” Bambenek said. “Life would be better if they, you know, just put on pants. I’m sure every actual criminal hacker on the planet noticed this tirade and you can bet their adjusting their targeting accordingly.” More

In a new advisory, CISA has warned US water and wastewater system operators about an array of cyberthreats aimed at disrupting their operations. Cybersecurity company Dragos worked with CISA, the FBI, the NSA and the EPA to outline cyberthreats targeting the information and operational technology underpinning the networks, systems and devices of US water and wastewater facilities.The warning also outlines a series of attacks that have happened this year, some of which were never reported previously. CISA noted that the advisory was not an indication of the potential for increased attacks targeting this particular sector but was simply an effort to help water facility operators protect their systems. The notice lists spearphishing as one of the most prevalent methods used by cybercriminals and nation-states to gain access to water systems, explaining that it is often deployed to deliver malicious payloads, including ransomware. CISA added that because IT and OT systems are often integrated together, access to one gives attackers access to the other. CISA also mentioned exploitation of internet-connected services like RDPs as another tool used to attack water systems. With COVID-19, many water system operators use RDPs and other tools to access the systems remotely, leaving them vulnerable to outdated operating systems or software. “WWS facilities tend to allocate resources to physical infrastructure in need of replacement or repair (e.g., pipes) rather than IT/OT infrastructure. The fact that WWS facilities are inconsistently resourced municipal systems — not all of which have the resources to employ consistently high cybersecurity standards — may contribute to the use of unsupported or outdated operating systems and software,” CISA explained. “WWS systems commonly use outdated control system devices or firmware versions, which expose WWS networks to publicly accessible and remotely executable vulnerabilities. Successful compromise of these devices may lead to loss of system control, denial of service, or loss of sensitive data.”

The notice lists several recent attacks since 2019, including one in August 2021 that involved the Ghost ransomware being deployed against a facility in California. Attackers spent a month inside the system before putting up a ransomware message on three supervisory control and data acquisition servers. An attack in July saw the ZuCaNo ransomware used to damage a wastewater facility in Maine and in March, a Nevada water treatment plant was hit with an unknown ransomware variant. In September 2020, the Makop ransomware hit a New Jersey facility and another attack in March 2019 involved an attempt to threaten the drinking water of a town in Kansas. CISA lists a number of things operators should look out for, including the inability to access certain SCADA system controls, unfamiliar data windows or system alerts, abnormal operating parameters and more. They urged water facilities to put increased security controls around RDPs and implement “robust” network segmentation between IT and OT networks. All facilities should have an emergency response plan and consider a wide range of impacts that a cyberattack may have on how systems function. CISA noted that there should also be systems in place that physically stop certain dangerous conditions from occurring even if a system is taken over. Neil Jones, cybersecurity evangelist for Egnyte, told ZDNet that the recent attacks on water treatment plants in the Bay Area, Florida, and Pennsylvania, should be a wake up call that the country’s critical food, utility and energy infrastructure are under direct threat from cyberattacks. Jones said recent reports indicate that 1 in 10 waste or wastewater plants has a critical security vulnerability. Bjorn Townsend, a water infrastructure incident responder for cybersecurity company Critical Insight, said alerts like this “indicate that they have specific intelligence that threat actors are attempting to tamper with our water systems on an ongoing basis, and they’re trying to alert water system operators to that fact.” “Municipal IT personnel should pass the guidance in the ‘WWS Monitoring’ section on to the plant engineers who work with the utility’s SCADA systems even if they aren’t specifically trained in IT, and give guidance on how to alert IT and/or cybersecurity staff to respond to the potential threat,” Townsend said. “The alert lists mitigations for the very issues I have seen firsthand while performing cyber and physical risk assessments of municipal water systems here in Washington State under the America’s Water Infrastructure Act of 2018. Most of the water systems I have personally inspected do not have the majority of the mitigations listed in place, particularly in terms of remote access controls, system upgrades, access reviews, or monitoring and logging of activity.”Water systems, he added, often have to deal with a lack of resources, both in terms of management, monitoring technologies and even a lack of investment in regular software and hardware upgrades for the industrial controls networks in those systems. The other issue is a lack of cooperation between water system operators and municipal IT staff, Townsend explained. “In a municipal water system, I often see a situation where IT administrators — who are nominally responsible for the computers within the drinking water system — are at odds with water system operators, because water system operators are trained to make minimal changes to a system over time,” he said. “That ‘minimal change’ approach is completely at odds with the recommended 30-day patching cycle for Microsoft Windows, let alone upgrading the software on the PLCs themselves. As a result, this alert shows that we need to both dramatically improve resourcing for IT and cybersecurity in the water sector and break down the stovepipe between municipal IT staff and the operators of their municipal water system by encouraging water system operators to follow IT software and hardware update policies.”  More than anything, Townsend said the lack of funding is often the greatest problem operators face because many organizations are bound simply by the number of people they have available to perform these otherwise very routine tasks. The staff they have are usually close to the minimum number required to respond to help desk and support requests, Townsend noted. More

