How Are the Hackers Connecting?

One of the most common methods is accessing RDP ports and points on computers and devices that share the SMB protocols in Windows 10. The hackers are acting as brokers to help other scammers and cyber attackers alike. They aren’t just ethical hackers or cyber attackers these days – now people are giving the job a title: initial access broker. This is because they get the data and sell it to bidders on the dark web and other areas, government offices, countries, and even your competitors (yes, this happens).

RDP Endpoint Sales

RDP connections are a hacker’s dream come true when spreading computer viruses.

This is when cyber criminals succeed with brute force cyberattacks on your servers or workstations configured to use the Remote Desktop Protocol. They then sell these remote desktop connections.

Hacked Network Equipment

Believe it or not, there are more and more vulnerabilities becoming persistent with this. As major ISPs worldwide are getting slammed with lawsuits regarding the issue, it still happens. Hackers exploit vulnerabilities of your network routers and modems, or even VPNs, and get access into the network and to the central data unit.

BOTNet Sifters

The malware and ransomware botnets go through the computers they infect and encrypt all their data. This allows them to be sold to other ransomware teams.

Fortunately, there are some defenses regarding these computer viruses. Still, the biggest problem is that many of these emerging viruses have never been seen before – let alone in the volume in which they are modified these days. Here are some of the most common computer viruses cyber attackers use nowadays.

MARS Virus

The MARS ransomware computer virus digs its heels into your data and encrypts more files than you think.

The MARS virus is extremely new – only being discovered in November 2020. What’s interesting about this is that the primary attacks seem to be coming from Russia and the surrounding areas. This ransomware acts like many others, but there is no fix for it yet (many others have decryptors for files already, but not this one).

Emotet

The Emotet malware strikes when you click the “Enable Editing” button and is one of the more complex computer viruses to remove.

This is one of the most popular and largest malware botnets out there. While most of these attacks are with ransomware teams directly, this attack is a chain of other ransomware infections. The compromised system’s data is then sold.

Trickbot

Trickbot has been making a comeback during the pandemic and is one of many computer viruses reaping havoc on RDP accounts.

Trickbot is a pretty similar botnet. Like Emotet, it is malware that allows cybercrime to take place. However, this one infects the victims but gets access to Emotet-infected systems.

BazarLoader

This one’s a doozy but acts like the backdoor trojans of yesteryears. However, it linked to the original Trickbot hacking group and became a spinoff of that project. What’s the most important problem is that they install the Ryuk ransomware.

Qakbot/Qbot

QakBot/Qbot is one of the most devastating computer viruses you can get infected with.

This one goes by multiple names. Infosec has deemed this one a slower infection than older systems. At the same time, the QakBot groups end up taking their time with their infections. However, they collaborate with other botnet networks to make them even more lethal.

SDBBot

You need to audit your network immediately if you see any computer viruses.

This one’s a more recent malware infection. It’s tied to a cybercrime group that has been seen where Clop and other ransomware computer viruses were inserted.

Dridex

Dridex helps distribute computer viruses to unsuspecting individuals.

This backdoor trojan is more of a malware downloader program. It is one of the most used spam email campaigns today and distributes the ransomware called Locky. However, they are using other newer ransomware strains to hit larger companies.

So How Do I Stay Protected?

First, you need a network solution to protect your business’s data and preserve its security. Finding the right IT support team is one of the most important things you can do. Ransomware hackers aren’t just sticking to computers and emails anymore. These days, exploits in various items around your offices can quickly become a target. And if they get access to your router, you’re in for a world of hurt. The most important thing you can do is contact your team to install some very secure firewalls, then increase your device security with a high-powered sentinel to protect your computer.

Important January 2021 Update

How One Malware Chain Became the Most Costly & How to Defend Against It

Emotet is one of the most dangerous computer viruses we have seen in a long time.

We’ve mentioned it, and you’ve probably heard about it elsewhere. Still, Emotet – the super virus of 2020 – has become the most impactful and destructive threat to small and medium businesses, government organizations, and larger corporations. While it’s not a new virus, it’s more heavily modified. It is evolving beyond a banking trojan – including selling information to other cyber attackers and infecting users with ransomware. But what is it? And how could one initially just an email phishing virus become this big?

Much Like a Worm

The super virus known as Emotet is similar to past computer viruses called worms.

