When a cyber threat grows in magnitude by 35 times in one year, and continues to become even more prevalent the next, every organization should pay attention. This is exactly what happened with ransomware. Cyber criminals have targeted organizations from many different industry segments, as well as businesses of virtually every size. Ransomware-as-a-Service (RaaS) and other kit-like tools have lowered the entry bar for cyber criminals, enabling even novice attackers to be successful against scattered security infrastructures. And monetary technologies like bitcoin make it virtually impossible for law enforcement authorities to track ransom payments. With the exponential growth in ransom paid to ransomware groups, the prospect that this will continue—and at a faster rate—in coming years is great. Recognizing the growing threat, banks are stocking up on bitcoin so their customers can quickly pay cyber criminals to unlock hacked data. The Runaway Ransomware Threat FortiGuard Labs analysis of global data showed a substantial increase in overall ransomware activity in the second half of 2020, compared to the first half. In fact, FortiGuard Labs analyzed the activity for all signatures that it has classified as ransomware, which showed a sevenfold increase in ransomware activity in December compared to July 2020. Among the most active of the ransomware strains in the second half of 2020 were Egregor, Ryuk, Conti, Thanos, Ragnar, WastedLocker, Phobos/EKING, and BazarLoader. Each of these exhibited varying degrees of prevalence, but the common trend among them was an increase in activity over the period. Threat actors have discovered that cryptolocking critical systems and demanding a ransom for the decryption key is a relatively easy way to extort money from organizations regardless of size or the industry to which they belong. This more targeted and sinister form of ransomware scheme has come to be known as “big game hunting.” It’s been all the rage with the ransomware gangs throughout 2020, and the larger paydays netted by such schemes virtually ensure the trend won’t go away anytime soon. Many adversaries took advantage of the disruptions caused by the COVID-19 pandemic to ramp up ransomware attacks against organizations in the healthcare sector in particular. In October, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services, and the FBI issued a joint advisory warning U.S. hospitals and healthcare services of increased ransomware activity involving TrickBot and BazarLoader malware. Other sectors that were also heavily targeted in ransomware attacks in 2H 2020 included professional services firms, consumer services companies, public sector organizations, and financial services firms. Multiple trends characterized the ransomware activity that FortiGuard Labs and others observed in the last half of 2020. One of the most troubling was the steady increase in ransomware attacks that involved data exfiltration and the subsequent threat to release the data if a ransom was not paid. The use of data theft as additional leverage in ransomware campaigns really only emerged as an adversary tactic in early 2020, but became part of a majority of attacks by the end of the year. The operators of most major ransomware strains, including Sodinokibi, Ryuk, Egregor, and Conti, all deployed data exfiltration as part of their standard operations last year. Some reported incidents were attacker (sometimes false) claims of data theft to try and scare victims into paying a ransom. In many cases, when victims paid to get attackers to delete stolen data, the attackers reneged and instead leaked or sold the data to others anyway. For organizations, the trend means that robust data backups alone are no longer enough protection against ransomware demands. How Ransomware Happens Distribution of Ransomware So, how does ransomware happen? Let’s begin by addressing how it is distributed. Any digital means can be used: email, website attachments, business applications, social media, and USB drivers, among other digital delivery mechanisms. Email remains the number one delivery vector, with cyber criminals preferring to use links first and attachments second. In the case of email, phishing emails are sent as delivery notifications or fake requests for software updates. Once a user clicks on the link or the attachment, there is often (but less so recently) a transparent download of additional malicious components that then encrypt files with RSA 2048-bit private-key encryption, leaving it nearly impossible for the user to decrypt the files. In other instances, ransomware is embedded as a file on a website, which when downloaded and installed, activates the attack. Types of Ransomware Ransomware attacks come in different forms. This past year has seen a substantial evolution in ransomware attacks. Traditional ransomware goes after data, locking files until the ransom is paid. But as mentioned above, with the rapid growth in Internet-of-Things (IoT) devices, a new strain of ransomware emerged. It doesn’t go after an organization’s data, but targets control systems (e.g., vehicles, manufacturing assembly lines, power systems) and shuts them down until the ransom is paid. Let’s take a quick look at some of the most prevalent types of ransomware that exist today: • Off-the-shelf ransomware. Some ransomware exists as off-the-shelf software that cyber criminals can purchase from darknet marketplaces and install on their own nefarious servers. The hacking and encryption of data and systems are managed directly by the software running on the servers of the cyber criminal. Examples of off-the-shelf ransomware include Stampado and Cerber. • Ransomware-as-a-Service. CryptoLocker is perhaps the most well-known RaaS model. Since its servers were taken down, CTB-Locker emerged as the most common RaaS attack method. Another RaaS that is rapidly growing is Tox, a kit that cyber criminals can download. The result produces a dedicated executable file that can be installed or distributed by the cyber criminal, with 20% of gross ransoms being paid to Tox in bitcoin. • Ransomware affiliate programs. The RaaS model uses affiliate hackers with a proven track record to spread the malware. • Attacks on IoT devices. Ransomware infiltrates IoT devices that control systems critical to a business. It shuts down those systems until a ransom is paid to unlock them. Interestingly, in addition to polymorphic code, ransomware often uses metamorphic code to change its digital identity while operating the same way. This rapid growth and constant evolution make it even more difficult for organizations that rely on traditional signature-based antivirus solutions to keep pace. By the time one strain has been identified and blacklisted, cyber criminals have already moved to a new variation. The Ryuk and Sodinokibi ransomware families, for example, both contributed to an increase in the ransom amounts demanded by attackers in Q1 of 2020. Ransomware Targets Virtually every operating system is targeted by ransomware today. Attacks also extend to the cloud and mobile devices. The cloud had been left largely untouched by ransomware, so it’s a new market opportunity for hackers. Cyber criminals also target nearly every industry. In 2020 alone, CISA issued alerts about ransomware targeting pipeline operations, healthcare, the public sector, K-12 schools, and more. Another recent strategy of ransomware hacktivists is to target and compromise vulnerable business servers. “The DearCry ransomware targeting the newly discovered vulnerabilities in Microsoft Exchange in early 2021 is a good example of this tactic, as well as demonstrating the agility of cyber criminals.”6 By targeting servers, hackers can identify and target hosts, multiplying the number of potential infected servers, and devices on a network. This compresses the attack time frame, making the attack more viral than those that start with an end-user. This evolution could translate into victims paying more for decryption keys and an elongation of the time to recover the encrypted data. Conclusion The financial impact of ransomware is much larger than just the ransom being paid to cyber criminals. Downtime translates into thousands, hundreds of thousands, or even millions of dollars in lost revenue and productivity. Organizations across multiple industry sectors can attest to these implications. Piecemeal approaches to security are not sufficient to thwart ransomware attacks. Integrated models enabling layered security using next-generation firewalls (NGFW), modern endpoint security, and more are required. These security controls must also use proactive threat intelligence when mounting a defense against cyberattacks.

