# data[].attributes.body
1. when ransomware works and companies pay, it encourages other attackers to do ransomware too
2. they should contact the fbi and not pay the attackers
3. you should back up systems and data

# data[].attributes.body
Ransomware is the easiest way to make money from a compromised network

Ransomware is not super sophisticated

The most well-organised ransomware operations will even cherry-pick the organisations they see as potentially the most lucrative or most likely to pay a ransom and focus their efforts on those in order to maximise profits.

# data[].attributes.body
1) Ransomware succeeds because attackers are able to demand payments in Bitcoin and other cryptocurrency.
2) Organizations that have ransomware attacks are usually demands from someone in another country.
3) Ransomware Task Force suggests to regulate Bitcoin and other cryptocurrency to disrupt the system that facilitates payment from ransoms.

# data[].attributes.body
1. Things like VPN without multi-factor authentication, things like unpatched Microsoft Exchange servers,  remote desktops on a port that was publicly available to the internet, are being leveraged for ransomware.
2. Cyber criminals used DarkSide ransomware to hack the network of Colonial Pipeline, resulting in services being shut down which disrupted gasoline supplies for much of north eastern United States and forcing the company to pay a ransom of almost $5 million in bitcoin.
3. In order to maximize profits, the most well-organized ransomware operations will even cherry-pick the organizations they see as potentially the most lucrative or most likely to pay a ransom and focus their efforts on those organizations.

# data[].attributes.body
1.Biden's warning to Putin came following the G7 Summit in Cornwall, England, where the leaders of Canada, France, Germany, Italy, Japan, the United Kingdom and the United States issued a joint declaration on ransomware, agreeing that international action is needed to combat the issue.
2., criminals using REvil ransomware hit meat processor JBS, which paid a ransom of $11 million in bitcoin.
3.Ransomware has become such a significant problem that now even leaders of the global superpowers are discussing these attacks at high-profile summits.

# data[].attributes.body
1. Ransomware criminals demand payment or the organization's sensitive data would be leaked
2. Many groups made alliances to help prevent further ransomware attacks
3. There had been increases in ransomware targets on bitcoin and other cryptocurrency

# data[].attributes.body
1.  Over half of ransomware attacks are committed towards three industries; banking, utility, and retail.

2. Retailers that are attacked can be subjected to cash-only payments.

3. Banking and finance made up for 22% of detected attacks between July and September of 2021.

# data[].attributes.body
Ransomware is a growing international problem and it needs global cooperation in order to prevent attacks and take the fight to the cyber criminals behind the disruptive malware campaigns.

Ransomware has been around for a number of years, but the cyber criminals behind the attacks are getting bolder, demanding ever-growing ransoms from targets and in many cases blackmailing organisations into payment by threatening to leak sensitive data stolen from the compromised network.

The nature of cryptocurrency means that transactions are difficult to trace and, by the time the Bitcoin has been laundered, it's almost impossible to trace back to the perpetrator of a ransomware attack.

# data[].attributes.body
-DarkSide and REevil are believed to be the work of cyber criminals in Russia and are not punished as the kremlin is believed to turn a blind eye to them

-Ransomware attacks are increasingly becoming a problem as now global superpowers are discussing these widescale attacks
-cybercriminals take currency in crypto which helps them as its not traceable

# data[].attributes.body
1.  Monitoring of Cryptocurrencies can control cyber criminals
2. Most of the most powerful cyber criminals are from Russia or former soviet states
3. Most cyber criminals use cryptocurrencies because the are nearly impossible to track

# data[].attributes.body
1.) A group consisting of Microsoft, Palo Alto Networks, the Global Cyber Alliance, FireEye, Crowdstrike, the US Department of Justice, Europol and the UK's National Crime Agency has 48 recommendations to help curb the threat of ransomware
2.) Some of the solutions suggested include governments giving a helping hand to organizations affected by ransomware
3.) Other solutions include regulating crypto currencies because the criminals usually ask for crypto for the ransom.

# data[].attributes.body
1. Cyber criminals using Dark Side hacked the network of Colonial Pipeline, resulting in services being shut down
2. The ransomware disrupted gasoline supplies for much of NE United States
3. Ransomware groups are able to keep demanding huge sums of bitcoins and other cryptocurrencies because victims are paying the ransoms

# data[].attributes.headline
Shahab Anwary                                                                1 - Banking and finance was the most common target for ransomware during the reporting period, accounting for 22% of detected attacks.                                                                       2 - There are several ways that usernames and passwords can be stolen,                                           3- Vulnerabilities in internet-facing applications have become the most common attack vector for ransomware operations.

