Ransomware: How it Works and How to Protect Against Infection

What Ransomware Delivers

One early morning in May 2017, a nurse walked into her ward. She switched on her computer, ready to log in for the busy day ahead. She checked her emails and noticed an urgent message from IT, stating, “Shut down your computer as soon as you see this message. The hospital has been infected with malicious software.” A sense of panic set in. Hospital IT officials went around to each section and ward in the hospital to ensure all of the computers were shut down. The hospital itself, effectively, was shut down, having to turn patients away.

The hospital in question was one of many organizations, small and large, across the world that had been infected with the ransomware variant, WannaCry. In 2019, over 500 schools in the U.S. were attacked by ransomware. Among the many hospitals hit by ransomware, three had to close their doors to all but critical patients. New ransomware families continue to enter our networks, encrypting our files and documents and causing untold and ongoing damage.  This seemingly intractable position is why we invented CryptoStopper.

This is our story of fighting against a tidal wave and seeing it turn. Ransomware is a sinister force, but with the right approach and tools to augment our anti-ransomware stance, we can take on the global wave of cybercrime with extortion at its core.

Download our Complete Guide to Ransomware to learn more!

Continue reading

Posted in Uncategorized | Tagged

Cybersecurity and the Coronavirus Pandemic

Coronavirus cybersecurity

The coronavirus (COVID-19) and resulting stay-at-home orders have put an unprecedented strain on information security teams and their cybersecurity measures, as employees are required to work remotely. Most significantly at risk for a cyberattack during the coronavirus pandemic are healthcare facilities, food suppliers, and other essential functions. However, all companies are at a higher risk of a cyberattack as hackers are attempting to take advantage of employees via coronavirus-focused phishing attacks or other social engineering tactics.

Continue reading

Posted in Uncategorized | Tagged

Should a Ransomware Attack be Considered a Data Breach?

ransomware data breach

Ransomware criminals are adding salt to the wound to those infected with ransomware by creating sites to leak data stolen from non-paying victims. Maze ransomware was the first variant to create a place to publish such data; however, over the last week, Sodinokibi/REvil (REvil), Nemty, and DoppelPaymer have started following suit. Ransomware attacks are no longer about simply encrypting files; ransomware attacks can now be considered data breaches.

Continue reading

Posted in Uncategorized | Tagged

Beware of Coronavirus Scams and Ransomware Attacks

CoronaVirus

In the midst of a global pandemic with the outbreak of the Coronavirus, or COVID-19, hackers aren’t putting their tricks into quarantine. While some gangs were promising not to hit medical centers during this time (they recently broke that promise), others are taking full advantage of individuals and businesses looking for the latest status on Coronavirus in their area.

Continue reading

Posted in Uncategorized | Tagged

Tips to Stay Sane While Working Remotely

WFH2

With the Center for Disease Control (CDC) recommending social distancing and limiting gatherings to ten people or less, the workforce is finding themselves working remotely; or as the cool kids would say “WFH” (Working From Home). Hopefully, your company has a business continuity plan in place, making the transition from working in the office to WFH as smooth as possible. Here are some tips to stay sane while working remotely as well as some cybersecurity measures, as this will be a “hay day” for lack of a better term for cybercriminals.

Continue reading

Posted in Uncategorized | Tagged

Snake Ransomware Slithers Through Networks

Snake ransomware2

Snake ransomware is the latest example of ransomware variants being used for targeting enterprises. Snake ransomware is being used to infiltrate business networks, gather administrative credentials, and encrypt the files of every computer on a network, using post-exploitation tools. Snake joins the likes of Ryuk, Bitpaymer, and other less notable ransomware variants that take part in enterprise targeting.

Continue reading

Posted in Uncategorized | Tagged

Ransomware Simulator Script – A tool for testing ransomware defenses

For too long, consumers have been without a method to test the cyber security products that they are purchasing or evaluating. Instead, the products are ‘field tested’ during a real event, at which time it’s revealed that the products didn’t perform as expected. WatchPoint is disrupting the cyber security market by providing all consumers with a way to test their defenses before it’s too late.

Continue reading

RDP Brute Force Attack Detection and Blacklisting with Powershell

Overview

Monitoring systems provide great value because they alert us to unusual events. They allow us to check a box on our audit sheet, but really a monitoring system is just half of the equation. The other half of the equation requires an action in response to the event.

Last week’s Tip-of-the-Week provided a simple detection to notification bridge for locked out accounts. This week’s tip takes things a step further, by arming our systems with an automated action in response to brute force attempts. Using Powershell, we’ll create a brute force detection script that automatically defends our network, by blocking the source IP address of the attack.

Continue reading

WatchPoint – Tip of the Week – Enumerate File Shares With Powershell

Use PowerShell to Discover and Record File Shares

An old college professor of mine once gave our class some simple yet sound advice; know your network. I didn’t realize it at the time but that his statement would stick with me and be something that I’d repeat to new hires and colleagues. So here you go Steve, I am writing this article for you.

Today’s Tip-of-the-Week is about knowing your network, specifically the file shares that it contains. Knowing what file shares exist and having a complete list of them can not only help with audits, but it will also help ensure you know what’s on your network and that it’s secure.

Continue reading