Security

Welcome to the DataMotion Blog’s third and final installment to the Rise of Ransomware as a Service series. Thus far, we have focused on what Ransomware as a Service is, examined some recent attacks and how they started, and explored the snowball effect that can follow when your third-party vendor is a risk factor. While these are important elements to understand in order to help create a defensive plan to avoid falling victim to a similar attack, there are still a couple of critical questions left to ask. What happens after an attack occurs? What is the true cost of a ransomware attack?

Understanding how companies recover from a breach, as well as the obstacles they often face in the wake of an attack, can help with financial planning and crafting a security strategy. For example, many organizations have opted to invest in ransomware insurance, or to establish a fund specifically for the possibility of an attack, because paying a ransom is often the fastest route to getting an encrypted infrastructure up and running again. In this installment, we will go over the financial cost, the required manpower, and reputation damage that is often the residue of ransomware.

The prices of everything, from milk to gas, are rising—and we hate to inform you, but ransom is no different. As companies continue to pay ransom demands to decrypt their environment or retrieve their data, cybercrime groups ask for more. A Forbes article found the average cost of ransomware recovery has grown $1.08 million in the last year. The cost per company, however, can vary, depending on its size and revenue. For example, JBS (the meat packing company who was hacked in early June) paid hackers $11 million to retrieve their data and get their systems back up and running. Colonial Pipeline paid their attackers roughly half of that, about $5 million. Though in Colonial Pipeline’s case, $2.3 million of the payment was recovered by the DOJ’s Ransomware and Digital Extortion Task Force. Given that the companies mentioned above each paid a hefty ransom, it might seem like a good idea to allocate resources, just in case.

Unfortunately, with the rise in ransom cost and the growing frequency of attacks, the price for insurance coverage is also increasing. Many insurance companies are starting to restrict their coverage, or drop ransomware coverage altogether. Those who find the higher cost in coverage to be worth it run into an entirely new issue: insurance is something hacking groups look for. Cybercriminals know they can’t extract blood from a stone, so they perform research to target companies who can afford to pay. Once they breach an environment, they often look for signs the compromised company has financial security to help determine the price of the ransom they will charge. A Washington Post article found hacking groups are referring to insurance companies as “an endless pot of gold” and are known to send screen shots of insurance plans to organizations from their own systems during negotiations. This greatly weakens a company’s ability to lower the ransom price, and may even increase the demand.

The rising cost of ransomware is not the only thing to worry about. As we reviewed in the last part of this series, an organization’s clients can become caught in the crossfire of these attacks, leaving customers’ data and systems vulnerable to subsequent attacks. This can destroy a company’s reputation and devastate their customer base.

Some organizations are able to pay ransom in secret, so their reputations likely won’t suffer the same damage as their wallets. However, it’s hard to keep the cat in the bag when your customers are affected. For example, last month T-Mobile was once again breached, and their customers’ data was compromised. The data for 47 million current and former customers was posted on a public site as a result of this breach, including social security numbers and financial records.

Once the smoke clears and damage is analyzed, lawsuits often follow, adding legal fees and settlement payments to the total cost of a ransomware attack. Colonial Pipeline experienced this after they were hacked; as a result, their oil distribution halted, leaving much of the southeastern U.S. without oil. The legal fallout includes business owners suing for lost profits and customers suing over higher prices while waiting for distribution, on the grounds that a lapse in Colonial Pipeline’s security causing the breach. This is becoming a familiar fate for other organizations as well.

As if the ransom and lawsuits weren’t enough, you also need to factor in the profit lost when your servers are down. This profit loss is what often drives the pressure to pay a ransom in the first place. Every day that your environment is unaccusable and your services are down, the more profit is lost. But paying hackers is a double-edged sword. The more money a cybercriminal group makes, the stronger and more resourceful they become, making them even more dangerous and unstoppable. The new accessibility to malicious software that RaaS brings, coupled with a steady stream of profits from paid ransoms, is only adding fuel to this fire.

Not to mention, there really is no honor amongst thieves. 92% of organizations who paid a ransom did not get all of their data back. New servers need to be built and brought online before services can resume, which can be an expensive and tedious task. Once your environment is up and running again, production is often slowed due to a loss in data. As we discussed in the second installment of this series, disaster recovery servers are the best way to recover data and bring servers back online. It’s also important to back your servers up often to minimize data loss and bring productivity up to speed as quickly as possible and limit the amount of revenue lost.