All-digital wireless carrier Visible has finally addressed issues its users were having with their accounts this week.The company, which is owned by Verizon, has faced overwhelming criticism from users, who took to social media to say their accounts had been hacked and used to buy phones or make other charges. Multiple customers voiced their complaints on Reddit and other social media sites, saying they had been locked out of their accounts, had their addresses changed, and had still not not gotten any response from Visible. The company came forward and confirmed the attack in a Twitter thread on Wednesday afternoon, writing that it was “aware of an issue in which some member accounts were accessed and/or charged without their authorization.” “As soon as we were made aware of the issue, we initiated a review and deployed tools to mitigate the issue, enabling additional controls to further protect our members. Our investigation indicates that threat actors were able to access username/passwords from outside sources, and exploit that information to login to Visible accounts,” the company claimed.The company urged affected customers to contact them if there were any charges made to their account without their knowledge. A Reddit user said on Monday that they discovered a $1,175.85 charge to their account coming from Visible. When they investigated further, they discovered that a 128GB iPhone 13 Pro Max had been purchased and sent to an address in New York City, far away from their home in the DC/Virginia area. 

“Visible basically offered nothing. I asked them what the hell is this, and they asked me if I had the order number. I said no, since my entire account was hijacked and the emails don’t come to me,” the user wrote. “I asked if I can be given access to my account again, and they said ‘We’re not sure.’ I should be hearing back within 24-48 hrs.”In a later message on Reddit, a Visible spokesperson denied that the company had been breached or compromised, claiming that only “a small number of member accounts was changed without their authorization.””We don’t believe that any Visible systems have been breached or compromised, nor that this unauthorized access to your Visible account is ongoing,” the company said. “However, for your protection, we recommend you review your account contact information and change your password and security questions to your Visible account. We also recommend that you review any other accounts that share the same email, login, or password, and make any changes you determine necessary to secure those accounts.”Visible isn’t the only carrier dealing with cybersecurity issues. In August, hackers breached T-Mobile’s systems, exposing the sensitive information of more than 50 million current, former, and prospective customers. More

The countries involved in the two-day ransomware summit led by the US have released a joint statement pledging to make systems more resilient against attack and outlining measures that will be taken to disrupt the criminal groups involved.  The summit included representatives from the US, Australia, Brazil, Bulgaria, Canada, Czech Republic, the Dominican Republic, Estonia, European Union, France, Germany, India, Ireland, Israel, Italy, Japan, Kenya, Lithuania, Mexico, the Netherlands, New Zealand, Nigeria, Poland, South Korea, Romania, Singapore, South Africa, Sweden, Switzerland, Ukraine, UAE, and the United Kingdom.All of the countries agreed that ransomware is an “escalating global security threat with serious economic and security consequences.” The countries reiterated that ransomware requires a “shared response” because of how complex and global the issue is. “Efforts will include improving network resilience to prevent incidents when possible and respond effectively when incidents do occur; addressing the abuse of financial mechanisms to launder ransom payments or conduct other activities that make ransomware profitable; and disrupting the ransomware ecosystem via law enforcement collaboration to investigate and prosecute ransomware actors, addressing safe havens for ransomware criminals, and continued diplomatic engagement,” the statement said.The countries pledged to make systems more resilient through policy measures, more resources, clear governance structures, well-rehearsed incident response procedures, trained workers, and private sector partnerships. They urged organizations to maintain offline data backups, require timely patches, and use MFA as well as stronger passwords. Nations should also “consider” frameworks that promote information sharing between ransomware victims and local cyber emergency response teams. 

