PDF Version: types-of-targeted-ddos-attacks
Tag: Cyber Security Page 8 of 41
BitPaymer is a ransomware type cyber threat that typically targets Windows-based systems on a compromised network. Also known as “wp_encrypt,” it was first discovered in 2017 and has launched different versions since then.
What Are The Attack Vectors of BitPaymer Ransomware?
BitPaymer uses multiple attack vectors to infiltrate the target network or system. The most commonly used attack vectors are:
- Phishing emails targeting organization’s employees
- Software downloads via third party, fake or malicious links
- Brute force attacks
What Does BitPaymer Ransomware Do?
BitPaymer Ransomware uses multiple steps to spread laterally across a network & infect multiple systems. Let us understand how the ransomware works:
- After infecting a system, the ransomware conceals itself & stays in the victim system to gather information such as login credentials, shared drives, IP addresses, private network details, etc.
- It further scans for servers running Microsoft Exchange & Microsoft SQL.
- The malware then penetrates Active Directory running on the network for lateral movement by infecting all other systems connected to the network.
- Once the systems are infected, the ransomware now encrypts all the files on the victim systems using RC4 and RSA-1024 encryption algorithms.
- The encrypted files are saved using “.locked” file extension. Some new versions of the BitPaymer ransomware use “.LOCK” as the file extension.
- A text file is generated for every encrypted file with extension “readme_txt” to inform the victim of encryption and provide details to contact the hacker.
- The ransomware also deletes the recovery checkpoints from the Windows system.
- A personalized ransomware note is also left on the desktop which includes ransom fee and steps that should be taken for data recovery.
What Makes BitPaymer Ransomware Unique?
BitPaymer Ransomware differs from other ransomware in many ways:
- The ransomware is very well-coded as compared to majority of ransomware that use Ransomware-As-A-Service codes.
- The hackers manually attack the Active Directory running on the network & also spend time to know the victim thoroughly.
- In some strains of the ransomware, the hackers build custom binary for every victim and even use the victim organization’s name in encrypted file extension.
- The ransomware makes extensive efforts to stay concealed in the target system.
How To Stay Protected Against BitPaymer Ransomware?
- Educate employees by conducting cyber security workshops to make them capable of spotting phishing attacks.
- Ensure regular data backup at multiple locations.
- Thoroughly review all RDP connections & secure them.
- Make sure to download & install the latest security updates on all servers & systems.
To know more about cyber security solutions for businesses, contact Centex Technologies. You can contact Centex Technologies at Killeen (254) 213 – 4740, Dallas (972) 375 – 9654, Atlanta (404) 994 – 5074, and Austin (512) 956 – 5454.
The Business Continuity Plan, or BCP, focuses on the mitigation of potential risks and the restoration of operations in the event of a cyber-attack. With the ever-increasing risk of cyber-attacks, BCP is now an integral part of the overall business plan for most organizations.
Here are some ways that can help businesses integrate cyber security in their business plan in an effective & efficient manner:
- Involve Cyber Security Teams: Cyber security teams are usually well aware of the areas of concern regarding cyber security. Involving them in the discussion helps in gaining benefits from their insight & ensuring that all major concerns are taken into consideration.
- Secure All Systems: Secure the systems that run your business including the Wi-Fi networks, on-premise computers, remote devices, and all the endpoints connected to the network.
- Implement Basic Controls: Cyber Security & Business Plan Management teams should work in alliance to formulate & implement basic controls. Some examples of basic controls include remote working policies, remote device management policies, VPN management, mobile device management, etc. A thorough layout of policies, investments, roles, & responsibilities should be chalked out to define individual roles in case of crisis management.
- Ensure Data Backup: Lost data can cause serious business disruptions which can cause huge financial losses to the business. An amalgamation of cyber security & business continuity plan can help in combating business disruption caused by loss of data due to a data breach. Implementing regular data backup as a part of disaster recovery strategy is a logical action that helps in restoring access to data.
