Cybercrime does not give up. Security experts predicted that ransomware attacks were going to intensify by 2020 and we didn’t have to wait too long to see it. Nemty Ransomware is the latest cybercrime operation that has created a data breach website to punish victims who refuse to pay ransom for data they have previously stolen.
Ransomware attacks are characterized by encrypting files on encrypted computers.
Nemty ransomware first appeared on the threat landscape in August 2019 – the malware’s name appears after the extension that is appended to encrypted file names. Said malicious software instantly removed encrypted files – previously stolen – to make any recovery procedure impossible.
In October 2019 , researchers from the security firm Tesorion developed a decryption tool that works on Nemty versions 1.4 and 1.6, they also announced a working tool for version 1.5.
However, this group of black hat hackers, blackhats , announced in February 2020 the opening of a website to filter the stolen data of ransomware victims who refused to pay the ransom. The threat was not just words; They have kept their promise and confidential documents have begun to be released publicly, following the dangerous trend started last year by the Maze ransomware group.
The theft and publication of stolen data, which in many cases includes company financial data, employee personal information, and customer data , automatically increased these ransomware attacks into data breaches.
As we have mentioned, once Maze Ransomware started with this tactic, other groups such as DoppelPaymer and Sodinokibi (who plan to send automatic emails to stock indices such as Nasdaq to directly damage the price of their victims) began to launch “leakage” websites. of data ”to extort money from victims in a similar way.
In the most recent case, with Nemty Ransomware, they have started to punish non-paying victims, releasing files that were stolen before the devices were encrypted.
As more ransomware operators start using this extortion tactic, victims will need to consider all ransomware attacks as a data breach.
Attackers hope that these additional costs and the potential impact on the reputation of companies and individuals will push some victims to pay a ransom to avoid having their valuable information published.
Ransomware attacks in Spain
In 2019 , companies such as the Everis consulting firm, Cadena Ser, Prosegur or even the Jerez City Council (Cádiz) were victims of this cyber attack.
At MUY, we have spoken with cybersecurity expert Deepak Daswani ( La Amenaza Hacker, 2018) to shed some light on this wave of data hijacking.
How can companies defend themselves against a ransomware attack?
“Ransomware is a plague that has been hitting companies virulently for the past few years andDefending yourself against these types of attacks does not seem like an easy undertaking.Because, among other things, in many cases ransomware is the result of the attack, butnot all are perpetrated in the same way.Some materialize by exploiting vulnerabilities in the organization’s systems, and a large part of them are produced through the use of thesocial engineeringconvincing a user to do a certain actionhow to open an attached file.But even within this there are many, many variants. As time goes by, users may know that they should not open executable attachments, butthey may not think they can get infected by opening a Word or Excel document.And many of the latest ransomware campaigns have stemmed from Word documents containing malicious macros and prompting users to enable such macros in order to compromise their systems. In other cases it has also been done throughfake Chrome update downloads, etc … So, in general,defending against these types of attacks involves many actions that apply in general to almost all types of attacks,such as periodically conducting security audits on the organization’s systems, keeping the systems updated, raising awareness and training the organization’s staff in the different types of risks and good practices that they have to undertake, as well as correctly managing the backup copies of face to be able to make use of them in case of being compromised. All this happens by having a good incident response plan appropriate to the size of the organization, as we must be aware that at some point our company may be affected, “explains Daswani.
If you have already been a victim of the attack, many companies may think that paying the ransom guarantees that they will not attack again. What do you think?
” This is something that has been happening for many years . In general, when negotiating with criminals, be they traditional criminals or cybercriminals, it must be taken into account that anything can happen, and that it is not precisely a clean, legal negotiation , ethical or moral. Therefore, companies that think about paying the ransom for not having other means to restore their information, must bear in mind that no one guarantees them that they will recover the information (although in the vast majority of cases they do cybercriminals return the data to them), much less ensure that in the future they will not suffer an attack of this type again. Probably when recovering said data, they may include a surprise file that could lead to a new incident in the future ” , continues the expert.
Does a 2020 full of attacks like this await us?
” Unfortunately the trend is on the rise in these types of attacks . In previous years we have seen numerous examples of organizations of all kinds affected by these types of attacks, and it does not seem that this is going to diminish. Cybercriminals have found a way to get a lot of economic profit with this type of technique and they will continue to use them to make their attack campaigns profitable. We will see if we can minimize the number of incidents and have a year with fewer ransomware incidents than the previous one, “concludes Daswani.