# data[].attributes.subject
Shahab Anwary                                                                1 - Banking and finance was the most common target for ransomware during the reporting period, accounting for 22% of detected attacks.                                                                       2 - There are several ways that usernames and passwords can be stolen,                                           3- Vulnerabilities in internet-facing applications have become the most common attack vector for ransomware operations.

# data[].attributes.body
1.  According to Trellix, 20% of attacks targeted the utilities sector and 16% of attacks targeted retailers.
2. Other sectors that were significant targets for ransomware were education, government, and industrial services.
3. It's recommended that organizations should apply multi-factor authentication across all accounts.

# data[].attributes.body
1. The three most targeted industries are banking, utility, and retail.

2. Ransomware on retail can cause stores to only accept cash or close altogether.

3. According to detections by Trellix, banking and finance was the most common target for ransomware during the reporting period, accounting for 22% of detected attacks.

# data[].attributes.body
1: Over half of all ransomware attacks are either against a retail, banking, or utilities institution.

2: most common victim of ransomware is banks and other financial institutions

3: Any business or industry can be a victim

# data[].attributes.attachment_link.readable_text
Ransomware has become such a significant problem that now even leaders of the global superpowers are discussing these attacks at high-profile summits.

The cyberattacks - which involve criminals encrypting networks and demanding payments that can reach millions of dollars in exchange for the decryption key - were one of the key discussion points during the first face-to-face meeting of US President Joe Biden and Russian President Vladimir Putin.

Ransomware was on the agenda following several high-profile campaigns against US targets, which caused significant disruption.

First, cyber criminals using DarkSide ransomware hacked the network of Colonial Pipeline, resulting in services being shut down - disrupting gasoline supplies for much of north eastern United States - and forcing the company to pay a ransom of almost $5 million in bitcoin. Just weeks later, criminals using REvil ransomware hit meat processor JBS, which paid a ransom of $11 million in bitcoin.

SEE: Network security policy (TechRepublic Premium)

Like many ransomware groups, both DarkSide and REevil are thought to be the work of cyber criminals working out of Russia. The consensus among cybersecurity researchers is that the Kremlin turns a blind eye to these activities. That's why President Biden directly brought up the issue of ransomware during his meeting with President Putin.

"I looked at him and said: 'How would you feel if ransomware took on the pipelines from your oil fields?' He said: 'It would matter.' I pointed out to him that we have significant cyber capability. And he knows it," Biden told reporters.

Biden's warning to Putin came following the G7 Summit in Cornwall, England, where the leaders of Canada, France, Germany, Italy, Japan, the United Kingdom and the United States issued a joint declaration on ransomware, agreeing that international action is needed to combat the issue.

Ransomware has been a problem for years, but attacks have become increasingly disruptive and damaging for victims while cyber criminals make more and more money from campaigns. A few years ago, ransoms were hundreds of dollars - now cyber extortionists are demanding millions or even tens of millions of dollars in ransoms.

And ransomware groups are able to keep demanding huge sums of bitcoin and other cryptocurrencies because, for one reason or another, victims are paying the ransoms.

"It's an effective business model because, from a criminal's point of view, it works because people are paying. Then there are more attacks as a result as it's so successful," says Eleanor Fairford, deputy director for incident management at the National Cyber Security Centre (NCSC).

SEE: Network security policy (TechRepublic Premium)

For cyber criminals, ransomware is the easiest and most efficient way to make money from a compromised network.

An intruder within a corporate network could spend months stealing sensitive information then struggle to find a way to make money from it. Or they could use that time and effort to move around a network laying the foundations for a ransomware attack - and walk away with millions of dollars.

The most well-organised ransomware operations will even cherry-pick the organisations they see as potentially the most lucrative or most likely to pay a ransom and focus their efforts on those in order to maximise profits.

"If you're worth $40 million to someone to compromise, is your security good enough to prevent somebody who thinks they can get $40 million out of you? That's a really hard question to answer," says John Hultquist, VP of analysis at Mandiant Threat Intelligence.