Like the old viruses called “worms,” Emotet often uses phishing emails to infect other systems on a network, other people’s contacts, and much more. And just like computer viruses of the past, users don’t know that they’ve been attacked until after.

However, Emotet is not a worm, even though it acts like one. And it can be spread in similar fashions, and other attackers have been delivering it with other methods. It was initially made as banking malware but has made its way to personal and small business computers, making it one of the most widely used and dangerous computer viruses.

Trickbot is the Second Most Dangerous

Out of all the current computer viruses, the Trickbot banking trojan ranks second regarding how much damage it produces.

Also, banking trojans are constantly being manipulated, and “improved” (more like tailored to do more damage) to the point that it’s become one of the other leading ways that cyber attackers can install ransomware on individual computers. Many of these trojans are being used to take advantage of exploits in network routers, home and business network computers, and even Microsoft products. This allows users to access any educated exploit they can use against the system to damage it.

Can an Antivirus Stop the Attack?

Installing an antivirus like SentinelOne can assist in keeping computer viruses at bay.

Although it’s highly reported that most attacks can be stopped with Windows Defender and other antivirus programs, many of these trojan viruses have protection to keep the user unaware that the virus is being installed. Even many advanced firewalls are not detecting the attacks. That’s where full-service solutions like SentinelOne come into play.

SentinelOne can offer a large defense against these attacks and even prevent them. At the same time, it can also aid in recovering data that may have been breached – and many ransomware attackers know it. Numerous companies are threatened when the attacker realizes they’re ignoring their ransomware attacks. We’ve even mentioned in a previous post that some hackers are cold-calling their victims when they know that their demands are being ignored.

So How Can You Protect Yourself?

Aside from using a full-service solution, it would help if you instilled maximum security. This is sometimes hard to do when you’re busy working. Therefore, you must have IT specialists that provide multiple services to implement these different security solutions. This could include, but not be limited to:

• Local cloud backups of your company’s financial and critical data
• Increased email security
• Advanced knowledge of cybersecurity that they’ll happily share so you can teach your employees
• A defense and helpdesk solution lets you keep busy doing what’s important – running your business.
• Voice over Internet Protocol (VoIP) systems and phone services that extend outside of your office to local home offices
• Dedicated local web hosting solutions
• And much more
• Whatever you decide to do, it’s crucial that you avoid getting these “deadly for business” computer viruses, and give us a call at Infinity DataTel today!

Cloud Service Providers Have One Thing in Common

Cloud services are an excellent way to stay connected with colleagues, share documents, and create backups. Your MSP can go over all of the benefits and possible pitfalls you may encounter.

The main reason why many people use cloud service providers is to share files. That means that they’re often an excellent alternative so people can collaborate on projects, documents, and more. However, there’s one thing that you can be uncertain of – these can all be breached, and you may never even know about it. Dropbox, for example, while it’s a great company that offers excellent file backup services (and has increased security), was breached back in 2012. While user passwords were not stolen, more than 68 million loyal customers’ information was breached, and it remains unclear to this day just how much data was taken.

So, is Local Storage Better?

Some businesses choose to back up their files on a dedicated server. Others like to use both local storage and cloud services. Talk to your MSP to see which solution will work best for your business.

While many people think that local storage is possibly safer, they couldn’t be more wrong. Both cloud service providers and managed services provide much more security for their customers’ data, and they’re less prone to human error. If one person in your company decides to use “password” as their work server password, and your system gets attacked, for example, you will be the victim of a cyberattack at some point, more than likely. When that happens, most companies trying to handle things on their own have no way to protect all of their user data, leading to massive breaches of information, loss of money, and much more.

Enter the MSP Solution

A managed services provider, MSP, does more than just cloud services and keeping your files backed up. They are, in a sense, your company’s lifeline to staying connected.

When you hire an IT Support service that can also give you cloud storage, you definitely want to take them up on the service. While their systems are locally stored on their servers, they offer a lot more security, even more than popular cloud service providers. Their systems are often rock-solid, and if you’ve ever tried to get ahold of Google’s customer support, you know that it is awful – just as with almost every one of the major corporations out there. Here are some things, though, that you’ll get with a managed service provider:

Additional Security

A good managed services provider, MSP,  takes your network’s security exceptionally seriously, and it should be a top priority.