The statement mentioned other ways to limit the effectiveness of ransomware gangs, including the disruption of payment networks. Through international cooperation, the countries said they planned to “inhibit, trace, and interdict ransomware payment flows, consistent with national laws and regulations.””Taking action to disrupt the ransomware business model requires concerted efforts to address illicit finance risks posed by all value transfer systems, including virtual assets, the primary instrument criminals use for ransomware payments and subsequent money laundering,” the statement said. “We acknowledge that uneven global implementation of the standards of the Financial Action Task Force (FATF) to virtual assets and virtual asset service providers (VASPs) creates an environment permissive to jurisdictional arbitrage by malicious actors seeking platforms to move illicit proceeds without being subject to appropriate anti-money laundering (AML) and other obligations.” Law enforcement entities and “financial intelligence units” will be deployed to help disrupt the ransomware business model, according to the statement. The countries pledged to work together to “counter cybercriminal activity emanating from within our own territory and impress urgency on others to do the same in order to eliminate safe havens for the operators who conduct such disruptive and destabilizing operations.” “We intend to cooperate with each other and with other international partners to enhance the exchange of information and provide requested assistance where able to combat ransomware activity leveraging infrastructure and financial institutions within our territories. We will consider all national tools available in taking action against those responsible for ransomware operations threatening critical infrastructure and public safety,” the countries agreed. Diplomatic efforts were also cited as a way countries can work to disrupt ransomware groups operating in certain regions. The statement said diplomacy can “serve as a force multiplier” for countries that lack the capacity to address cybercrime. The Counter Ransomware Initiative meeting held on October 13 and 14 drew headlines this week for who wasn’t involved, namely Russia. Russia, North Korea, and other countries have been accused of harboring — and in some cases actively helping — ransomware gangs conducting attacks on organizations across the globe. But when asked about Russia not being involved in the summit, the US said it already communicates directly with the country through the US-Kremlin Experts Group established this year by US President Joe Biden and Russian President Vladimir Putin.Darktrace director of strategic threat Marcus Fowler said the summit was important because even countries with relatively low cyberattack rates need to understand that their economies are vulnerable because of their dependence on fragile supply chains.”Ransomware actors are well aware of this; governments need to be too. With any political gathering, the proof is in the commitments and actions that come after. Whether this is a more formal UN resolution or increased scrutiny around cryptocurrency exchanges, combatting ransomware requires a transnational approach and strategy,” Fowler said. “Biden’s warnings and the recent crypto sanctions are solid steps in deterring attacks, especially on our most critical infrastructure — but they will not stop determined, sophisticated hackers from getting in. But accepting that attacks will get in is not accepting failure. As Chris Inglis said in this week’s CISA summit, ‘We want to create the situation where an adversary needs to beat all of us to beat one of us.'” More

ZDNet Recommends

Best security key 2021

While robust passwords go a long way to securing your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.

Read More

Acer has confirmed a cyberattack on its offices in India this week after hackers with the Desorden Group claimed to have breached servers and stolen 60GB of files. The group emailed ZDNet about the hack, claiming to have customer and corporate business data as well as financial information. When asked, the hackers denied it was a ransomware attack and claimed to have access to the company’s servers “over time.”A spokesperson from Acer confirmed the hack, telling ZDNet that their security team recently detected an “isolated attack” on its local after-sales service system in India.”Upon detection, we immediately initiated our security protocols and conducted a full scan of our systems,” an Acer spokesperson said. “We are notifying all potentially affected customers in India. The incident has been reported to local law enforcement and the Indian Computer Emergency Response Team, and has no material impact to our operations and business continuity.” After receiving the message from Acer, ZDNet asked the hackers whether they still had access. “Acer is a global network of vulnerable systems. We no longer have access to their India servers. This is all we can reveal now,” the hackers said in a follow-up message. This is the second cyberattack Acer has suffered this year after being hit with ransomware in March.