Do you know what is happening on your network? Do you receive notifications about suspicious behavior on your network? Do you have security protocols in place to block the exfiltration of sensitive data on your network? What about unwanted surveillance, do you have a way to ensure you are not being watched? Are you data communications encrypted? Can your data be intercepted? If it is intercepted, will it be usable? These are the important questions that the average home network user does not have answers to, nor have they typically considered. That is why the work we do is so important. The home network exposes a soft underbelly to an otherwise formidable foe. Businesses are secured with the latest and greatest in enterprise cybersecurity hardware, software, and knowledge. What happens when the users of the enterprise networks go home? Home to their neglected and overlooked home network. A network supported by vulnerability filled consumer grade technology built by foreign companies and operated with reckless abandon. As we saw in the Wikileaks files, even our own government has developed techniques and tools to circumvent the limited security of the home network to surveil and track our fellow citizens. All on a scale that is shocking to the uninitiated. OPSEC will armor this underbelly. Protection from all enemies, foreign and domestic. OPSEC is the only grass-roots independent cybersecurity firm that is capable of taking on such a task. All our technicians and solutions are vetted to ensure transparency and so that we can deliver peace of mind to our customers. Our principles encompass moral integrity and constant refinement and enrichment of the individual. We require secure moral compass and intestinal fortitude of our operators. Secure operators ensure secure operations with uncompromising moral integrity and discretion. Talk with a cybersecurity operator about how we can help you answer some of the aforementioned questions today! Click Here.