As promised, below are two additional tips to help protect your environment from a ransomware attack, hopefully sparing you a logistical headache:

The first tip is to implement an email gateway to avoid phishing attacks. An email gateway can help scan links and documents within incoming messages to identify potential malicious code and immediately deny the message or move it to your trash folder. By identifying and removing malicious emails, which hackers often exploit for entry to your systems, you greatly reduce the threat of a phishing attack. Email gateways can also be used to create other rules in addition to thwarting malicious messages. For example, to send data securely with DataMotion software, right from your email client, you can easily create a rule that will send any message with a tag like “[Secure]” to be encrypted and sent over a secure line. This tag can be added anywhere such as the subject or body of the message, and doing so helps lock down sensitive data and meet compliance regulations.

The second tip we have for you today is to patch and update your products and environment as soon as new updates are released. As zero-day vulnerabilities are detected within an environment or product, a patch or update is created as soon as possible to correct the vulnerability and protect you from the exploitations that can follow.  The Kaseya attack started with a zero-day vulnerability in Kaseya’s VSA server. Once the hackers discovered the vulnerability, they quickly scanned the Internet to find customers utilizing this product in order to exploit the lapse and breach customers’ systems as well. Had Kaseya discovered the vulnerability first and deployed a patch to resolve this error, only those customers who did not deploy the patch would still be at risk.

Every ransom that is paid to undo an attack emboldens and strengthens cybercrime groups. But the price of a ransomware attack goes beyond the cost of ransom. With the costs of service downtime, legal fees, lost data and new equipment factored in, ransomware becomes much more expensive than what is often portrayed to the public. And to top it off, your company and leadership team’s reputations are definitely at risk, along with the trust of your current and potential customers.

With the rise of Ransomware as a Service, attacks will continue to be launched, likely with greater frequency. However, implementing the tips reviewed in this series will help you and your organization create a solid defense and resilient infrastructure against ransomware attacks. One tactic we review is to implement email encryption and to secure your data transfers. You can quickly find more information on how to enact this functionality today with DataMotion APIs.

Be sure to check out the DataMotion Blog and our Resources page for great development advice, including articles on protecting your environment both internally and externally.

• The Rise of Ransomware as a Service
• Rise of RaaS: Consolidating the Vendor Risk Factor

• Forbes’ “Ransomware Reality Shock: 92% Who Pay Don’t Get Their Data Back” by David Winder
• Reuters’ “Meatpacker JBS says it paid equivalent of $11 mln in ransomware attack” by Aishwarya Nair in Bengaluru
• TechCrunch’s “T-Mobile says at least 47M current and former customers affected by hack” by Zack Whittaker
• DataMotion’s “The Rise of Ransomware as a Service” by Heather Post
• Washinton Post’s “Ransomware claims are roiling an entire segment of the insurance industry” by Rachel Lerman and Gerrit De Vynck
• Washinton Post’s “First came the ransomware attacks, now come the lawsuits” by Gerrit De Vynck
• Forbe’s “Why Ransomware Costs Businesses Much More Than Money”

In the first part of our Rise of Ransomware as a Service series, we learned RaaS enables organizations to purchase ransomware and gain hacking resources which were not accessible before. With heightened access to malicious software, a rise in ransom attacks has followed. In this second part of our Rise of RaaS series, we will focus on ransomware protection and defense.

This post will review three high-profile cyberattacks that grabbed America’s attention this past year. Understanding how these attacks occurred, and the snowball effect that often follows, allows organizations to build their defenses and implement strategies to thwart similar assaults, as hackers often reutilize techniques. We’ll review some key steps and new security strategies that, when implemented, will ensure your organization is protected, as well as resilient, to ransomware.

The first attack we want to expound upon is what many know as the hack on the Pentagon and Department of Homeland Security. This recognition is due, of course, to the major security risk this hack imposes to the United States. But the Pentagon and DHS were not the only entities compromised in this attack. Fortune 500 companies, as well as additional government agencies, were also breached. These organizations all had one thing in common: a third-party vendor named SolarWinds, a Texas-based vendor that provides IT management tools for their customers.

