How Are the Hackers Connecting?

One of the most common methods is accessing RDP ports and points on computers and devices that share the SMB protocols in Windows 10. The hackers are acting as brokers to help other scammers and cyber attackers alike. They aren’t just ethical hackers or cyber attackers these days – now people are giving the job a title: initial access broker. This is because they get the data and sell it to bidders on the dark web and other areas, government offices, countries, and even your competitors (yes, this happens).

RDP Endpoint Sales

RDP connections are a hacker’s dream come true when spreading computer viruses.

This is when cyber criminals succeed with brute force cyberattacks on your servers or workstations configured to use the Remote Desktop Protocol. They then sell these remote desktop connections.

Hacked Network Equipment

Believe it or not, there are more and more vulnerabilities becoming persistent with this. As major ISPs worldwide are getting slammed with lawsuits regarding the issue, it still happens. Hackers exploit vulnerabilities of your network routers and modems, or even VPNs, and get access into the network and to the central data unit.

BOTNet Sifters

The malware and ransomware botnets go through the computers they infect and encrypt all their data. This allows them to be sold to other ransomware teams.

Fortunately, there are some defenses regarding these computer viruses. Still, the biggest problem is that many of these emerging viruses have never been seen before – let alone in the volume in which they are modified these days. Here are some of the most common computer viruses cyber attackers use nowadays.

MARS Virus

The MARS ransomware computer virus digs its heels into your data and encrypts more files than you think.

The MARS virus is extremely new – only being discovered in November 2020. What’s interesting about this is that the primary attacks seem to be coming from Russia and the surrounding areas. This ransomware acts like many others, but there is no fix for it yet (many others have decryptors for files already, but not this one).

Emotet

The Emotet malware strikes when you click the “Enable Editing” button and is one of the more complex computer viruses to remove.

This is one of the most popular and largest malware botnets out there. While most of these attacks are with ransomware teams directly, this attack is a chain of other ransomware infections. The compromised system’s data is then sold.

Trickbot

Trickbot has been making a comeback during the pandemic and is one of many computer viruses reaping havoc on RDP accounts.

Trickbot is a pretty similar botnet. Like Emotet, it is malware that allows cybercrime to take place. However, this one infects the victims but gets access to Emotet-infected systems.

BazarLoader

This one’s a doozy but acts like the backdoor trojans of yesteryears. However, it linked to the original Trickbot hacking group and became a spinoff of that project. What’s the most important problem is that they install the Ryuk ransomware.

Qakbot/Qbot

QakBot/Qbot is one of the most devastating computer viruses you can get infected with.

This one goes by multiple names. Infosec has deemed this one a slower infection than older systems. At the same time, the QakBot groups end up taking their time with their infections. However, they collaborate with other botnet networks to make them even more lethal.

SDBBot

You need to audit your network immediately if you see any computer viruses.

This one’s a more recent malware infection. It’s tied to a cybercrime group that has been seen where Clop and other ransomware computer viruses were inserted.

Dridex

Dridex helps distribute computer viruses to unsuspecting individuals.

This backdoor trojan is more of a malware downloader program. It is one of the most used spam email campaigns today and distributes the ransomware called Locky. However, they are using other newer ransomware strains to hit larger companies.

So How Do I Stay Protected?

First, you need a network solution to protect your business’s data and preserve its security. Finding the right IT support team is one of the most important things you can do. Ransomware hackers aren’t just sticking to computers and emails anymore. These days, exploits in various items around your offices can quickly become a target. And if they get access to your router, you’re in for a world of hurt. The most important thing you can do is contact your team to install some very secure firewalls, then increase your device security with a high-powered sentinel to protect your computer.

Important January 2021 Update

How One Malware Chain Became the Most Costly & How to Defend Against It

Emotet is one of the most dangerous computer viruses we have seen in a long time.

We’ve mentioned it, and you’ve probably heard about it elsewhere. Still, Emotet – the super virus of 2020 – has become the most impactful and destructive threat to small and medium businesses, government organizations, and larger corporations. While it’s not a new virus, it’s more heavily modified. It is evolving beyond a banking trojan – including selling information to other cyber attackers and infecting users with ransomware. But what is it? And how could one initially just an email phishing virus become this big?

Much Like a Worm

The super virus known as Emotet is similar to past computer viruses called worms.

Like the old viruses called “worms,” Emotet often uses phishing emails to infect other systems on a network, other people’s contacts, and much more. And just like computer viruses of the past, users don’t know that they’ve been attacked until after.

However, Emotet is not a worm, even though it acts like one. And it can be spread in similar fashions, and other attackers have been delivering it with other methods. It was initially made as banking malware but has made its way to personal and small business computers, making it one of the most widely used and dangerous computer viruses.

Trickbot is the Second Most Dangerous

Out of all the current computer viruses, the Trickbot banking trojan ranks second regarding how much damage it produces.

Also, banking trojans are constantly being manipulated, and “improved” (more like tailored to do more damage) to the point that it’s become one of the other leading ways that cyber attackers can install ransomware on individual computers. Many of these trojans are being used to take advantage of exploits in network routers, home and business network computers, and even Microsoft products. This allows users to access any educated exploit they can use against the system to damage it.