"The prices of ransoms has sky-rocketed and it's going to be even harder than ever for organizations to secure themselves against an actor, who can afford advanced capabilities to gain access."

It's because of this situation that hackers are targeting organisations that operate essential infrastructure, factories and other critical services that are reliant on uptime in order to remain functioning. It's possible that an office-based business that gets hit by ransomware can take the time to restore the network without paying a ransom, even if it disrupts services for days or weeks.

Ease of attack

Not only is ransomware a lucrative activity, it's often via relatively simple means that cyber criminals gain access to networks in the first place, exploiting common cybersecurity vulnerabilities as the first step in a ransomware attack.

"It's not super-sophisticated zero-day vulnerabilities or that the threat actor wrote an exploit; it's things like VPN without multi-factor authentication, things like unpatched Microsoft Exchange servers, it's things like remote desktops on a port that was publicly available to the internet, that are being leveraged for ransomware," says Sherrod DeGrippo, senior director of threat research and detection at Proofpoint.

Despite repeated warnings, organisations may be completely unaware that these vulnerabilities exist or may not have the procedures in place to apply the relevant security patches to close vulnerabilities in RDPs and VPNs.

And the COVID-19 pandemic has exacerbated the problem as organisations have far more staff working remotely than before, making it harder to manage security updates or monitor for potentially unusual behaviour.

Ransomware attacks are already damaging and disruptive enough, but many of the most successful ransomware gangs have added another string to their bow - double extortion.

SEE: This company was hit by ransomware. Here's what they did next, and why they didn't pay up

Not only do criminals encrypt data and demand a ransom in exchange for a decryption key, the access they've gained to the network means they're able to steal sensitive information. They're not looking to sell it on to rival firms or governments; they simply threaten to publish it if the victim doesn't pay.

It isn't an empty threat, with ransomware gangs running dedicated leak sites where they publish data stolen from organisations that didn't pay up - and that could scare some victims into paying the ransom, although there's no real guarantee that cyber criminals won't exploit that data in the future.

Hard-to-trace payments

When organisations do pay the ransom, it's paid in cryptocurrency - and there's an argument that it's helped cyber criminals easily make money from ransomware.

For criminals, getting the money out is the key thing and by using cryptocurrency like bitcoin, they're able to do it in a way that's difficult to trace - and crucially, avoids anything like a regular bank account that could be used to identify them.

"When it comes to cybercrime, monetization becomes really complicated. It's always been sort of the bottleneck - you can get your hands on a bajillion credit-card numbers, but the part where you convert it, that's where everything stops," says Hultquist.

"Cryptocurrencies provided sort of a way around that because it allows them to move this cash freely around outside of regular systems and provided much easier monetization. It's not necessarily the cryptocurrency that is fuelling this, the tremendous payouts are fuelling this. Cryptocurrency just makes the monetization easier," he adds.

The Russian angle

And when ransomware attacks are this financially successful, they'll keep happening - especially if cyber criminals are operating from countries where their governments turn a blind eye to their activities.

The consensus is that many of the most notorious ransomware gangs are operating from within Russia and that they're allowed to make money from ransomware, so long as they focus their activities against the west.

"The Russian state and Russian criminal underworld are not the same thing, but there is understanding between them and understanding is that as far as the state's concerned, Russians can make money a way that suits them," says Ciaran Martin, professor of practice at the University of Oxford's Blavatnik School of Government - and former director of the NCSC.

ZDNet Recommends

The best cyber insurance

The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

"But the conditions are: leave Russians and Russian interests alone, and when we need your best people, they have to come; that's the way the model has worked."

SEE: Ransomware: A company paid millions to get their data back, but forgot to do one thing. So the hackers came back again

Cyber criminals take heed of this warning, with many coding their ransomware with instructions to terminate if a scan reveals that it's on a Russian language system.

On top of this, it's against the Russian constitution to extradite Russian citizens, so even if authorities in the West were able to identify members of a ransomware operation, they're unlikely to be able to make arrests.

Meanwhile, a ransomware group would be unlikely to succeed for long if it was working out of a western nation because law enforcement would quickly take action.

"Why are there no major international ransomware syndicates in the West? Because if you set one up in London or Oxfordshire or Northern Ireland, the National Crime Agency will be kicking down the door within a week, you just couldn't do it," says Martin. "You can't really do it in the West, but you can do in Russia. Why? Because it's allowed."