The REvil ransomware group claimed the attack and demanded a $50 million ransom, one of the highest reported at the time. Acer offered to pay the group $10 million, which was rejected by the hackers. The Record reported that the data stolen recently by the Desorden Group was posted to cybercriminal forum RAID as well as being sent to reporters. Acer India was hit with a similar cyberattack in 2012 by a Turkish cybercriminal group, according to DataBreaches.net. The attackers defaced the company website and leaked 20,000 user credentials at the time. DataBreaches.net reported last month that the Desorden Group recently claimed to have hacked into the Malaysian servers of ABX Express Enterprise on September 23.Like the latest attack, the group sent reporters portions of the stolen files and posted them into the RAID forum. They claimed to have stolen 200GB of information including the data of millions of Malaysians. In messages to the site, the group said their name stands for “chaos and disorder” and had reorganized after originally going by the name “Chaos CC.”The group said it plans to attack supply chains and cause “disorder and chaos” that affects as many people as possible. The Desorden Group said it plans to hold data ransom and sell it if they are not paid. At the time, they claimed to have been negotiating a ransom with an unnamed Italian automotive supply company.  More

Special feature

Cyberwar and the Future of Cybersecurity

Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.

Read More

HP released its latest Wolf Security Threat Insights Report, finding evidence that cybercriminals are moving even faster in taking advantage of zero-day vulnerabilities and exploiting specific problems like CVE-2021-40444 — the remote code execution vulnerability targeting the MSHTML browser engine through Microsoft Office documents.The HP Wolf Security threat research team first discovered cyberattackers exploiting CVE-2021-40444 on September 8, one week before Microsoft issued a patch. By September 10, attackers had already created scripts designed to automate the creation of this exploit and shared it on GitHub.The devastating attack gives cybercriminals a startlingly easy entry point into systems, deploying malware through an Office document that only needs to be previewed to be initiated. HP researchers compile the report by analyzing the millions of endpoints running HP Wolf Security. In the latest report, the researchers found that 12% of email malware isolated had bypassed at least one gateway scanner and 89% of malware detected was delivered via email, while web downloads were responsible for 11%. The most common attachments used to deliver malware were archive files, which HP Wolf researchers said increased in ubiquity from 17.26% last quarter to 38% this quarter.Word documents are also used in 23% of instances while spreadsheets (17%), and executable files (16%) rounded out the list. The report found that the top five most common phishing lures all used business lingo to lure victims in. Words like  “order”, “payment”, “new”, “quotation” and “request” were used prolifically in attacks. The report found 12% of malware captured was previously unknown.

Alex Holland, the senior malware analyst with the HP Wolf Security threat research team, said the average time for a business to apply, test and fully deploy patches with the proper checks is 97 days, giving cybercriminals an opportunity to exploit this ‘window of vulnerability’. “While only highly capable hackers could exploit this vulnerability at first, automated scripts have lowered the bar for entry, making this type of attack accessible to less­ knowledgeable and resourced threat actors. This increases the risk to businesses substantially, as zero-day exploits are commoditized and made available to the mass market in venues like underground forums,” Holland said. “Such novel exploits tend to be effective at evading detection tools because signatures may be imperfect and become obsolete quickly as the understanding of the scope of an exploit changes. We expect threat actors to adopt CVE-2021-40444 as part of their arsenals, and potentially even replace common exploits used to gain initial access to systems today, such as those exploiting Equation Editor.”
HP
Holland added that his team is seeing major platforms like OneDrive allowing hackers to conduct ‘flash in the pan’ attacks. While malware hosted on such platforms are generally taken down quickly, this does not deter attackers because they can often achieve their objective of delivering malware in the few hours the links are live, Holland explained. “Some threat actors are changing the script or file type they are using every few months. Malicious JavaScript and HTA files are nothing new, but they are still landing in employee inboxes, putting the enterprise at risk. One campaign deployed Vengeance Justice Worm, which can spread to other systems and USB drives,” Holland said. The HP Wolf team also found cybercriminals exploiting Cloud and web providers to host malware as well as multiple malware families being hosted on Discord and other gaming social media platforms. The report outlines how new Javascript malware has been able to slip past detection tools via malicious email attachments. One campaign uncovered by the HP Wolf Security threat research team found cybercriminals pretending to be part of the Ugandan National Social Security fund and using a spoofed web address similar to an official domain name to lure targets to a site that downloads a malicious Word document. According to the report, Trickbot Trojans are also being delivered through HTA files now, which initiate the malware once the file is opened. Ian Pratt, global head of security for personal systems at HP said relying on detection alone will no longer be sufficient because the threat landscape is too dynamic and attackers are increasingly adept at evading detection”Organizations must take a layered approach to endpoint security, following zero trust principles to contain and isolate the most common attack vectors like email, browsers, and downloads,” Pratt said. “This will eliminate the attack surface for whole classes of threats while giving organizations the breathing room needed to coordinate patch cycles securely without disrupting services.” More

