Large, sophisticated corporations and government agencies have been mercilessly attacked by ransomware. Here is a look at some that have been hit around the world.  

Ransomware attacks have become increasingly prevalent throughout the world. At one time, only small companies were the only ones at risk. This may be because they were not savvy about the real dangers, and didn’t put cyber security in place. Now, even large, sophisticated corporations and government agencies have been mercilessly attacked. Here is a look at some of the firms and agencies that have been hit around the world.

Russia’s Largest Oil Company

In 2016, Russia’s largest oil company, with a majority owned by the Russian State, was named the 51^st largest corporation in the world. Sales are estimated at over $64 billion annually.

On June 27, 2017, this company disclosed that it had been hit by the most recent ransomware attack, said to closely resemble the devastating “Wannacry” attack that was carried out just last May of 2017. With that much sales in jeopardy, the Russian oil company probably does wanna cry. A Russian-based cyber security firm estimated that roughly eighty companies in Russian and Ukraine were affected. However, the damage wasn’t limited to Eastern Europe, as seen by the following other companies that were affected.

Corporate Snack Brand

A corporate giant and traded stock company that owns famous snack brands was forced to take its systems offline in response to a “serious global cyber incident.” It’s likely that the perpetrators of this were not just having a “snack attack,” but are in hot pursuit of something far darker than the darkest chocolate.

Global Pharmaceutical Firm

One of the world-renowned pharmaceutical firms that are worth untold billion was also hit by a ransomware attack. Corporate executives announced Tuesday that their firm, too, had been somehow breached by this latest attack. Unlike a pharmacy break-in, a lot more than prescription drugs are at stake.

Global Shipping Company

One of the subsidiaries of a global shipping company was another victim of the latest ransomware attack on June 27, 2017. The subsidiary’s deliveries were disrupted, leaving over 200 countries affected by undelivered packages.

What is Ransomware?

Ransomware is malicious code that holds company files and data hostage until a certain sum of money is paid to the perpetrator. Just like in a real world ransom scenario, the “goods” won’t be handed back until the ransom is given over. Also as in real world ransom scenarios, there’s a risk that the “goods,” or the data in the case of ransomware, will be harmed while in possession of the “kidnappers.”

When the extorted party gets the files back, there is no way of telling what other kinds of breaches have occurred. Since there are usually billions or more lines of code, it would be nearly impossible to tell if the files were infected with spyware, or some other kind of future ransomware virus, ready to defer to a date in the future.

Another risk with the ransomware scenario is that the files won’t actually be returned, even after the money is paid. In the case of the recent attack, logic would seem like the perpetrators would return the files. If one company paid and didn’t get their date back, word would quickly spread and other companies wouldn’t pay the ransom. For that reason, in many ways, it behooves the hackers to return the files in the same condition in which they stole them; however, the “operating code” of hackers is obviously not ethically bound.One thing is sure. If any of these companies do end up paying the ransom, it won’t be widely reported in the press, if at all. It’s unlikely that a giant corporation would want to admit that it a) hadn’t backed up its systems, and b) went against all professional advice to not pay, and c) paid out millions to criminals.

Will Major Firms Pay the Ransom?

Whenever something is taken for ransom – be it a person, property or, as in this case, digital data – authorities strongly advise against paying the ransom. Paying ransom does perpetuate the problem. When hackers see that they can steal data and profit by it, they are thus encouraged to rinse and repeat. The prevailing advice is that corporations back up their data, plug holes and monitor for suspicious activity. But this is like telling someone who just had their wallet stolen that to get their wallet back they should put extra money someplace else, hide their wallet and look out for suspicious characters lurking in alleyways. That advice doesn’t actually help get the wallet back. Basically, if a large corporation hadn’t taken those precautionary steps before the ransomware attack, and the lost data would put them out of business, they are going to pay the ransom. Hackers know this, and that’s why ransomware works.

The Only Answer is in Prevention

The only solution to a ransomware attack is to live and learn and spread the word. The more willing these corporations are to admit that they got hit, the better prepared other companies are likely to be. While it’s embarrassing for a giant pharmaceutical firm to admit that they were fooled, it’s ultimately better for the rest of us to learn that even the big guys are not infallible to cyber threats.