Time for change?

Ransomware has been a problem for years - particularly with hospitals regularly falling victim to attacks during the peak of the coronavirus pandemic, but the attack against Colonial Pipeline has struck a particular chord.

The pipeline that provides almost half the gasoline supply to the north eastern United States was shut down and that was obvious to all: this wasn't just a business not being able to operate without the use of particular files, this was critical infrastructure that got shut down due to ransomware.

"There will be 'before Colonial Pipeline' and 'after Colonial Pipeline', it's that much of a milestone in the way that the threat actor economy is going to work," says DeGrippo. "It's not a ransom of files any more, it's a ransom of your existence. Ransoming the ability to get hot dogs and beer and gasoline is a whole different ballgame."

The United States has a strong relationship with oil and gas and that made the disruption caused by Colonial Pipeline ransomware attack impossible for the Biden administration to ignore - and it started with the Department of Justice seizing most of the bitcoin used to pay the ransom.

Even the operators of DarkSide ransomware-as-a-service attempted to distance themselves from the attack, claiming that "our goal is to make money, and not creating problems for society". They even claim that they'll establish additional checks and balances on their "partners" in future.

But now the ransomware gangs may have bitten off more than they can chew.

"They don't want this much notoriety, they want to be recognised, they want people to pay - but I don't think they necessarily want the US government on their trail - they probably took it a step too far. I'm sure the other ransomware gangs are pretty upset with them," says Hultquist.

The threat from ransomware is still high - as evident by how Ireland's healthcare service continued to suffer disruption weeks on from a Conti ransomware attack, which hit days after the Colonial Pipeline attack - but there's a feeling that recent events could potentially be a turning point.

"There is at least a plausible case to be made that the past month has been strategically damaging for the criminals and that one hopes that we might - please note, the very careful language - that we might be able to look back at some point on this period as peak ransomware," says Martin.

"Now that's by no means certain yet, it's not even likely yet, but governments are starting to see this can do real harm."

However, in the immediate future, ransomware will remain effective as long as organisations are vulnerable to being hacked by cyber criminals, as demonstrated by how attacks have continued to cause disruption around the world.

But it is possible to build resilience to cyberattacks - including ransomware - and make it much harder for cyber criminals to compromise the network in the first place.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)

Much of this resilience can be built-up by ensuring that cybersecurity hygiene procedures, such as installing security patches in a timely manner, preventing the use of simple passwords and using multi-factor authentication, are applied across the network. Because ransomware gangs are opportunists, by making things more difficult for them, it decreases the likelihood of a successful attack.

"The sorts of things that are useful: having visibility on your network to be able to see if precursor activity is taking place, understanding where your assets and network are, and properly having that mapped and understood. These standard good processes will defend against ransomware," says Fairford.

Regularly updating backups - and storing them offline - also provides another means of lessening the severity of ransomware attacks, because even in the event of the network being encrypted, it's possible to restore it without paying cyber criminals, which cuts off their main means of income.

Nonetheless, the rise of double extortion attacks has added an extra layer of complexity to this issue because if the organisation doesn't pay a ransom, they're faced with the prospect of potentially sensitive information about employees and customers being leaked.

"Do you have a plan if if your information starts leaking out?," says Hultquist. "Those pieces need to be in place now, not when it hits the fan"

The fact that the US and other governments are talking about ransomware should also act as a catalyst for any organisation - that, for whatever reason, didn't have any specific plans for preventing or protecting against a ransomware attack - to decide on their plans now.

Because even in the worst-case scenario, when the network has been encrypted with ransomware, having a set plan can help manage the incident and potentially make it less damaging.

"Companies must sit down with their executives and they must decide, 'if we are a victim of ransomware, how much are we willing to pay, who on the board is going to be authorized to negotiate this and what is our relationship, going to be with law enforcement when it happens?'. Then every quarter, you revisit it and you ask, 'is this still our decision if we come under a ransomware attack, is this still our plan of action?'" says DeGrippo.

"If you haven't made the decision on how you're going to handle it yet, it's not going to work out in your favour," she adds.