It’s unclear how hackers gained access to the SolarWinds infrastructure, but once inside they began work on creating a duplicate of a SolarWinds patch that was due to be released to customers. The replica included the same bug fixes and software updates that SolarWinds had intended it to have, but lines of malicious code were added. At the very last second, right before SolarWinds was set to deploy their patch, the hackers switched the two and the replica patch containing malicious software was released. Customers were then able to download and deploy what they thought was the SolarWinds patch. Once this patch was deployed on any server with Internet access, a backdoor was opened and the attackers made themselves right at home. The intrusions were only discovered when the cybersecurity giant, FireEye, noticed some strange activity in their network and investigated. They traced this activity to the SolarWinds patch and discovered the malicious code.

Without FireEye’s inspection, the hackers could have continued undetected, extending their reach before locking down data and requiring a ransom for restoration. This prompts a frightening question: Could hackers have used the same methodology as the patch swap, or something similar, to gain access to other organizations and have yet to be discovered? We will review ransomware protection tips towards the end of this article, but we think it’s worth mentioning now that a “see something, say something” approach is of critical importance. Many employees may write off suspicious activity as a glitch or one-off scenario, but a sense of due diligence to investigate these situations caught a breach that affected an estimated 18,000 organizations. Of course, not everyone has the same resources as FireEye, but a log of suspicious activity and when it occurred can give your third-party vendors reason for an additional patch review.

The attack on Kaseya occurred more recently, on the Friday before the Fourth of July weekend. Like the Solar Winds attack, the Kaseya breach affected their customers as well. Kaseya provides IT management solutions for managed service providers (MSPs) and IT teams. The managed service providers who utilized Kaseya‘s products provide security and management services to their customers. This management integration caused a snowball effect and allowed hackers within the affected MSPs to gain access to Kaseya’s customers’ infrastructures as well. This led to the breach reaching about 1,500 companies.

The attack occurred when hackers from REvil, the Russian based cybercrime group, found a zero-day vulnerability, or a vulnerability that has just been discovered, in Kaseya’s VSA servers which allowed them entry. From here, REvil hackers scanned the internet to find any of Kaseya’s customers utilizing this software in order to exploit the vulnerability and access their infrastructure as well. REvil demanded $70 million dollars in exchange for a key to decrypt their environment. As mentioned in the first part of this series, REvil has since taken down their site and did so without providing any decryption keys for those, like Kaseya, still in negotiations. Kaseya has stated that they have since obtained a universal decryptor from a third party.

The last and most recent breach we’ll touch upon is the attack on Accenture. This attack happened on Tuesday, August 8^th when the cyber-crime organization, LockBit, encrypted data on Accenture’s infrastructure and seemingly exfiltrated the data offline. Lockbit has threatened to release the data to their site if a ransom is not paid.

According to Accenture, they had tactics in place to minimize the impact of this attack. Once suspicious activity was noticed, their team worked quickly to trace the activity and lock down their servers to limit what the hackers could access. From there, they were able to roll their encrypted servers back to their latest backup or snapshot version. This rollback method is effective and a route many organizations have taken in the past. Rolling your servers back may cause you to lose any changes made from the time the last backup or snap was taken to the time of the rollback, but allows organizations to get their infrastructure up and running quickly, without paying a ransom.

In the next section, we will provide tips to protect against ransomware, as well as techniques to make your environment resilient if an attack does occur. However, we want to emphasize the importance of backing up your servers, as we’ve seen in this example. Doing so frequently will minimize the data lost and allow for easy and seamless disaster recovery in the wake of an attack. It’s also good practice to store backups in a separate location so if one server is destroyed or compromised, the backup is not lost with it. Now, let’s jump into some additional steps you can take in order to be both protected and resilient.

A new cyber security practice rising with RaaS is vendor consolidation. As the examples reviewed in this post have shown, companies both large and small can fall victim to ransomware through their third-party vendors. With this revelation, many organizations are taking preemptive measures to protect themselves and limiting vendors will help reduce your attack surface. The vendor consolidation strategy involves using one vendor to fulfill as many tasks as possible and building in-house solutions to replace software that’s currently contracted out.

One step to implementing this strategy is to understand the full reach each vendor has, which can allow you to utilize them for multiple needs. You may need to do your research and ask about other products your trusted vendors provide. It’s common for vendors to fulfill multiple needs and not get to market each of their products to you, so you might not know the full capabilities one vendor has. For example, DataMotion, Inc. is best known for our secure messaging technology, but we are also a Health Information Service Provider (HISP). This is a separate product and therefore may not come up when searching and researching about our secure messaging APIs. However, with a quick inquiry into our full product list found either on our website or through a sales representative, this can be easily discovered.