One of the main things you can get is the most secure protocols to protect your data online. Because of this, you can ensure that your data is safer and much more easily accessible.

Backup Solutions

How important is it to backup data offsite? It might be the difference between your business shutting its doors and being able to live another day. If your MSP hasn’t come up with a viable backup plan, it may be time to look for a new MSP.

Of course, one of the primary reasons people use any cloud service is to have external data backups of their data. You get the same backup solutions and file retention. For example, if you have an essential payroll file deleted, it will remain on the server for up to 30 days (unless otherwise requested with a simple phone call) to ensure the deletion wasn’t accidental.

Longer Data Protection Service

Your MSP should continuously update your security suite, and cloud services alone cannot do this.

Another thing is that over time, you lose security with cloud service providers. By offering these services, your data is protected in a local area, and you don’t have to be the one responsible for purchasing additional security protocols for your company (advanced firewalls, antivirus, etc.).

Other IT Services

Another high note is that MSPs also provide additional IT services. If you’re choosing the networked storage option, you may even get special discounts on other IT services, and IT companies can often give you much more secure solutions on the local level so you can keep things close to home.

So, What’s the Best Option?

Some companies can benefit more from Network-attached-storage (aka NAS), but even these companies don’t use all of their resources or place all of their data on them. Therefore, a combination may be a good option for you. However, you’re better off keeping more critical documents and data, such as customer and employee login information, etc., on an MSP’s devices rather than your own or a cloud service.

These are all things you’ll want to consider when choosing what’s called a Network Attached Storage solution. In this guide, we’ll give you some of the best that we’ve found and insight into how you can benefit from this.

What is NAS?

NAS is Network Attached Storage that backs up your files in case a disaster happens.

We know NAS sounds kind of like a new energy drink. But it’s not. Think of it as a data server that is ten times better, more secure, faster, and viable than, say, an external hard drive (or a bunch of them, as some people have a problem with). Have you ever wanted to back up your entire computer? Well, this is one way to do it safely. This is a great option to keep all of your documents safe, from photos to videos, movies, music, and related files. If you ever need to access the data, you can log onto your NAS server and download them to your local device.

Why Do You Need One?

A Plex Media Server might be an excellent option if you’re looking to beef up your storage capacity and your home’s network.

This is a big question you’ll want to ask yourself. If you want to create a home media server network, you’ll probably want a pre-built option. These can be useful in a home office environment as well. Still, many are designed to offer the ability to stream things like videos, such as the famous Western Digital My Cloud (which features four bays and a custom OS that can help you back up your data and critical files, as well as having Plex Media server integrated into it for media streaming across your home’s devices). For a reliable office solution or maximum security, though, you’ll want to consider a more customized approach.

Size Matters

A 20 TB NAS will give most small businesses more than enough storage space to house their backups.

The main thing is that you need to consider the storage space you’re going to need. If you want 20 TB, you need to figure out if your NAS system can handle large drives or maximum capacity. At the same time, you’ll want to look at how many drive bays it has as well. Most of the time, you also need to consider that whatever server you’re going to use will probably be “diskless,” meaning that you’ll have to buy your hard drives.

Fortunately, you can easily buy a Synology 4-Bay NAS Diskstation for less than three hundred bucks, and a 4TB Seagate Ironwolf NAS Hard Drive can be put inside of it for less than a hundred dollars apiece (get 4 for 20TB of hard drive space!).

The Downsides to Using NAS?

You may need to install a NAS OS to set it all up, but that’s pretty easy if you do your research. There are even great solutions available like FreeNAS, which can make everything more manageable and give you accurate logging. You can also do just like other cloud servers and have numerous plugins installed, such as torrents, Plex Media Server, QBittorrent, and even home security camera tools if you want to install your NAS for that purpose.

Do I Need a Custom Installer?

Creating and sticking to a backup strategy can save your business if and when things go awry. Talk to your MSP to learn about the ins and outs of storage and a solid backup plan.

If you’re not well versed in how a backup file system works, you’ll want to have a quality service team provide installation. These are perfect for things like VoIP phone systems and more, and you may want to have a real expert like Infinity Solutions to get everything in place for you. However, for more secure options in the Phoenix area, looking into a local external cloud service may be the better option if you’re a large corporation or even a small business.

