During 2017, the WannaCry ransomware attack impacted more than 300 000 people across 150 countries in less than two days. In 2018, criminals are evolving their tactics, including launching well-researched, targeted attacks intended to infect specific, high-value assets known to hold critical data.
In the past few years, ransomware attacks relied on infecting systems by taking advantage of vulnerabilities.
However, in mid-2017 the perpetrators of the NotPetya ransomware attack set a new president by gaining admin credentials, which granted them access to infect non-vulnerable systems that affected almost all accessible systems in the network.
One of the predictions made in the 2018 Cybersecurity Predictions released by Stroz Friedberg, an Aon Company, is that we will continue to see large-scale ransomware attacks that target admin credentials to gain access to, and infect, wider networks.
“With the expected increase in ransomware attacks designed to spread through a network, businesses will urgently need to segment their networks. Companies that fail to do so will be impacted by ransomware attacks at a larger scale than necessary,” warns Kerry Curtin, business unit manager: financial institutions at Aon South Africa.
Attackers are also changing their tactics, utilising forms of benign malware–such as software designed to cause distributed denial-of-service (DDoS) attacks, or launching display ads on thousands of systems– to unleash huge outbreaks of ransomware. Botnet operators will grant ransomware attackers with access to botnet nodes in exchange for payments, allowing them to significantly expand the scope of a ransomware attack.
“While attackers will continue to launch scatter-gun-style attacks to disrupt as many systems as possible, we are also seeing increasing instances of attackers targeting specific companies and demanding ransomware payments proportional to the value of the encrypted assets. This can be quite significant in an event where cyber criminals manage to get their hands on sensitive and distinguishable client information, of which there has been ample, high-profile examples in South Africa,” says Curtin.
To achieve stronger returns in these targeted attacks, criminals will hit environments where access to data and systems is mission critical, such as hospitals, transportation companies and manufacturing companies.
We also expect to see an increase in the use of ransomware to infect IoT devices, which come with a diminished set of security features by default to facilitate out-of-the-box functionality, and users tend to maintain these original settings once the devices start functioning. Stroz Friedberg has already seen the Mirai botnet that harnessed IoT devices to launch DDoS attacks and anticipate ransomware to infect smart thermostats and other smart devices in 2018.
In addition, cryptocurrencies will continue to support the flourishing ransomware industry overall, despite law enforcement becoming more advanced in their ability to trace attacks, for example, through bitcoin wallets.
According to Curtin, companies will have to go beyond the vital step of creating backups, to protect themselves. “Companies will need to utilise systems that can create snapshots in time or maintain multiple versions of files created over the course of the day, to enable restoration to a specific point in time prior to the backup with minimal loss of productivity.
“Security professionals will need to routinely test if their backups allow them to restore the data and files in a specific timeframe to ascertain the downtime the company can withstand if a ransomware attack is realised.
“We will also see more companies recognising the need to implement the Principle of Least Privilege – limiting file access rights for users to the bare minimum permissions they need to perform their work to reduce the number of files that could be encrypted in the event of a ransomware attack. Advanced companies will grant employees only the access needed for the business activities of a specific function, rather than providing automatic access to everything,” she adds.
With perpetrators carrying out wide-scale, profitable, and disruptive attacks in recent years, the number of attackers, the volume of ransomware families, and the number of infections increased dramatically. The trend is continuing, with attackers launching large-scale attacks, but also evolving their tactics to implement targeted attacks with demands for greater payments proportional to the value of the assets. This activity will be supported by the continued rise of cryptocurrencies.
The following questions from Stroz Friedberg will give an indication on how risk ready your organisation is to face a ransomware attack:
* When was the last time you reviewed your company’s patch management program? Your disaster recovery and business continuity plans?
* Can you identify where all of your mission critical data resides and whether regular backups are being made?
* Does your cyber insurance policy provide adequate coverage? Have you taken the necessary steps to ensure you will be eligible to make a claim if your company is impacted?
* Have you communicated with employees about the latest phishing and social engineering techniques?
* Do you have an incident response plan in place and has it recently been tested so everyone knows what to do in the event of an attack?
* Are all necessary technical and procedural controls in place and operating properly?
* Has your security posture recently been assessed and tested and have you acted on the results?
“Whether you are a big or small operator, your company’s ability to protect against and recover from ransomware attacks rely on implementing proactive technical measures and business continuity plans,” Curtin says. “That is why you need a qualified risk advisor by your side who is able to take your business through a comprehensive cyber risk assessment in order to mitigate the risk of unwarranted access to your most crucial data.”