India amongst the top 10 countries susceptible to SAMSAM
By MYBRANDBOOK
Sophos has released an in-depth investigative white paper on the SamSam ransomware attacks that first appeared in December 2015. Titled “SamSam: The (Almost) Six Million Dollar Ransomware”, this white paper aims to provide a comprehensive understanding of this unique ransomware attack by summarizing key findings about attacker’s tools, techniques, and protocols.
SamSam is a thorough encryption tool, rendering not only work data files unusable but any program that is not essential to the operation of a Windows computer, most of which are not routinely backed up. SamSam’s attacking method unique as it is manual and as a result, attackers can employ countermeasures (if needed) to evade many security tools. If the process of encrypting data is interrupted, the malware is capable of comprehensively erasing all trace of itself immediately, hindering any investigation. Furthermore, recovery from the attack may require reimaging and/or reinstalling software as well as restoring backups. As a result, many victims were not able to recover sufficiently or quickly enough to ensure business continuity, and had to pay the ransom.
Peter Mackenzie, Global Malware Escalations Manager, Sophos, says, “Most ransomware is spread in large, noisy and untargeted spam campaigns using simple techniques to infect victims and demand relatively small sums in ransom. What sets SamSam apart is that it’s a targeted attack tailored to cause maximum damage and ransom demands are measured in tens of thousands of dollars. The attack method is surprisingly manual, and more cat burglar than smash-and-grab. As a result, the attacker can employ countermeasures to evade security tools and if interrupted can delete all trace of itself immediately, to hinder investigation.”
SamSam’s relentless attack methodology combined with the growth in Ransomware-as-a-Service and the anticipation of the ever-evolving threat landscape, emphasizes the need for a layered and synchronized cybersecurity approach for businesses of all sizes.
Intrusions from exploits have been persistent and are still a prominent threat to businesses and often go undetected for months. Once inside a system, cybercriminals use complex malware that can hide in memory or camouflage itself. In many cases, businesses do not know they’ve been breached until someone finds a large cache of stolen data on the Dark Web.
Sophos recommends the following top four security measures:
* Restrict access to port 3389 (RDP) by only allowing staff who use a VPN to be able to remotely access any systems. Utilize multi-factor authentication for VPN access
* Complete regular vulnerability scans and penetration tests across the network; if you have not followed through on recent pen-testing reports, do it now
* Activate multi-factor authentication for sensitive internal systems, even for employees on the LAN or VPN
* Create backups that are offline and offsite, and develop a disaster recovery plan that covers the restoration of data and whole systems
Singapore to remove One-Time Passwords from Bank Accounts
According to the Monetary Authority of Singapore, clients who utilise secur...
Is 375 million Airtel subscribers database breached?
When a hacker claims to have accessed and put up for sale a customer databa...
The government of India intends to construct a single portal f
A single portal will be launched by the Indian government to list all of it...
OpenAI offers GPT-4o, a faster model available to all users at
GPT-4o, a faster and more sophisticated AI model, is made available to all...
Icons Of India : CP Gurnani
Former Managing Director and CEO of the well-known IT service company ...
Icons Of India : Bhavish Aggarwal
Indian entrepreneur Bhavish Aggarwal is the CEO of Ola, India’s larg...
Icons Of India : Dr. Arvind Gupta
Arvind Gupta is the Head and Co-Founder of the Digital India Foundatio...
C-DAC - Centre for Development of Advanced Computing
C-DAC is uniquely positioned in the field of advanced computing...
STPI - Software Technology Parks of India
STPI promotes and facilitates the growth of the IT and ITES industry i...
IREDA - Indian Renewable Energy Development Agency Limited
IREDA is a specialized financial institution in India that facilitates...
Indian Tech Talent Excelling The Tech World - Soni Jiandani, Co-Founder- Pensando Systems
Soni Jiandani, Co-Founder of Pensando Systems, is a tech visionary ren...
Indian Tech Talent Excelling The Tech World - Thomas Kurian, CEO- Google Cloud
Thomas Kurian, the CEO of Google Cloud, has been instrumental in expan...
Indian Tech Talent Excelling The Tech World - Sanjay Mehrotra, CEO- Micron Technology
Sanjay Mehrotra, the President and CEO of Micron Technology, is at the...