Ransomware

Chapter 6. Threat Intelligence and Ransomware

Threat intelligence is a great guide to responding to the continuous evolution we see attackers undergoing today as part of their criminal schemes. Simply put, by understanding the types of attacks your peers and partners are experiencing, you can learn about what you should be looking for on your network and in your information systems.

It Can Happen to You!

I can recall one specific instance where I was working with a team who had received a number of new domains associated with a piece of malware that was targeting point-of-sale (POS) devices. The team initially ignored the indicators, because, they did not have POS devices on their network. However, on a whim, we ran a scan through the proxy logs and found a few systems in the head office communicating with those domains, and more specifically those URLs. After tracking down the floor, and isolating the devices on a dirty VLAN, we went to take a look. They did not have any POS devices installed, which was good, but they did have some kiosks they were building for pop-up information booths that were being tested in the marketing department, and those kiosks were running the same OS as many popular POS systems of the day. Had these been compromised, all information collected at the trade shows would have been shuttled right off to the attackers.

Most digital extortionists will blanket groups of similar companies to extract the ransoms through a fear-based system that allows them ...