MORE ON CYBERSECURITY

# data[].attributes.attachment_link.title
Have we reached peak ransomware? How the internet's biggest security problem has grown and what happens next | ZDNet

# data[].attributes.attachment_link.description
Ransomware has become such a significant problem that now even leaders of the global superpowers are discussing these attacks at high-profile summits. The cyberattacks - which involve criminals encrypting networks and demanding payments that can reach millions of dollars in exchange for the decryption key - were one of the key discussion points during the first face-to-face meeting of US President Joe Biden and Russian President Vladimir Putin.

# data[].attributes.attachment_link.readable_text
Over half of ransomware attacks are targeting one of three industries; banking, utilities and retail, according to analysis by cybersecurity researchers - but they've also warned that all industries are at risk from attacks.

The data has been gathered by Trellix - formerly McAfee Enterprise and FireEye - from detected attacks between July and September 2021, a period when some of the most high-profile ransomware attacks of the past year happened.

According to detections by Trellix, banking and finance was the most common target for ransomware during the reporting period, accounting for 22% of detected attacks. That's followed by 20% of attacks targeting the utilities sector and 16% of attacks targeting retailers. Attacks against the three sectors in combination accounted for 58% of all of those detected.

SEE: A winning strategy for cybersecurity (ZDNet special report)

Utilities is a particularly enticing industry for ransomware gangs to target because the nature of the industry means it provides vital services to people and businesses, and if those services can't be accessed, it has an impact - as demonstrated by the ransomware attack against Colonial Pipeline, which led to gas shortages in the north eastern United States. The incident saw Colonial paying a ransom of millions to cyber criminals in order to receive the decryption key.

Ransomware attacks against retailers can also have a significant impact, forcing shops to be restricted to taking cash payments, or even forcing them to close altogether while the issue is resolved, preventing people from buying everyday items they need.

Other sectors that were significant targets for ransomware include education, government and i ndustrial services, serving as a warning that no matter which sector they operate in, all organisations could be a potential target for ransomware.

"Despite the financial, utilities and retail sectors accounting for nearly 60% of all ransomware detections, no business or industry is safe from attack, and these findings should act as a reminder of this," said Fabien Rech, VP EMEA for Trellix.

"As cyber criminals adapt their methods to target the most sensitive data and services, organisations must shore up their defences to mitigate further threats."

While several high-profile ransomware groups of 2021 seem to have disappeared or gone dark, particularly following arrests, new gangs and malware strains are emerging all the time and ransomware remains a key cybersecurity threat to organisations around the world.

In order to help protect networks against ransomware and other cyberattacks, it's recommended that organisations regularly apply the required security updates to operating systems, applications and software, which can prevent hackers from exploiting known vulnerabilities to launch attacks.

It's also recommended that organisations apply multi-factor authentication across all accounts and that security teams attempt to scan for credential-stealing attacks and other potential suspicious activity in order to prevent attacks before they happen.

MORE ON CYBERSECURITY

# data[].attributes.attachment_link.title
Ransomware: Over half of attacks are targeting these three industries | ZDNet

# data[].attributes.attachment_link.description
Over half of ransomware attacks are targeting one of three industries; banking, utilities and retail, according to analysis by cybersecurity researchers - but they've also warned that all industries are at risk from attacks.

# data[].attributes.attachment_link.readable_text
It started out as a normal Thursday for Tony Mendoza, senior IT director at Spectra Logic, a data storage company based in Boulder, Colorado. And then the ransomware attack began.

"We got some notifications of some system failings and it quickly turned into a lot of unrelated systems failing, which is really abnormal," says Mendoza. He realised that the company was under attack - and that its files were being encrypted.

"When it hit, we ran to our server room and data centre and started pulling plugs out so it couldn't propagate itself - which brought our entire infrastructure down," he says.

SEE: What is cyber insurance? Everything you need to know about what it covers and how it works

In total, three-quarters of the production environment was compromised with ransomware. The hackers left a ransom note demanding a payment of $3.6 million in bitcoin in exchange for the decryption key.

"Figuring out what it was was fairly simple, because they tell you who they are, and they tell you where to send the money. It was NetWalker because it said so in the ransomware letter," explains Mendoza.

Another problem: the attack came in May 2020, when many employees had just started to work remotely because of the COVID-19 outbreak, so there was no way of easily communicating what was going on outside the building.

Despite that, the IT team had to assess the damage that had been done and what the options were for getting data back - if it was going to be possible at all. There was some hope - the company had backups, which were separate from the rest of the network and safe from the incident.