Cyber Security has become one of the biggest concerns for business. Business and Enterprise have increased their spending to an incredible 150 billion dollars in 2021, according to a recent Gartner study. The driving force is to secure remote workers and the ever expanding digital footprint of business. Emerging threats from foreign nation-state actors, ransomware enthusiasts, and even our own governments have spurred a renewed imperative to secure operations. But, what about your home network? You the individual have a right to know that your home network is secure from unwanted digital communication, wire-tapping, and data harvesting. What is the individual person to do about ransomware and other emerging threats that can cripple and decimate a network that isn't backed by enterprise grade cyber security technicians? The average home user does not have the budget to implement the security countermeasures warranted by such insurmountable threats. Gartner did not include recent security events that spurred further spending. This spending was to remediate and secure vulnerable systems from real world bad-guys. These events likely pushed the annual spend closer to 200 billion dollars. This year saw one of the biggest cyber security compromises of recorded history. The SolarWinds/FireEye hack took everyone by surprise and exposed some very real vulnerabilities that were overlooked by even the most prepared security teams. Complacency is to blame. Furthermore, the Microsoft Exchange Server vulnerability gave cyber criminals access to confidential and encrypted communications from some of the highest levels of government and enterprise. These vulnerabilities exist in the enterprise environment due to the shear complexity of modern business. These same exploits do not pose a risk to the average home user. However, home users typically deploy consumer grade hardware to create the home network. These consumer grade devices are full of vulnerabilities that are easily exploited. There are an estimated 110 million individual home networks in the U.S. as of 2017 and those numbers likely exploded in 2019 during the COVID-19 lockdown and stay-at-home orders. There is a new imperative to secure America; American business, American homes, and American data. The majority of business and government compromises come from the individual. Social engineering and phishing attacks are some of the most effective. Even if you have the latest and greatest in enterprise cyber security hardware, software, and technicians, the users of the network, the people that access the critical data can often be exploited and it is often at home. The home network presents a unique opportunity for cyber criminals and a blind spot for most cyber security teams. Users have personal email accounts, social media, and a digital footprint all of their own. The security of this footprint is the responsibility of the individual and so is subject to their individual cyber security acumen or lack thereof. The average home user does not typically consider vulnerabilities and exploits when they purchase their home network equipment. Even with the hardware recommendations of cyber security professionals, the average home user does not have the skills or time necessary to monitor, control, or implement cyber security countermeasures. The gaping hole in the American cyber security defense becomes ever expansive. OPSEC aims to patch this vulnerability, house by house. By securing the home network, we secure America. Applying enterprise grade technology and solutions to the average consumer's home network. Supplying enterprise grade cyber security technicians and experience to provide solutions to common home network vulnerabilities with cost effectiveness at the forefront. OPSEC already secures businesses with our Network Operations Center and Security Operations Center. Staffed 24x7 and redundant, OPSEC is poised to supply enterprise IT solutions at massive scale. This easily scalable model can be pointed at any network, business or home. OPSEC had zero systems compromised during 2019, 2020, and 2021. OPSEC looks to spread our impeccable track record to the consumer market and make America secure from all enemies, foreign and domestic. Talk to a cybersecurity technician today. Click Here.

New executive orders on cybersecurity have been signed. What does it mean for you? It means it is time to invest in the much needed infrastructure upgrades that your cybersecurity consultant has been telling you that you need. If you already listened? Good job, you've done what you are supposed to do. If you, like many of your peers in the private sector, have postponed these upgrades, the time to act is upon us. Constant threat of infrastructure compromise is no longer reserved for systems of high value. In the wild, OPSEC technicians have observed nation state actors attempting to compromise new systems on new internet circuits with brand new IP blocks within seconds of initial interconnection. While most attempts seem to be simple brute force attacks that are "shotgunned" en masse to all known public IP blocks, there is a very serious component behind it. Just like the triage of IT support tiers, these nation state actors pass compromised systems up to higher levels and to technicians with far greater knowledge and skill. So what started as a simple brute force that got lucky with a weak password, soon becomes a compromise on the scale of the SolarWinds incident in a nanosecond. What is rational person to do in these dire times? Secure your operations. If it plugs in, it needs to be secured against all possible attack vectors, known and unknown. Now is not the time for half-measures. The theory of "just good enough, is good enough" is wrong. It is easier to stop a fly from intruding through a pinhole than it is to bar its entry through an open door. Implementing automation, zero day countermeasures, and behavior analytics are a great start. But true security is multi-layered, redundant, and disaster resilient. So, not only do you have sensors and AI monitoring the pinhole for anything suspicious. You should also have 24x7 staff of fly-swatting enthusiasts jacked up on coffee and general contempt for all fly-kind. This team should further be supported by bug spray, glue traps, poisoned honey-pots, and a claymore as a last ditch failsafe insurance policy. These nation state actors don't play. Neither does OPSEC.

submitted by /u/Megabeets [link] [comments]

submitted by /u/Struppigel [link] [comments]

submitted by /u/ujeio [link] [comments]

submitted by /u/zenomeno [link] [comments]

submitted by /u/navneetmuffin [link] [comments]