Can an Antivirus Stop the Attack?

Installing an antivirus like SentinelOne can assist in keeping computer viruses at bay.

Although it’s highly reported that most attacks can be stopped with Windows Defender and other antivirus programs, many of these trojan viruses have protection to keep the user unaware that the virus is being installed. Even many advanced firewalls are not detecting the attacks. That’s where full-service solutions like SentinelOne come into play.

SentinelOne can offer a large defense against these attacks and even prevent them. At the same time, it can also aid in recovering data that may have been breached – and many ransomware attackers know it. Numerous companies are threatened when the attacker realizes they’re ignoring their ransomware attacks. We’ve even mentioned in a previous post that some hackers are cold-calling their victims when they know that their demands are being ignored.

So How Can You Protect Yourself?

Aside from using a full-service solution, it would help if you instilled maximum security. This is sometimes hard to do when you’re busy working. Therefore, you must have IT specialists that provide multiple services to implement these different security solutions. This could include, but not be limited to:

• Local cloud backups of your company’s financial and critical data
• Increased email security
• Advanced knowledge of cybersecurity that they’ll happily share so you can teach your employees
• A defense and helpdesk solution lets you keep busy doing what’s important – running your business.
• Voice over Internet Protocol (VoIP) systems and phone services that extend outside of your office to local home offices
• Dedicated local web hosting solutions
• And much more
• Whatever you decide to do, it’s crucial that you avoid getting these “deadly for business” computer viruses, and give us a call at Infinity DataTel today!

Backup Strategies You Can Count On

Creating and sticking to a backup strategy can save your business if and when things go awry.

First, let’s discuss your backup strategy. We will jump into this topic because you can’t have a crash plan without a proper backup strategy. Creating a backup scheme is fundamental to recovering from any significant incident. Your business could be hit by ransomware or an act of God like a hurricane. Either way, with a bit of preparation and testing, these things become less threatening.

There’s a tried and true rule for creating backups. That is called the 3-2-1 rule. It’s simple. Make three backups of everything. Two of those backups need to be on different media, like a tape backup and a cloud backup. One of those backups needs to be kept off-site, preferably in a different city or region.

Following this rule used to be a lot more complicated. With the availability of cloud services today, there is no reason not to follow this rule. Even better, all your backups can be completely automated and still follow this rule.

What Software Should We Use?

Office 365 and Google’s G Suite are both viable options when it comes to backups.

Let’s start with user PCs. These are the computers that each business assigns to employees to get work done. Today, most companies subscribe to Office 365 or Google’s G Suite. Both subscriptions include a cloud syncing service with an important feature.

Office 365 has a syncing feature called OneDrive. G Suite has its Backup and Sync service, also called Drive. Both applications will sync data stored within a designated folder on a user’s PC to the cloud. Once in the cloud, employees can access their data on the go. They can also easily send and share files stored in the cloud with customers and co-workers.

Syncing Data

Syncing your data daily or even weekly will keep your files and backups updated if an emergency occurs.

Both cloud syncing services offer two powerful features. First, if a user’s PC needs to be re-imaged or replaced, restoring those synced files is easy. The applications must be configured and given a little time to restore these files.

It’s important to note that both services will only sync data stored in those configured folders for each app. Make sure that employees are saving their data to these folders. It might be wise to set this specific sync folder as the standard Documents library in Windows. That way, files are saved to this location automatically.

The second important feature that both apps have is a file versioning feature. This is especially important for ransomware. If files are encrypted and synced, or if a user accidentally saves a file after making an unwanted change, data can be rolled back from the cloud to previous working versions.

Server Talk

Some businesses choose to back up their files on a dedicated server. Others like to use both local storage and cloud services.

Now, let us discuss servers. Servers can take a bit more work to back up, but they are not challenging. Applications like Veam can make images of current servers and backup specific folders. These features can also be used for essential computers that employees regularly use.

You will want to spend a little time deciding which computers and servers need to be backed up, and you need to determine how regularly they need to be backed up. There are many strategies to discover the answers to these questions, but the easiest way to decide is to figure out how much data you could lose before your business is impacted. Is it one day, three days, or a week?

After backups are made, they need to be stored somewhere. Thankfully, data storage has become very cheap today. There are various solutions, whether you are a small, medium, or large business. For small businesses, a simple NAS might work best. They can be purchased or built for about the price of a laptop. They can also hold a lot of data!

Once that data is saved somewhere locally, you need to think about getting it off-site. Your IT staff can help you decide on the best solution for that. There are a lot of useful applications that will save backups to online storage facilities. With services like AWS S3, Azure, and Wasabi, plenty of reasonable solutions would work for your business.

Have You Prepared for a Crash?

Restoring your information from your backup only works if you know how to do it and have a plan ahead of time.

Now, let’s talk about your crash plan. Backing up data doesn’t mean much unless you know how to restore it. So, it would help if you created a plan to restore your data.