This means having your network solutions specialist set you up with a high-quality backup file system on your own dedicated hosted cloud server. Storage options can be discussed and bandwidth options so that you can get the most out of your service possible!

Backup Strategies You Can Count On

Creating and sticking to a backup strategy can save your business if and when things go awry.

First, let’s discuss your backup strategy. We will jump into this topic because you can’t have a crash plan without a proper backup strategy. Creating a backup scheme is fundamental to recovering from any significant incident. Your business could be hit by ransomware or an act of God like a hurricane. Either way, with a bit of preparation and testing, these things become less threatening.

There’s a tried and true rule for creating backups. That is called the 3-2-1 rule. It’s simple. Make three backups of everything. Two of those backups need to be on different media, like a tape backup and a cloud backup. One of those backups needs to be kept off-site, preferably in a different city or region.

Following this rule used to be a lot more complicated. With the availability of cloud services today, there is no reason not to follow this rule. Even better, all your backups can be completely automated and still follow this rule.

What Software Should We Use?

Office 365 and Google’s G Suite are both viable options when it comes to backups.

Let’s start with user PCs. These are the computers that each business assigns to employees to get work done. Today, most companies subscribe to Office 365 or Google’s G Suite. Both subscriptions include a cloud syncing service with an important feature.

Office 365 has a syncing feature called OneDrive. G Suite has its Backup and Sync service, also called Drive. Both applications will sync data stored within a designated folder on a user’s PC to the cloud. Once in the cloud, employees can access their data on the go. They can also easily send and share files stored in the cloud with customers and co-workers.

Syncing Data

Syncing your data daily or even weekly will keep your files and backups updated if an emergency occurs.

Both cloud syncing services offer two powerful features. First, if a user’s PC needs to be re-imaged or replaced, restoring those synced files is easy. The applications must be configured and given a little time to restore these files.

It’s important to note that both services will only sync data stored in those configured folders for each app. Make sure that employees are saving their data to these folders. It might be wise to set this specific sync folder as the standard Documents library in Windows. That way, files are saved to this location automatically.

The second important feature that both apps have is a file versioning feature. This is especially important for ransomware. If files are encrypted and synced, or if a user accidentally saves a file after making an unwanted change, data can be rolled back from the cloud to previous working versions.

Server Talk

Some businesses choose to back up their files on a dedicated server. Others like to use both local storage and cloud services.

Now, let us discuss servers. Servers can take a bit more work to back up, but they are not challenging. Applications like Veam can make images of current servers and backup specific folders. These features can also be used for essential computers that employees regularly use.

You will want to spend a little time deciding which computers and servers need to be backed up, and you need to determine how regularly they need to be backed up. There are many strategies to discover the answers to these questions, but the easiest way to decide is to figure out how much data you could lose before your business is impacted. Is it one day, three days, or a week?

After backups are made, they need to be stored somewhere. Thankfully, data storage has become very cheap today. There are various solutions, whether you are a small, medium, or large business. For small businesses, a simple NAS might work best. They can be purchased or built for about the price of a laptop. They can also hold a lot of data!

Once that data is saved somewhere locally, you need to think about getting it off-site. Your IT staff can help you decide on the best solution for that. There are a lot of useful applications that will save backups to online storage facilities. With services like AWS S3, Azure, and Wasabi, plenty of reasonable solutions would work for your business.

Have You Prepared for a Crash?

Restoring your information from your backup only works if you know how to do it and have a plan ahead of time.

Now, let’s talk about your crash plan. Backing up data doesn’t mean much unless you know how to restore it. So, it would help if you created a plan to restore your data.

Unfortunately, giving everyone a concrete recovery plan is beyond the scope of this article. Creating a crash plan depends on the methods you use to back up your data. Create a program built around how you would retrieve that data from wherever you are storing it. Keep in mind that you may also need to get your off-site copies.

After you have made that plan, break things down. It’s not suggested to break computers that are in active operation, so use a spare computer. Better yet, try your crash plan on different hardware as well. Let’s say a server has a hardware problem and goes down. That hardware can no longer be replaced, and you are forced to buy new computers. Can you restore your data and configure that new machine?