"We're still under attack, we're still trying to stop the bleeding, we still don't know what the extent of the damage was - but we knew we had data to work with," says Mendoza.

Every organisation that falls victim to a ransomware attack ultimately has to face one major question - do they they give in to the ransom demand in order to retrieve their data?

Cybersecurity companies and law enforcement agencies around the world argue against giving into extortion surrounding ransomware attacks, because not only does it hand over hundreds of thousands or even millions of dollars in bitcoin to criminals, it proves that the attacks work, which encourages ransomware attackers to continue with campaigns.

However, some victims feel as if they've got no choice and they'll pay the ransom, perceiving it to be the quickest and easiest way to get their data returned and the network back up and running - although that isn't without issues. There are instances where attackers have either taken the money and ran, or taken the ransom then just returned with a second attack.

Spectra Logic had cyber insurance, which could potentially have covered the cost of paying the ransom. That might have been the simpler short-term decision for restoring the network, but it was quickly decided that with the backups still available, Spectra Logic wouldn't give in to the ransom demand.

So instead of communicating with the cyber criminals at all, Mendoza contacted the FBI.

"I went from being in a panic to being reassured by them that they'd seen it before, we're not alone in this and they're going to put tools in place to start protecting us. That was the biggest thing, getting protected," he explained.

The FBI also assigned a specialist team to help Spectra Logic deal with the immediate fallout from the attack over the course of the days that followed.

Attempting to restore the network turned out to be a 24/7 job for the small team over the course of the following week. For much of that time, people were sleeping at the office in order to have the most time possible to focus on restoring the network.

"From the Thursday morning, we spent 24 hours everyday for the next five days working on this - we slept in shifts. Three of us would work through the night while two people slept for a few hours," said Mendoza.

"There was no leaving and coming back, it was go sleep on the couch in case we need you. It was five days of all hands on deck."

As well as this, he was having to provide the board with updates on the ongoing situation. They wanted answers about when the network was going to be restored and when business was going to be back to normal.

"I'm dealing with leadership in the company and I don't want to lie to them and say I know when it'll be up - I had to tell them I don't know what's going on or when systems will be up," he says.

It took days of working around the clock but eventually the IT department, with the aid of cybersecurity specialists, was able to restore some functionality to the network a week after the ransomware attack, without paying out to the attackers.

"Our cybersecurity team provided us with the expertise and tools, monitoring and logging to get the threat out of our system. Monday morning they give us a green light; it's done, they've stopped it and removed it," Mendoza remembers.

"The FBI told us we're going the hard way, but the right way - and it ended up being the easy way when we came back and said we were back up eight days later; it was shocking for them," he added.

But it didn't mean everything was immediately back to normal - it took weeks more to bring back systems that weren't critical to the business, and during that whole time careful attention was required just to make sure the attackers hadn't somehow managed to spread the ransomware again, which meant constantly monitoring all activity on the network for another month.

A lot of ransomware attacks never become public knowledge, and examples of companies that go into detail about what happened are still few and far between.

But Mendoza says it's important to be transparent about dealing with a ransomware attack, because it's important to show that it is possible to recover from an attack without lining the pockets of cyber criminals.

"What we realised was we protected our data and there's a way to thwart ransomware. We couldn't find public information when we were looking for it, so we wanted to make it a common thing, that it's okay to talk about being impacted by ransomware," he said.

So what is the key lesson Mendoza would say that other organisations need to take away from Spectra Logic's experience? It's backup your systems - and do so offline - so, if the worst happens and the organisation falls, you still have backups offline.

"You've got to limit your attack blast radius. Backup your data in multiple locations on multiple mediums and the key is to air-gap it. Whether it's physical air-gap or virtual air-gap, you've got to put a wall between an attack and your data," he said.

And how did the company end up falling victim to a ransomware attack in the first place? Analysis of the incident revealed a phishing email sent to an employee working from home was how hackers gained their initial access to the network.

In the aftermath of the ransomware attack, Spectra Logic has worked to improve its cybersecurity culture, both on-site and for remote workers in an effort to learn from the incident. The company is now actively looking for potential cybersecurity threats that might have been missed before.

