Another day, another news story about a company having a ransomware attack. Most of the time we are unaffected, and it seems like it couldn’t happen to us. Then we turn on the local news and find that they have become the story, being the victims of a ransomware attack themselves. What we don’t hear as much about are the attacks on people’s personal computers where their digital information is held hostage until they pay the attackers. Ira wanted to talk with us about being proactive vs. reactive and ways to stay out of trouble online.

There are many groups involved in the ransomware attacks. What used to be lone hackers pulling off small attacks has evolved to sophisticated criminal enterprises that are making billions of dollars attacking companies and individuals around the world. Most of the ransomware is written using Russian military code (you can draw your own conclusions from that fact), and most of the hackers operate in Eastern Europe or Russia with the seeming blessing (contrary to the public denials) of the Russian government. The payments to release the data are being made in bitcoin, which is harder for authorities to track. Ira discussed the issue around whether companies should pay the ransom. He stated that there is an “honor among thieves” going on with the hacking groups. They have quite a lucrative business model and it would only take a few rogue groups that take the ransom and then don’t deliver the key to unlock the data to ruin that model for all the groups. The criminals have shown a willingness to police themselves (as funny as that sounds) in this area. As an example, the City of Atlanta was hit with a massive cyberattack in 2018 that effectively shut down most of their city offices, including emergency services (9-1-1 wasn’t working!). They resolved that they would refuse to pay the ransom and would instead employ people to crack the code themselves. Three years later, they are still working to recover their data and have spent millions more than the requested ransom to do so. When it comes to this type of cybercrime, it is hard to take a stand.

Ira showed an example of an alert from the FBI concerning one of the latest types of attacks, a type of ransomware called Ranzy Locker. This is one of the more sophisticated codes being used. The hackers using this can gain access to a user’s Microsoft Exchange Servers and drop the code in in such a way that opening up a basic program like Word or Excel will activate the ransomware. The only way to detect the intrusion is to recognize that a new user account has been created that the user did not create. With this attack, the user account created ends in “.felix”. When a program is opened, a ransom note appears with instructions on how to pay the ransom and gain access back to the locked data. When you follow the instructions and access the website, they will even give you a key code which allows you to unlock three of your files (they get to pick the files) for free, just so you can see how the process works. They warn you not to use a third party to try and decrypt the files for you, and they have safeguards built into the code which will cause all your data to be lost should a third party try to do so.

Ira then showed us some government websites that have very useful information on how to avoid attacks and what you should do if you are a victim of one. Ransomware is ever evolving and becoming more sophisticated daily. Websites hosted by the Secret Service, CISA, and the FBI can all give you information useful to help you be more prepared both at home and in your business. The threat is real, and it is not going away. The best we can do is be prepared.