The governments of the UK, US, Australia and more have publicly blamed Russia for the NotPetya ransomware attacks, which crippled businesses all over Europe back in June 2017 with a particularly nasty and destructive strain of ransomware. Last Thursday, the White House press secretary Sarah Sanders stated that NotPetya was “a reckless and indiscriminate cyber-attack that will be met with international consequences”, squarely blaming the Russuan Military and the Kremlin for causing billions of dollars’ worth of damage to businesses and states alike. The same day, the British defence secretary Gavin Williamson accused the Russian government of “undermining democracy”, after the attack, which was primarily aimed at the Ukraine, spread uncontrolled throughout Europe and beyond and caused major disruption to commerce and public services.
A macro is a small piece of code that runs within a software program such as Microsoft Word or Excel, and is normally used to automate common or repetitive tasks. Macro malware is the practice of hiding a virus in a macro code and enticing unsuspecting users into downloading a Word or Excel file and running the macro script within, which then will download a virus, malware or even ransomware onto that person’s PC. Macro malware was common during the 1990s, but lapsed in popularity through most of the 21st century as increasingly savvy PC users learned how to spot the spam or phishing emails that delivered them, which were often riddled with typos. Nowadays, however, macro malware is seeing a big return due to two factors – Phishing emails are becoming increasingly sophisticated and no longer have obvious typos in them, and ransomware – a very profitable form of malware for criminals – can be easily downloaded via a macro, leading to entire networks being encrypted and held to ransom. It is now critical that all users understand the threats that macro malware can pose, particularly to their organisation, and learn how to spot the attacks before it’s too late.
Excel files are a common means of transmission for macro malware, which can download ransomware to infect entire networks at a time
Traditionally, cyber security has been seen as an IT department’s problem. They make sure everyone has antivirus on their PCs and take care of the firewall – and as long as they’re doing it right, then everyone else is safe… right? This has lulled users and business owners into a false sense of security of late, believing that cyber security simply isn’t their area or that it’s not in their job description. However, this attitude is now being taken advantage of in a big way by cyber criminals, who have discovered that individual users are much easier to target and deceive. As a result, users often takes actions which inadvertently allows the hackers to bypass the IT security systems. Traditional antivirus is dead, and even more advanced next-generation antivirus simply can’t stop the most deadly attacks. Now, everyone in an organisation has a part to play in keeping it secure, from the bottom all the way up to the CEO.
Hackers are now finding it easier to target regular users, who often lack cyber security training, than to try and bypass complex technical measures put in place by IT
In May of this year, the world was shook by a global ransomware attack, the now-infamous WannaCry, which is believed to have affected more than 400,000 machines. It shook the world, crippling business big and small across a wide variety of industries. It utilised a vulnerability in the outdated Windows protocol Server Message Block (SMB) v1, and Microsoft even developed a patch for Windows XP to help defend against it. How could such an attack have caught so many organisations off guard? Well, lack of patching, cited the experts, and lack of security awareness on behalf of their employees. Patch your machines now, train your staff, and you’ll be OK going forward. Then, the following month, it happened again – the world was hit by NotPetya, a ransomware strain believed to have infected a further 250,000 machines around the world. It’s worth noting that both attacks managed to affect PCs in Ireland, and that the second of the two major attacks could have been prevented if these companies had taken appropriate measures following WannaCry.
BadRabbit is the latest in a streak of mass-ransomware attacks this year, and may have been unleashed by the creators of NotPetya
As of this week, yet another strain of mass-ransomware is out in the wild, which has been dubbed BadRabbit. While it doesn’t utilise the same vulnerability as the previous two infections, its modus operandi is very similar in that it relies on both the SMB v1 protocol (which is largely defunct in 2017) and heavy use of social engineering to trick employees into clicking their malicious links. It’s an epidemic, and too few companies are learning the lessons that the cyber and business communities have gleaned from these attacks.
Ransomware has taken the world by storm this year, costing millions for businesses around the world. In the last 12 months alone, the number of ransomware variants spotted in the wild has more than doubled. As its prevalence has increased, so has the complexity of the attacks, and new ways to defend against them have been developed. Microsoft have been known to take the ransomware threat very seriously, even releasing a security patch for the long obsolete Windows XP operating system in the wake of the infamous WannaCry attack back in May. With the realease of the Windows 10 Creators Update (build 1703), now there are even more features built right in to the OS that can prevent and protect against ransomware. In fact, it’s so secure that Microsoft claim no Windows 10 devices were affected by WannaCry.