This is the point of testing your crash plan. Make sure it works. Chances are, your crash plan will never work on the first attempt. You need to find the holes in that plan and fill them. If you are having difficulty and can’t find the holes to fix, you can contact us, and we’ll find them for you.

The key to surviving a Ransomware attack is preparation. Preventing and recovering from a ransomware attack is a cultural habit that needs to be developed. It is not a simple set of security measures, though those security measures are certainly part of the preparation process. Any dynamic shift in a company needs to happen in stages. Otherwise, employees won’t respond well to it. Read through this list and use it as a guide to creating a roadmap of those changes that need to be made within your business.

Utilize OneDrive or Google Docs

Using OneDrive allows you to back up files in real-time. If, for some reason, you should suffer from a ransomware attack, you’ll be able to recover your files much quicker.

There’s a good chance that your business subscribes to either Office 365 or Google’s G Suite. Both of those services come with great cloud syncing software. That software can backup user files and PC configurations. These are automated processes included with the price of your subscription, so why not use them?

Both OneDrive and Google Drive, the online syncing apps for each service, will backup files in real-time as they are saved to their designated sync folder. Training employees to start using this folder can be tough, though. So, have IT start mapping that sync folder as the Document library. Also, move existing files to that folder.

Here’s the key. If something happens to a user’s PC, their files will still be available in the cloud. Because they are synced, it also makes it very easy to restore those files. Both of those services also keep a version history of data saved. That means if someone makes a mistake and saves a file or a Ransomware attack encrypts data, anyone can easily roll back to a prior version of the file that worked.

Train Your Employees to Spot a Ransomware Attack

Doing something as simple as training your employees to spot phishing emails will help you avert a Ransomware attack.

The first line of defense in any ransomware attack or virus situation is your employees. It’s not enough to ask employees to be aware of risks. Everyone knows not to open file attachments or click on links in emails they don’t recognize. Most people are even aware of inspecting those URLs or email addresses to make sure they pass the smell test.

Unfortunately, phishers, people who use social engineering attacks, have gotten good at phishing attacks. They have learned to disguise their emails better. In some cases, emails can even include spam links or email addresses that look like real things. It’s not a simple matter of trying to pass the smell test anymore. In many cases, phishing emails do now.

There was a story in the tech news not long ago written after a Firefox zero-day vulnerability was released. That tech story revolved around a computer researcher that almost got hacked from a phishing scam. The attack was extremely targeted and well thought out. If it weren’t for dumb luck, that researcher would have been hacked.

If a computer researcher can fall for phishing scams, then everyday employees can, too. There are a lot of programs out there that will train employees. They also measure how susceptible specific employees are to certain kinds of attacks. It would be wise to investigate these services or talk to your MSP about various training options.

Know Your IT Security

Being at least somewhat familiar with your IT security could save you from a future Ransomware attack.

IT security is a complex subject and is often best left to professionals. Setting up a network isn’t as simple as plugging in network cables and assigning IP addresses anymore. That will keep data flowing through the wires, but it won’t help secure your business.

A good network technician will segregate business units and functions into different VLANs, for example. This helps keep different parts of the network separate from each other. That way, if one set of employees is attacked, others may not be. This is because everyone operates in their own ‘zones.’

Another good security measure is implementing a proper firewall. Firewalls can be a bear to manage, though! Part of maintaining a firewall means making a list of all of the apps that need access to the outside world and whether data goes in or comes out of the network for those apps.

Managing Security

Managing your security and ensuring your business’s right areas are secure should be a top priority in preventing a Ransomware attack.

A firewall could be configured to block any traffic from dangerous areas of the world like Russia or China. That would prevent many of the phishing emails and links from ever getting to your business. Likewise, many pieces of Ransomware won’t function properly if they can’t phone home.

This needs to be managed appropriately, though. Some businesses might need to communicate with people from these areas. So, make sure to do a proper audit before implementing rules like this.

On a final note concerning IT security, make sure that security software is configured correctly and updated. Installing antivirus software on PCs is not enough anymore. It was recently found that Norton and Symantec were blocking Windows updates because Microsoft started deploying updates at the beginning of 2019. This is a huge issue! That means unless a PC using either of these AV suites was correctly configured, they weren’t receiving Windows patches from Microsoft! Microsoft routinely releases patches that fix vulnerabilities that hackers find. They are excellent about making these patches quickly, too. That doesn’t matter if a PC never receives a patch, though. If you don’t patch, you’re leaving yourself wide-open to a Ransomware attack.