In addition to the vendor consolidation strategy, it’s also important to ask your vendors what their security stack looks like, and which companies they work with. Have this conversation not only while searching for a vendor, but also with current vendors. As industry leaders learn more, new security best practices, techniques and strategies will be developed (such as vendor consolidation) and it is important that you and your vendors work to implement them.

MFA is another great way to prevent a breach. A password is a mere speed bump that is one successful brute force attack away from being broken. The more complex a password is the longer the brute force may take, but it will still be hackable. Once a password is cracked, a second layer of defense is required. Most multifactor authentication strategies require the user to type in a code they receive from a text, email or authentication app that is only valid for a short period of time (so the code can’t be brute forced as well).

Finally, a resilient infrastructure is extremely important. You can do everything correctly on your end to protect your company against ransomware, but a vulnerability in a vendor’s product or system can still leave you open to a breach. Therefore, you must ensure that you have internal security measures in place to minimize damage if a breach does occur. This is why a least privilege model (LPM) or zero trust is essential.

The least privilege model ensures each system and user only has access to what they need to do their job, and no more than that, thus limiting any access to a hacker if they gain network entry. Similarly, zero trust treats an internal network just as it would traffic coming from outside the network; users and devices are not trusted simply because they have joined the network. They must be verified, just as a user from outside would be. Those who implement zero trust also utilize LPM, encryption and MFA within their internal network. The use of either model means if any user or system is compromised through a zero-day vulnerability or phishing attack, the data the hackers can open is limited by the access available. A zero trust approach is something DataMotion has implemented since the early stages of our development.

The encryption factor of zero trust is one we especially advocate for. Encrypted data on file servers, as well as any sensitive emails and messages, will help protect data from intruders within your environment. Hackers will not be able to open or read encrypted data in folders and messages. In the same vein, if encrypted data is exfiltrated from your environment, and the attackers threaten to decrypt your data and post it for all to see you don’t have to worry.  Your encrypted data will be unreadable. Windows file servers make it easy to encrypt sensitive data, and a tool like DataMotion makes it easy to send and receive encrypted messages and know they are backed up on our messaging portal.

As ransomware continues to rise, cybercrime groups are becoming stronger and smarter. They are learning to target organizations that will enable them to reach as many companies as possible through a single vulnerability. Attacking third-party vendors often creates a snowball effect, allowing the organization’s customers, and in some cases customers’ customers, to fall victim as well. Understanding this risk allows companies to take preemptive steps to help protect themselves. In addition to vendor consolidation, understanding your vendor’s security level and keeping up with security best practices will help prevent a breach. A least privilege model and data encryption will help keep you resilient if a breach does occur.

The final post of this RaaS Series will cover the aftermath of an attack, including the steps often taken to bring encrypted infrastructures back up and running, how victims engage in negotiations, and the legal issues that often follow. Keep an eye out for this installment, as it will also provide additional security tips to help protect your company from a ransomware attack.

If you haven’t already, please visit our recent Danger for Data series, which focused on potential security vulnerabilities in an enterprise’s back-end and business sides, as well as how your team can mitigate these risks. To learn more on how you can take action now and protect your data while in motion, visit https://datamotion.com/tour-services/.

• The Rise of Ransomware as a Service
• The Rise of RaaS: The Real Cost of Ransomware

• The New York Times’ Scope of Russian Hacking Becomes Clear: Multiple U.S. Agencies Were Hit by David E. Sanger, Nicole Perlroth and Eric Schmitt
• NPR’s “A ‘Worst Nightmare’ Cyberattack: The Untold Story Of The SolarWinds Hack” by Dina Temple-Raston
• NPR’s “A Ransomware Attack Hit Up To 1,500 Businesses. A Cybersecurity Expert On What’s Next” by Leila Fadel
• The Verge’s “19 days after REvil’s ransomware attack on Kaseya VSA systems, there’s a fix” by Richard Lawler
• Inforsecurity Magazine’s “Accenture Tied Up in $50M Ransom Lockbit 2.0 Attack” by Sophia Waterfield
• Gartner Top Security Risk and Trends for 2021 contributed by Kasey Panetta
• CPA Practice Advisor’s Zero Trust and Least Privilege: What a Cybersecurity Mindset Looks Like

From the attacks on SolarWinds to the JPS Meat Packing Company, the threat of a cyberattack has been democratized. Enterprises both large and small, across industries, have reported attacks and ensuing business disruptions, financial losses, and damaged reputations. In this article, the first of a three-part series on the rise of ransomware, we’ll cover what Ransomware as a Service (RaaS) is, the key players, what is being done to combat future attacks, and if your enterprise could be a target. (Hint: The answer is probably yes.)