"Initially after the attack, when the wounds were fresh, we talked about security. Six months later, we're still concerned about security and we're more aware of phishing attacks. We were kind of complacent before," he says: now staff will notify him if a phishing email isn't picked up by the malware system. "There's more awareness now."

MORE ON CYBERSECURITY

# data[].attributes.attachment_link.title
This company was hit by ransomware. Here's what they did next, and why they didn't pay up | ZDNet

# data[].attributes.attachment_link.description
It started out as a normal Thursday for Tony Mendoza, senior IT director at Spectra Logic, a data storage company based in Boulder, Colorado. And then the ransomware attack began. "We got some notifications of some system failings and it quickly turned into a lot of unrelated systems failing, which is really abnormal," says Mendoza.

# data[].attributes.attachment_link.readable_text
Ransomware is a growing international problem and it needs global cooperation in order to prevent attacks and take the fight to the cyber criminals behind the disruptive malware campaigns.

A paper by the Institute for Security and Technology's (IST) Ransomware Task Force (RTF) - a coalition of cybersecurity companies, government agencies, law enforcement organisations, technology firms, academic institutions and others - has 48 recommendations to help curb the threat of ransomware and the risk it poses to businesses, and society as a whole, across the globe.

Members of the group include Microsoft, Palo Alto Networks, the Global Cyber Alliance, FireEye, Crowdstrike, the US Department of Justice, Europol and the UK's National Crime Agency.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)

Some of the solutions suggested include governments giving a helping hand to organisations affected by ransomware and providing them with the required cybersecurity support so they don't fall victim in the first place.

Others focus on more direct action, such as taking the fight to ransomware gangs by disrupting their infrastructure, or even regulating Bitcoin and other cryptocurrencies that cyber criminals use to anonymously demand ransom payments from victims.

Ransomware attacks involve cyber criminals compromising the networks of organisations - often via phishing attacks, stolen Remote Desktop Protocol (RDP) credentials or exploiting software vulnerabilities - and then encrypting as many files and servers with malware as possible.

Organisations will in many cases only become aware they've been infected when they see a ransom note on the screens of machines across their network. Often, the victims feel as if they've got no option but to pay the ransom - which can amount to millions of dollars - in order to restore the network.

Ransomware has been around for a number of years, but the cyber criminals behind the attacks are getting bolder, demanding ever-growing ransoms from targets and in many cases blackmailing organisations into payment by threatening to leak sensitive data stolen from the compromised network.

And it isn't just sophisticated criminal gangs that are causing problems; the rise of ransomware as a service means that almost anyone with the skills required to navigate underground forums on the dark web can acquire and use ransomware, safe in the knowledge that they'll probably never face being arrested for their actions.

"The tools are available to malicious actors to ramp up the scale of what they want to do and be able to get away with it. That's what happens as technology diffuses into society and you have inadvertent ramifications which have to be dealt with," says Philip Reiner, executive director of the RTF and CEO of IST.

"We're grappling with that as a global society and we have to come up with better solutions for the problems it presents."

Ransomware isn't new, it's existed in one form of another for decades and the threat has been rising over the past five years in particular. While it's perceived as a cybersecurity problem, a ransomware attack has much wider ramifications than just taking computer networks offline.

Ransomware attacks are increasingly targeting critical infrastructure, and crucially, over the course of the past year, healthcare.

But many organisations still aren't taking the necessary precautions to protect against ransomware, such as applying security patches, backing up the network or avoiding the use of default login credentials. These concerns are viewed as issues for IT alone, when in reality it's a risk that needs the focus of the entire business.

"We have to stop seeing leaders think of this as a niche computer problem; it's not, it's a whole business event. You should think about ransomware in the same way you think about flooding or a hurricane - this is a thing that will close your business down," says Jen Ellis, vice president of community and public affairs at Rapid7 and one of the RTF working group co-chairs.

"But we don't. We think about it as a niche computer event and we don't recognise the impact it has on the entire business. We don't recognise the impact it has on society."

In 2017, the global WannaCry attack demonstrated the impact ransomware can have on people's everyday lives when National Health Service (NHS) hospitals across the UK fell victim to the attack, forcing the cancellation of appointments and people who came for treatment being turned away.

But years later, the problem of ransomware has got worse and in some cases hospitals around the world are now actively being targeted by cyber criminals.

"You would think there would be no greater wake-up call than that, yet here we are years later having these same conversations. There's a real problem with how people think about and categorise ransomware," says Ellis.

