Slashdot Mirror
Crypto Ransomware Attacks Have Jumped 500% In The Last Year (onthewire.io)
Kaspersky Lab is reporting that the last year saw a 500% increase in the number of users who encountered crypto ransomware.
Trailrunner7 shares an article from On The Wire:
Data compiled by Kaspersky researchers from the company's cloud network shows that from April 2015 to March 2016, the volume of crypto ransomware encountered by users leapt from 131,111 to 718,536. That's a massive increase, especially considering the fact that ransomware is a somewhat mature threat. It didn't just burst onto the scene a couple of years ago. Kaspersky's researchers said the spike in crypto ransomware can be attributed to a small group of variants. "Looking at the malware groups that were active in the period covered by this report, it appears that a rather short list of suspects is responsible for most of the trouble caused by crypto-ransomware..."
It's difficult to overstate how much of an effect the emergence of ransomware has had on consumers, enterprises, and the security industry itself. The FBI has been warning users about crypto ransomware for some time now, and has consistently advised victims not to pay any ransoms. Security researchers have been publishing decryption tools for specific ransomware variants and law enforcement agencies have had some success in taking down ransomware gangs.
Enterprise targets now account for 13% of ransomware attacks, with attackers typically charging tens of thousands of dollars, the article reports, and "Recent attacks on networks at the University of Calgary and Hollywood Presbyterian Medical Center have demonstrated the brutal effectiveness of this strategy."
It's difficult to overstate how much of an effect the emergence of ransomware has had on consumers, enterprises, and the security industry itself. The FBI has been warning users about crypto ransomware for some time now, and has consistently advised victims not to pay any ransoms. Security researchers have been publishing decryption tools for specific ransomware variants and law enforcement agencies have had some success in taking down ransomware gangs.
Enterprise targets now account for 13% of ransomware attacks, with attackers typically charging tens of thousands of dollars, the article reports, and "Recent attacks on networks at the University of Calgary and Hollywood Presbyterian Medical Center have demonstrated the brutal effectiveness of this strategy."
My job got hit by an email-delivered virus that spread across the network and encrypted 200+ hard drives before being stopped. Fortunately, user profiles are stored on the network. Didn't take much time to deploy loaner laptops and re-image the desktops to get the users up and running again.
If you are doing IT for an enterprise, get stats like this to go to management and show them why you need storage with snapshots and backups to alternate storage. Ya it costs to get a good setup, and it takes some IT time to administer, but all it takes is one of these and it has paid for itself.
We got hit with cryptolocker back in the day, the Dean opened it and it proceeded to go and encrypt the entire administration share he had access to. However we didn't pay shit, I went in to the management console, rolled back to an earlier snapshot, and we were good. Minimal disruption. Even had it somehow been able to blast the snapshots (users don't have write access to them so I can't see a way) we could have pulled data from tape that was at most a couple days old.
There's other reasons to do this too, of course, but this is a big one that is very visible these days, and so worth it.
Law enforcement is busy fighting non-existent terrorists. Of course they cannot do anything about actually dangerous malware.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Fortunately, by next year all encryption algorithms will be required by law to have back doors for law enforcement, so if you get hit by one of these crypto ransomware attacks you can just go to the nearest police station and get your files decrypted.