Ransomware attacks - demand Crypto payments.
A well known form of denial service attack is the Ransomware attack. These attacks have become an industry and are multi-tier attacks and impact business large and small. It goes without saying that Government at all levels Local, State & Federal are Ransomware targets. The other top industries are Healthcare (think lots of data records), manufacturing sites (think robot and robot controls). Attacks are up over 600% since '16.
Most attacks come in via email, that doesn't limit the other methods where they attack the application stack seeking new CVE (Common Vulnerabilities & Exploits) to gain further footholds in Enterprises. Once a victim has launched their attack it rapidly goes to work encrypting your data, local and remote if it can gain access if they can. Once encrypted the attackers demand a Ransom to unlock your data and you have a countdown clock to pay in order to get your data unlocked.
Don't misconstrue my next statements as been fond or or even pandering to these attackers; only pointing their evolving tactics. The attackers are so bold as to encrypt your data then demand a ransom. Typically that ransom must be paid in Cryptocurrencies. That can be a hefty task for those in the US to purchase and then transfer it to the attackers who may or may not unlock their data. I have seen cases where both has taken place. The attackers are savvy and sophisticated as this is big business. Some are as BOLD as to send a survey after unlocking your data. More and more attackers are leveraging AI (Artificial Intelligence) to battle the ever evolving Enterprise landscape (think battling NGFW, Edge monitor, DLP monitors, SIEM Log aggregation, RBAC audits the list goes on and on). Some are as brazen to work together in groups sharing information about targets and penetration successes. Attackers are also attacking your backup data (yes that local copy that might not be air gapped).
Unbeknownst to most in the USA that in Oct. '20 the US Office of Foreign Asset Control (OFAC) passed legislation that states "Paying Ransomware in Crypto Curriencies violates US Law). Which puts the already impacted victims in a very difficult position. So, what's a firm to do?
Rely on the NIST Ransomware framework found here - https://csrc.nist.gov/publications/detail/white-paper/2020/10/01/securing-data-integrity-against-ransomware-attacks/draft as a great place to start to secure your environment. Also my recommendation is to ensure you are running multilayer defenses and always being paranoid! It may not help you fend off attackers at least it a fun way to survive.
Enjoy the Journey!