Prevention measures must include redundancy, as a number one priority. That one step would, 1) prevent the loss of critical operating data, and 2) enable overwriting of any malicious code that might have been introduced into the data while it was in the hands of the hackers. Backing up files so there is a minimum of one extra copy is good. Two backups is even better.

The next prevention measure involves making sure virus software is up to date with plug-ins. Literally, the company’s IT department should be checking daily, if not hourly to install available updates that are designed to plug security holes.

Finally, monitoring activity must be done continually. These ransomware attacks leave prints, and they are detectable by watchful IT experts. If vigilance is practiced, future attacks could be kept to a minimum, or even prevented.

Contact {company} in {city} at {email} or {phone} to learn more about protecting your company.

Reports have begun to pour in regarding a new ransomware infection currently wreaking havoc in Russia, Ukraine, France, Spain, and several other countries. This highly sophisticated Russian strain is known as Petya or Petrwrap, and it has been advancing on a scale comparable to the recent WannaCry ransomware infection. However, unlike WannaCry, this strain lacks both the errors WannaCry contained as well as lacking a kill-switch.

A wide range of businesses have reported being hit with this infection, with victims receiving the following message: “If you see this text, then your files are no longer accessible because they are encrypted. Perhaps you are busy looking for a way to recover your files, but don’t waste your time. Nobody can recover your files without our decryption service.” Sources state that the message appears as red text on a black background, and demands $300 worth of bitcoin in exchange for the decryption key.

While it has not been completely confirmed as of yet, Petya/Petrwrap looks to be taking advantage of the EternalBlue exploit, which was leaked by a group known as The Shadow Brokers. If EternalBlue sounds familiar to you, it should – it’s the same exploit WannaCry took advantage of.

If you haven’t already, you should be taking steps to protect your business against this exploit by installing the MS17-010 security update from Windows (which you can find here) and checking to see that your systems are fully patched. Like WannaCry, Petya/Petrwrap has the ability to compromise systems that are firewall protected. As this is a true worm, if the infection is able to reach a single computer within your network all of your systems and servers are at risk of becoming infected.

Take a moment to remind your staff that they need to be exercising extreme caution at all times when checking their email. If anything even slightly suspicious finds its way into an employee’s inbox, they need to know how to handle the situation and who to alert. All it takes is one mistake for your business to suffer serious damage, and events like this serve as an ugly reminder that a certain level of vigilance is required at all times to keep your business secure.

If you have concerns or want to find out more about what you can do to protect your business in the wake of this latest ransomware attack, please contact {company} right away at {email} or {phone}. Our team is here to help.

Unless you happen to be a cyber criminal, ransomware is bad news. So for the rest of us who might have a run in with a cyber criminal who uses ransomware as a method for extortion, it’s important to know what to do and how to handle such situations. Thankfully, we’re going to provide such tips to stop an individual from holding your data ransom and how to prevent them from getting away with their crime.

What’s Ransomware?

Ransomware is known as a form of malware that either blocks access to your files (via encryption) or holding your computer hostage. Once a person is infected with ransomware, they’re usually ordered to pay a ransom in order to retrieve their data. Since the ransom can usually range between hundreds or thousands of dollars, many individuals who are unprepared for such attacks end up paying the amount and suffer the financial setback – regardless if get their data after paying the ransom.

How Ransomware Is Spreading & Evolving

With ransomware finally receiving national attention on the news, it’s safe to say that it’s only evolving and becoming more common in the future. This is mostly due to the fact that cyber criminals are utilizing modern technology that make the most dangerous links seem completely harmless.

One specific ransomware strand that has been causing concern has been CDT-Locker. Being incredibly hard to detect, CDT-Locker is capable of hiding in files and going unnoticed by security software. To make them even more threatening, hackers have managed to get people to download such files by utilizing tricks that make them seem harmless. An excellent example would be a hacker (posing as your utility company) claiming that they are about to shut off your power if you don’t fill out a form. Another example could be a hacker utilizing social engineering tactics (to pose as a contact you know) to get you to click on a link via email.

