Ransomware Attacks and How Lumu Helps

Watch the news these days and you will find a particular word show up recurrently, one that creates anxiety among business leaders and cybersecurity practitioners alike: ransomware. Regardless of your organization’s vertical or its size, everybody who uses a computer for business or leisure should be aware of it. There is an evil out there trying to get into your infrastructure just to encrypt your most important asset: your information.

We don’t mean to bore you with stats but if you thought the problem was not bad enough, take a look at these stats which speak for themselves. If you already know how bad (and we mean pretty bad) it is, you may skip this paragraph. According to Kaspersky there were 174 ransomware attacks against cities and towns in 2019. Cybersecurity Ventures estimates that the global cost of ransomware will reach $20 billion by next year and Malwarebytes reports that Ryuk detections increased by 543% over Q4 2018 and Sodinokibi increased by 820% since its introduction in May 2019. That means that the problem is not going away but is increasing dramatically. 

The situation is so out of control that a new job title is emerging: “Ransomware Negotiators”. This new role is helping organizations to scale down financial demands, arrange payments, and try to restore encrypted data. This certainly shows that we are tackling the problem in the wrong way and that we need to change our mindset and strategy.

First: The Basics

By definition, ransomware is a type of malware that encrypts victims’ information and demands a ransom to return the information to its original unencrypted state. Even though this definition differentiates this type of malware from the huge amount of samples out there, there are still several behaviors that belong to particular ransomware malware families. Understanding these behaviors is the first step to successfully mitigate the attack, so let’s dig into the details.

Let’s review three real-life examples and how Lumu has helped organizations prevent ransomware attacks from materializing, and keep you out of the news cycles.  

Case Study 1 – WannaCry Ransomware Attacks

In May of 2017, a massive cyberattack was spotted affecting thousands of Windows machines worldwide. The impact of this attack was not only its ransomware nature but also its ability to spread quickly across networks thanks to the ‘eternalblue’ exploit discovered several months before the outbreak. 

This looks like a forgotten story but it is far from over. At the time this attack took place, it was only a matter of time for security experts to identify a killswitch to stop the havoc. Thanks to experts’ efforts, WannaCry is out of the front pages, for now. However, it is still worrisome to find that even today this threat remains at the top of detections by AV vendors. So are we really safe?

Well, let’s see. Taking into account its MITRE ATT&CK matrix, the “Exploitation of Remote Services” (T1210) is a behavior used by several different attacks including Emotet, NotPetya, and PoshC2, among others. So even if your files are no longer encrypted by WannaCry, if your infrastructure has been infected by this worm it is a clear sign of how vulnerable you are against even more nefarious trojans that can also lead to ransomware attacks, such as the triad Emotet, Trickbot, and Ryuk.