Unfortunately, giving everyone a concrete recovery plan is beyond the scope of this article. Creating a crash plan depends on the methods you use to back up your data. Create a program built around how you would retrieve that data from wherever you are storing it. Keep in mind that you may also need to get your off-site copies.

After you have made that plan, break things down. It’s not suggested to break computers that are in active operation, so use a spare computer. Better yet, try your crash plan on different hardware as well. Let’s say a server has a hardware problem and goes down. That hardware can no longer be replaced, and you are forced to buy new computers. Can you restore your data and configure that new machine?

This is the point of testing your crash plan. Make sure it works. Chances are, your crash plan will never work on the first attempt. You need to find the holes in that plan and fill them. If you are having difficulty and can’t find the holes to fix, you can contact us, and we’ll find them for you.

The key to surviving a Ransomware attack is preparation. Preventing and recovering from a ransomware attack is a cultural habit that needs to be developed. It is not a simple set of security measures, though those security measures are certainly part of the preparation process. Any dynamic shift in a company needs to happen in stages. Otherwise, employees won’t respond well to it. Read through this list and use it as a guide to creating a roadmap of those changes that need to be made within your business.

Utilize OneDrive or Google Docs

Using OneDrive allows you to back up files in real-time. If, for some reason, you should suffer from a ransomware attack, you’ll be able to recover your files much quicker.

There’s a good chance that your business subscribes to either Office 365 or Google’s G Suite. Both of those services come with great cloud syncing software. That software can backup user files and PC configurations. These are automated processes included with the price of your subscription, so why not use them?

Both OneDrive and Google Drive, the online syncing apps for each service, will backup files in real-time as they are saved to their designated sync folder. Training employees to start using this folder can be tough, though. So, have IT start mapping that sync folder as the Document library. Also, move existing files to that folder.

Here’s the key. If something happens to a user’s PC, their files will still be available in the cloud. Because they are synced, it also makes it very easy to restore those files. Both of those services also keep a version history of data saved. That means if someone makes a mistake and saves a file or a Ransomware attack encrypts data, anyone can easily roll back to a prior version of the file that worked.

Train Your Employees to Spot a Ransomware Attack

Doing something as simple as training your employees to spot phishing emails will help you avert a Ransomware attack.

The first line of defense in any ransomware attack or virus situation is your employees. It’s not enough to ask employees to be aware of risks. Everyone knows not to open file attachments or click on links in emails they don’t recognize. Most people are even aware of inspecting those URLs or email addresses to make sure they pass the smell test.

Unfortunately, phishers, people who use social engineering attacks, have gotten good at phishing attacks. They have learned to disguise their emails better. In some cases, emails can even include spam links or email addresses that look like real things. It’s not a simple matter of trying to pass the smell test anymore. In many cases, phishing emails do now.

There was a story in the tech news not long ago written after a Firefox zero-day vulnerability was released. That tech story revolved around a computer researcher that almost got hacked from a phishing scam. The attack was extremely targeted and well thought out. If it weren’t for dumb luck, that researcher would have been hacked.

If a computer researcher can fall for phishing scams, then everyday employees can, too. There are a lot of programs out there that will train employees. They also measure how susceptible specific employees are to certain kinds of attacks. It would be wise to investigate these services or talk to your MSP about various training options.

Know Your IT Security

Being at least somewhat familiar with your IT security could save you from a future Ransomware attack.

IT security is a complex subject and is often best left to professionals. Setting up a network isn’t as simple as plugging in network cables and assigning IP addresses anymore. That will keep data flowing through the wires, but it won’t help secure your business.

A good network technician will segregate business units and functions into different VLANs, for example. This helps keep different parts of the network separate from each other. That way, if one set of employees is attacked, others may not be. This is because everyone operates in their own ‘zones.’

Another good security measure is implementing a proper firewall. Firewalls can be a bear to manage, though! Part of maintaining a firewall means making a list of all of the apps that need access to the outside world and whether data goes in or comes out of the network for those apps.

Managing Security

Managing your security and ensuring your business’s right areas are secure should be a top priority in preventing a Ransomware attack.

A firewall could be configured to block any traffic from dangerous areas of the world like Russia or China. That would prevent many of the phishing emails and links from ever getting to your business. Likewise, many pieces of Ransomware won’t function properly if they can’t phone home.

This needs to be managed appropriately, though. Some businesses might need to communicate with people from these areas. So, make sure to do a proper audit before implementing rules like this.

On a final note concerning IT security, make sure that security software is configured correctly and updated. Installing antivirus software on PCs is not enough anymore. It was recently found that Norton and Symantec were blocking Windows updates because Microsoft started deploying updates at the beginning of 2019. This is a huge issue! That means unless a PC using either of these AV suites was correctly configured, they weren’t receiving Windows patches from Microsoft! Microsoft routinely releases patches that fix vulnerabilities that hackers find. They are excellent about making these patches quickly, too. That doesn’t matter if a PC never receives a patch, though. If you don’t patch, you’re leaving yourself wide-open to a Ransomware attack.

For more safety tips or to read part 3 before it’s released to the public, please send us a message.