For more safety tips or to read part 3 before it’s released to the public, please send us a message.

What to Expect From the Cloud Restore

The Windows 10 cloud restore feature is similar to that of Apple’s and not too difficult to navigate.

We expect that the Windows 10 cloud restore feature will work similarly to the way the restore feature works on Mac OS. The restore features will let users download a new copy of the Windows 10 OS to the machine over the internet. This could have a wide array of applications and issues.

It’s suspected that Microsoft might be developing this feature for both Windows 10 Lite and Windows 10 core. Both operating systems would need a lighter, more straightforward version of recovery. Though this still poses other questions.

Windows 10 Lite is expected to be Microsoft’s answer for Chrome OS. Chrome OS has a feature called Power Wash. At any time, users can wipe Chrome OS clean and re-sync all their data back to the machine. Since Chrome OS syncs user data and profiles to Google’s cloud services, this process is straightforward and fast. Microsoft already has similar options with OneDrive and Microsoft accounts. It would be expected that using this Windows 10 cloud restore feature might work much like Power Washing does for Chrome OS.

That still leaves other questions, though. How Is Microsoft going to handle this in enterprise environments? Microsoft already has a product called Windows Deployment Server (WDS). WDS lets organizations create a master image that includes applications, policies, and settings. That master image is then stored on a deployment server. At deployment time, the IT department within a business can connect a device to the network and image it through a PXE environment. This has been a standard deployment tool within the Microsoft ecosystem for many years.

What is Microsoft’s Plan?

Microsoft might be rolling out the Windows 10 cloud restore feature in hopes of adding it to its 365 families.

Microsoft could be bolstering this service for their suspected Microsoft 365 service expected to debut in the future. The Microsoft 365 service is expected to change how organizations, both big and small, handle IT. This new subscription model would allow businesses to not only lease hardware through Microsoft but also lease deployment tools as well. Microsoft would take creating the master image for devices, as well as deployment to those devices. If Microsoft has a cloud deployment feature, that will make it much easier for them to deploy images to customers’ PCs.

The jury is still out on whether Microsoft will make any inroads with this service. After the Microsoft 365 service was leaked, the IT industry and hardware partners alike had a massive outcry against it. Many believe that this Microsoft 365 service may undercut the business IT structure and remove control of IT functions away from the company. As expected, many companies are skeptical about having Microsoft handle all their IT needs.

Problems That May Occur

A few problems may arise when using Microsoft Windows 10 cloud restore, but they should develop patches to fix them as time passes.

Looking back at consumer gadgets, this cloud restore function may also cause an issue for low-end devices, or it may resolve past issues Microsoft has had with them as well. In the past, OEMs have sold devices with only 32-64gbs of storage space. These devices would quickly run out of storage and not be able to accept Microsoft updates. This has posed security issues in the past.

Likewise, Microsoft only supports hardware in Windows 10 for a certain amount of time. Unlike Windows 7, a PC sold only five years ago may not receive major Windows 10 updates. This has been an issue with some of the older Intel I series processors and some AMD CPUs. Some versions of Windows 10 will not install on these older hardware platforms.

It could be assumed that since these devices don’t support newer versions of Windows 10 that they might not be affected by this cloud restore feature. After all, these older devices won’t be able to update a version of Windows 10 that supports it. When Windows 10 launched, Microsoft stated that it would be the last version of Windows released. Instead of releasing significant new versions of Windows every five years, Microsoft would instead put Windows on a rolling update schedule.

This could mean that even though current hardware might support Windows 10 with this cloud restore feature, they may not support future versions of Windows 10 in a couple of years. How will Microsoft handle devices that need to be fixed that do not support the latest release of Windows 10? It could be assumed that this cloud restore feature will only push the newest version of the OS, causing issues.

Wrapping Up

This is all speculation as of now. The Windows 10 cloud restore feature isn’t even publicly available yet, and Microsoft has made no official rollout announcements either. Only time will tell what issues might arise in both the enterprise and consumer environments from this restore feature.

If you’d like to learn more about how the cloud can help your organization, send us a message. If you have any questions or insight about Microsoft’s cloud restore, please leave a comment below.