Cybercriminals are distributing a new form of ransomware in attacks against victims in which they not only encrypt the network but also make threats to launch distributed denial of service (DDoS) attacks and to harass employees and business partners if a ransom isn’t paid. Dubbed Yanluowang, the ransomware was uncovered by cybersecurity researchers in Broadcom Software’s Symantec Threat Hunter team while they were investigating an attempted cyberattack against a large undisclosed organization.  

ZDNet Recommends

While the attempted attack wasn’t successful, the investigation revealed a new form of ransomware. It also provided insight into how some cybercriminals are attempting to make attacks more effective — in this case, with the threat of additional attacks.See also: A winning strategy for cybersecurity (ZDNet special report).Yanluowang drops a ransom note telling the victim they’ve been infected with ransomware, telling them to message a contact address to negotiate a ransom payment. The note warns victims not to contact the police, FBI or authorities, and not to contact a cybersecurity company — it’s implied that if the victim does this, they won’t get their data back. But the cybercriminals behind Yanluowang go even further with their threats, suggesting that if the victim calls in outside help, they’ll launch DDoS attacks against the victim — overflowing their websites with so much traffic that they’ll crash — and they’ll make calls to employees and business partners. They also suggest that if the victim isn’t cooperative, they’ll return with additional attacks or even delete the encrypted data, so it’s lost forever. “It’s difficult to say if this is a genuine threat. However, it’s certainly in line with what we’re seeing from other ransomware actors who seem to feel threatened by victims calling in law enforcement or sharing information with third parties,” Dick O’Brien, principal editor at Symantec, told ZDNet. 

It’s still unclear how the cybercriminals gained access to the network. Still, researchers uncovered the attack after identifying suspicious use of AdFind, a legitimate command line in the Active Directory query tool. This tool is often abused by ransomware attackers and is used as a reconnaissance technique for exploiting Active Directory and finding additional ways to secretly move around the network, with the ultimate goal of deploying ransomware.  In this case, the attackers attempted to deploy ransomware just days after the suspicious activity was identified — and ultimately, the attempted ransomware attack was prevented because the tell-tale signs of an attack had been recognized and blocked. 

ZDNet Recommends

The best cyber insurance

The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

Read More

Nonetheless, the emergence of yet another new ransomware group, particularly one making additional threats in order to coerce victims into paying ransoms, is an unwelcome development.See also: BYOD security warning: You can’t do everything securely with just personal devices.The ransomware appears to be a work in progress so that it could become more effective in future. However, there are steps that organizations can take to protect their businesses from this threat and other forms of ransomware. “Broadly speaking, they should adopt a defense in depth strategy, using multiple detections, protection, and hardening technologies to mitigate risk at each point of the potential attack chain,” said O’Brien. “Only allow RDP [Remote Desktop Protocol] from specific known IP addresses. We’d also advise implementing proper audit and control of administrative account usage,” he added. Other actions organizations can take to help protect against ransomware, and other cyberattacks include applying security patches as soon as possible, so cybercriminals can’t exploit known vulnerabilities to access the network. Organizations should also equip users with multi-factor authentication tools, so it’s more difficult for cybercriminals to take advantage of breached usernames and passwords. More on cybersecurity More