The rise of ransomware
Connecting state and local government leaders
With thousands of new modifications, the lucrative malware is not going away any time soon.
Earlier this month, the sheriff’s department in Carroll County, Ark., was hit with ransomware -- another victim in a year-long trend of attacks that lock organizations large and small out of their own files.
Lt. Daniel Klatt said the Carroll County Sheriff’s Office paid about three bitcoins to get its data back, the equivalent of about $2,400, according to the Associated Press. The attack occurred on Dec. 5, and the system was operational within a week.
Other victims of ransomware have been able to get their systems back up and running without paying the ransom. When the San Francisco Municipal Transit Agency, known as Muni, was targeted with ransomware in November, the agency was able to restore its data using backup systems.
“The SFMTA has never considered paying the ransom,” Muni spokesperson Paul Rose told GCN in an email.
“Upon discovering the malware, we immediately contacted the Department of Homeland Security to identify and contain the virus,” he said. “We have an information technology team in place that can restore our systems, and that is what they are doing.” The transit agency is “working closely with the FBI and DHS to fully investigate this matter and to help them identify a suspect,” he added.
These are just two examples among the growing number of ransomware attacks that have affected not just government agencies, but hospitals, educational institutions and private businesses. That is why Kaspersky Lab dubbed the money-making malware operation the “story of the year” for 2016.
“A lot of threat actors are using this kind of malware because it has a clear monetization strategy,” said Anton Ivanov, senior malware analyst and anti-ransom researcher at Kaspersky.
Ransomware as a service has also become more common as the malware authors offer their product on the market. “This approach has proved immensely appealing to criminals who lack the skills, resources or inclination to develop their own,” Kaspersky’s security bulletin said.
There were 44,287 new ransomware modifications in 2016, according to Kaspersky. The most common variant, known as Locky, spread across 114 countries.
Guarding against ransomware is very much possible, Ivanov said in an interview, and the advice is the same for government and private business.
Protection starts with installing a security solution on every network endpoint and every server that is connected to the internet, he said. Currently, behavioral detection components are the most effective way to detect ransomware, so organizations should find a security solution that includes this feature. “Also to prevent infection with ransomware, the security solution should have components that can analyze web traffic and email attachments,” he said.
Ransomware frequently gets downloaded to a network after a single user clicks on a malicious link or file in a phishing email. Ivanov echoed advice from other experts that training employees on email hygiene is important, but having a security solution that monitors email can help take some of the weight off of employees.
If a company does get attacked by ransomware, Ivanov advises not paying the ransom, the position also advocated by the FBI. According to Kaspersky, one in five victims who pay ransom don’t get their data back.
A security company may be able to help victims crack sloppy encryption used by
copycat actors. “Threat actors can make mistakes in their encryption,” Ivanov said. “There are companies out there that can break these algorithms and get data back.”
Even if an organization can’t get its data back, it should save its locked files because keys for malware are occasionally published, which can give victims a way to regain access to their information. Victims should also consider having a cyber forensic expert look at the attack because threat actors can leave behind metadata that can prove helpful to other investigations or tracking trends, Ivanov said.
Kaspersky has worked with the Dutch National Police, Europol and Intel Security to create nomoreransom.org, a website that provides advice on preventing ransomware and tools to decrypt already infected files.
As the year comes to a close there are still newer variants of ransomware. One version, named Popcorn Time and described by Wired as “diabolical,” gives its victims the ability to forego paying the ransom if they share the malicious app. If two others download the app and become infected, then the data on the original device is unlocked while the newly infected are left to decide whether they should pass along the link or pay up.
But just because the calendar year is ending doesn’t mean the creativity of threat actors will slow in the new year. “It was the main trend this year and it will be the main trend next year,” Ivanov said.
NEXT STORY: Are states ill-equipped to manage cybersecurity?