What exactly is Ransomware as a Service (RaaS)? You can think of it as the sinister twin of Software as a Service (SaaS). Just like Salesforce sells its CRM software for customers to utilize, cybercrime organizations are now offering ransomware in a similar vein. In short, organizations that have built malicious software are now offering the technology to others for a profit. Scary, right? With malicious software for sale, groups with fewer technical resources and those who want a solution without the work of building one themselves, are now able to gain the same hacking abilities as the large and sophisticated groups that spent years cultivating software to exploit system weaknesses and lock down network-wide data.

This malicious new industry is on the rise. According to a Gartner report, 27% of all malware incidents in 2020 were a result of ransomware. There are a few possible reasons why. One reason is that this is an incredibly profitable venture–many companies opt to pay their attackers, as this is often the fastest route to get their systems back up and running. Another reason could be that in addition to profit, malicious software is now more readily available through Ransomware as a Service (RaaS). The more organizations with access to malicious software, the larger the number of attacks launched at corporations per year will be.

Throughout the years, we have seen many cybercrime groups come and go, often dismantling and regrouping under a new name to avoid detection. Two of the most notorious hacking groups, often in the news today, originate from Russia; REvil and Darkside.

REvil, which stands for Ransomware Evil, was behind the Memorial Day weekend attack on the meat processing company JBS, and the attack that targeted Kaseya VSA servers right before the Fourth of July holiday. Kaseya provides IT management solutions for MSPs and IT teams; many customers of Kaseya with on-premise VSA servers were also affected by the attack.

Darkside has claimed credit for a number of cyberattacks globally, but their most recent claim was the attack on Colonial Pipeline. This attack resulted in major disruptions of US oil distributions to southeastern states, causing gas and oil shortages in the area, and attracting the unwanted attention of the US government.

Both organizations have gone dark since their latest attacks. Darkside shut down their sites due to pressure stemming from the attention of the US government, but uncertainty surrounds the reason why REvil’s sites went down. Experts believe that the two groups will also appear again, next time under new names.

As a result of these high-profile attacks, many organizations are investing the necessary resources to train their employees on better security practices, and build their cybersecurity stack. From CASBs, secure data transfer solutions, SIEMs, endpoint protection and more, security is fast becoming a top priority to help combat looming cyber assaults from RaaS. In addition to building their own protection, many organizations are looking to the government for help.

One of the government’s responses to these recent cyberattacks was to create the Ransomware and Digital Extortion Task Force. The goal of this task force is to bring the full weight and resources of the Department of Justice (DOJ) in response to new attacks on US companies. As many other organizations have done, Colonial Pipeline decided to pay the ransom needed to quickly bring their servers back up on May 8^th. The task force was able to recover roughly 2.3 million dollars (almost half of the payment made to Darkside) which added to the mounting pressure the attackers were facing.

According to the Cybersecurity and Infrastructure Security Agency, DarkSide has publicly stated they “prefer to target organizations that can afford to pay large ransoms instead of hospitals, schools, non-profits, and governments.” Cybercrime groups will also do their diligence to identify corporations with ransom insurance, or finances earmarked specifically for that purpose. While larger enterprises are currently the favorite for cyberattacks, smaller organizations also fall victim; however, the ransom amount demanded of smaller entities tends to be significantly lower than that of larger organizations.

In the next part of the Ransomware as a Service series, we will focus on how ransomware attacks have succeeded in the past, and discuss actionable steps to help protect your organization now and in the future. In the meantime, we invite you to visit our Danger for Data series, which focused on potential security vulnerabilities in an enterprise’s back-end and business sides, as well as how your team can mitigate these risks. We also invite you to learn more about the security-first zero trust strategy, and how DataMotion employs this model to help keep your organization’s data safe from would-be thieves while in transit.

To learn more on how you can take action now and protect your data while in motion, visit https://datamotion.com/tour-services/.

• Rise of RaaS: Consolidating the Vendor Risk Factor
• The Rise of RaaS: The Real Cost of Ransomware