To make matters even more bothersome, cyber criminals will even use newsgroup postings and social media to post their malicious codes. By taking advantage of human reactions, cyber criminals have no problem benefiting making money at another’s expense.

What To Do In A Ransomware Attack

There’s a few guidelines one should follow in the event of a ransomware attack. Such guidelines are:

1. Regardless if you’ve found a questionable file or received a pop-up window demanding payment, the first thing you’ll want to do is to contact law enforcement. Although it’s likely that they might not be able to offer immediate assistance, they should be notified of what’s going on in regards to your attack. Once you’ve contacted the police, contacting the FBI is necessary so they can begin to take action on the matter.
2. The next thing you’ll want to do is to contact your service provider. Make them aware of your situation so they can take action and rectify the issue. Doing so not only makes it easier for them to solve your problem, but this helps them prevent ransomware attacks in the future.
3. The third thing you’ll want to do is to turn off the infected computer and disconnect it from any networks that it could be connected to. By containing the malware, you can prevent further damage to other computers within your network. Many individuals do not know that ransomware can take down an entire network of computers if the infected computer remains on the same network, so removing the infected computer from the network is necessary to stop the problem.
4. The final step is up to you – if you weren’t prepared for a ransomware attack beforehand. If you end up paying the ransom, it is possible that you might not receive your data and end up with a financial setback that could happen again. for example: the cyber criminals already got you once, what would prevent them from attacking you once more? In addition to this, cyber criminals tend to want payment in bitcoins or over the Tor network, since these methods of payment are virtually untraceable. Caving in to the ransom not only makes their illegal acts easier in the future, but it allows ransomware to become much larger problem in the future.

However, if you have been backing up you files and information via the cloud or through physical drives, you won’t have to suffer such traumatic experiences. By having this upper hand in a ransomware situation, the cyber criminals remain powerless since they don’t have anything that you don’t already have in your possession.

So regardless if you happen to be a small business or a large corporation in {city}, it’s important to back up your files to avoid such severe circumstances. Thankfully, {company} is here to solve your problem. Since a few hours of backing up information on other platforms can save you hundreds of dollars (and time lost medicating headaches during the ordeal), preparing for such situations is one of the the best ways to combat and prevent the event of a ransomware attack. Contact us by {email} or {phone} today so we can save your business a lot of hair pulling in the future.

Flash Back Friday: The World’s First Spam

The word “spam” has quite a different meaning in today’s technology-focused world than it did even just a few decades ago. When you hear about spam, you probably don’t think about the weird, textureless, “spiced ham” that was an inexpensive staple of meals closer to the mid-twentieth century; nor are you likely reminded of Monty Python’s infamous “spam and eggs” sketch.

When you hear about spam today, your first thought is probably of digital junk mail – outrageous sales offers, phony claims of being able to make thousands of dollars a week working from home, solicitations from less-than-legit dating sites, etc.

While our spam folders generally keep such content out of our inboxes today, have you ever wondered about when it all began?

In terms of actual digital spam, the first instance is believed to have taken place in 1978, when DEC salesman Gary Thuerk “spammed” 400 or so users on ARPANET. However, if you define spam as simply an unsolicited communication, the history goes a bit further back. More than a century further back, in fact.

As we all know, in 1864, there was no email or ARPANET. So, if a scammer wanted to deliver unsolicited messages to unsuspecting recipients, they had to do it by telegram, and that’s exactly what dentist Messrs Gabriel did. In order to advertise that his practice would be open from 10 am – 5pm, Gabriel sent telegrams to several British politicians, who, given the fact that telegrams were usually time sensitive and important in nature, were less than pleased to have been contacted for something so inconsequential.

In fact, many of them were angry enough to write to The Times about it: “I have never had any dealings with Messrs Gabriel, and beg to know by what right do they disturb me by a telegram which is simply the medium of advertisement?” wrote one of the recipients.

So by this definition, spam is now more than 150 years old as a method of advertisement – does it make you as mad today as it did the politicians who wrote to The Times about it?

Keep an eye on our blog for more Flash Back Friday articles. For information about spam filters and other IT solutions, be sure to get in touch with Inspired IT at {phone} or {email} right away.