- Emergency Access Management: In times of crisis or recovery management, it sometimes becomes essential to grant access to third parties. However, appropriate policies should be laid down to make sure that level of access is limited to required systems or networks only.
- Prioritize Communication: Timely detection & remediation is key to preventing or fighting against cyber-attacks. So, promote multiple communication channels and make your employees understand the importance of communicating any irregularities or signs of breach to the designated team.
- Deploy Firewalls: A firewall is essential to secure network and systems from outside threats. However, as businesses now have both on-premises and remote systems or devices, it has become essential to deploy multiple firewalls – centralized firewall & program firewall. A centralized firewall protects the hardware while a program firewall helps in ensuring the security of individual devices.
- Automate Critical Processes: It is important to ensure business continuity even if the business faces a crisis such as cyber-attack. Also, it helps in ensuring the smooth working of critical business operations to minimize the impact of the crisis. This can be done by automating critical operations to make sure they keep running without any manual intervention even during a crisis.
- Formulate a Disaster Recovery Plan: Make sure that disaster recovery is a part of your business plan. A disaster recovery plan lays out thorough steps for threat recognition, response, & remediation for minimizing the impact of an attack.
Consult Centex Technologies for enterprise cyber security solutions. Contact Centex Technologies at Killeen (254) 213 – 4740, Dallas (972) 375 – 9654, Atlanta (404) 994 – 5074, and Austin (512) 956 – 5454.
After Joker, there is a new addition in the line of Batman villain-themed malware, named “Harly”. Named after the fictional girlfriend (Harley Quinn) of “Joker” in the Batman series, this trojan can be defined as an auto-subscriber that works under the pretext of legitimate android apps.
To begin with, let us understand the basic difference between Joker & Harly Trojan.
- Apps developed under the Joker series did not possess any malicious code. Instead, they worked by offering legitimate services to lure the target users into downloading the app from Google Play Store. Once the app was downloaded, it would download the malicious code on the victim’s phone. This code could send expensive SMS messages to premium rate numbers from the victim’s phone.
- On the contrary, Harly is a step ahead. The apps contain the malicious code required to function and thus do not depend on remote CCS (control & Command Server). This makes Harly trojan difficult to detect.
The reach of Harly trojan can be estimated from the fact that over 190 apps in Google Play Store are infected by this trojan, and infected apps have been downloaded more than 4.8 million times.
How does Harly Trojan Work?
The functioning of Harly trojan can be understood as a step-wise process.
- The trojan is distributed using android apps in Google Play Store.
- Cybercriminals download legitimate apps available in the play store.
- Malicious code is injected into the app code while retaining the original functioning of the app.
- The altered app is uploaded to the play store under a different name.
- When user downloads this app, the app decrypts the malicious code & launches it.
The purpose of the code is to gather information related to the target device, such as device configuration & network. Based on these details, the malicious code fetches a subscription list for the victim & signs him up for paid subscriptions.
Can Harly Sign Up The Victim For Subscriptions Bypassing SMS Or Call Verification?
A standard safety measure deployed while activating paid subscriptions is to send a verification code via SMS or over a phone call. But, Harly trojan is capable of bypassing this security measure.
To begin with, it disconnects the Wi-Fi on the mobile device & connects it to the internet using the mobile service provider’s network. Following this, it opens hidden windows to fetch user details for subscription. The trojan then gains access to the messages and intercepts the code sent for verification.
How to Stay Protected Against Harly Trojan?
A few preventive measures & diligences can help in avoiding falling prey to Harly trojan.
- Thoroughly review the testimonials before downloading any app & avoid apps with negative feedback.
- Avoid installing unnecessary apps on your mobile device.
- Use open code apps as it allow users to inspect the code. Malware code hidden in the source code can be found easily.
- Place a spending limit on your mobile phone & keep an eye on your subscriptions.
For more information about cybersecurity solutions, contact Centex Technologies. You can call at the following office locations – Killeen (254) 213 – 4740, Dallas (972) 375 – 9654, Atlanta (404) 994 – 5074, and Austin (512) 956 – 5454.