To help organisations recognise the threat posed by ransomware - no matter the sector their organisation is in - the RTF paper recommends that ransomware is designated a national security threat and accompanied by a sustained public-private campaign alerting businesses to the risks of ransomware, as well as helping organisations prepare for being faced with an attack.

But the Ransomware Task Force isn't just suggesting that governments, cybersecurity companies and industry are there to help organisations know what to do if faced by a ransomware attack - one of the key recommendations of the report is for cybersecurity companies and law enforcement to take the fight to the cyber-criminal groups behind the attacks.

A recent operation involving Europol, the FBI and other law enforcement agencies around the world resulted in the takedown of Emotet, a prolific malware botnet used by cyber criminals - and something that had become a key component of many ransomware attacks.

Many cyber criminals switched to using other malware like Trickbot, but some will have taken the fall of Emotet as a sign to give up, because finding new tools makes it that little bit harder to make money from ransomware.

"If you're screwing with infrastructure, like going after Emotet, you're making it harder," says Chris Painter, president of the Global Forum on Cyber Expertise and former senior director for cyber policy at the White House.

In line with this, the paper recommends that the pace of infrastructure takedowns and the disruption of ransomware operations should increase - ultimately with the aim of arrests and bringing criminals who develop and deploy ransomware to justice.
SEE: This company was hit by ransomware. Here's what they did next, and why they didn't pay up
It's notoriously difficult to apprehend members of ransomware groups, especially when it's an international problem. More often than not, the organisation that comes under a ransomware attack faces an extortion demand from someone who is in another country entirely.

And that's a particular problem for European and North American governments, when large quantities of ransomware attacks by some of the most prolific groups appear to originate from Russia and former-Soviet states - countries that are highly unlikely to extradite suspected cyber criminals.

But identifying cyber criminals isn't impossible - the United States has indicted individuals from Russia for the NotPetya cyberattacks, as well as naming and shaming three North Koreans for their involvement in the WannaCry ransomware attack. Meanwhile, Europol has previously arrested individuals for being involved in ransomware attacks, demonstrating that, while difficult, it isn't impossible to track cyber criminals down and bring them to justice.

One key factor that has allowed ransomware to succeed is that attackers are able to demand payments in Bitcoin and other cryptocurrency. The nature of cryptocurrency means that transactions are difficult to trace and, by the time the Bitcoin has been laundered, it's almost impossible to trace back to the perpetrator of a ransomware attack.

The Ransomware Task Force suggests that in order to make it more difficult for cyber criminals to cash out their illicit earnings, there needs to be disruption of the system that facilities the payment of ransoms - and that means regulating Bitcoin and other cryptocurrency.

"It's recognising that cryptocurrency has a place and there's a reason for it, but also recognising that it's notoriously being used by criminals - is there more that can be done there to make it harder for criminals to use it, or make it less advantageous to them," says Ellis.

Recommendations in the report for decreasing criminal profits include requiring cryptocurrency exchanges to comply with existing laws and to encourage information exchange with law enforcement.

The idea is that by applying additional regulation to cryptocurrency, it allows legitimate investors and users to continue using the likes of Bitcoin and Monero, but makes it harder for cyber criminals and ransomware gangs to use it as an easy means of cashing what they've extorted out of victims - to the extent that, if it's too difficult, they won't bother with attacks in the first place.

"If they're using cryptocurrencies as a way to hide, if you have more compliance with existing regulations, it makes it tougher for them," says Painter.

The paper offers 48 recommendations and has been presented to the White House. It's hoped that with cooperation across the board, businesses can be provided with the tools required to prevent ransomware attacks, governments can get more hands-on with providing help, and law enforcement can hunt down ransomware attackers - but it's only going to work if ransomware is viewed as global problem, rather than one for individual organisations or governments to fight alone.

"What's really important is that this has an international perspective on it, because it's not an American problem, it's an international problem," says Reiner.

MORE ON CYBERSECURITY

# data[].attributes.attachment_link.title
Ransomware is now a national security risk. This group thinks it knows how to defeat it | ZDNet

# data[].attributes.attachment_link.description
Ransomware is a growing international problem and it needs global cooperation in order to prevent attacks and take the fight to the cyber criminals behind the disruptive malware campaigns.