How Are the Hackers Connecting?

One of the most common methods is accessing RDP ports and points on computers and devices that share the SMB protocols in Windows 10. The hackers are acting as brokers to help other scammers and cyber attackers alike. They aren’t just ethical hackers or cyber attackers these days – now people are giving the job a title: initial access broker. This is because they get the data and sell it to bidders on the dark web and other areas, government offices, countries, and even your competitors (yes, this happens).

RDP Endpoint Sales

RDP connections are a hacker’s dream come true when spreading computer viruses.

This is when cyber criminals succeed with brute force cyberattacks on your servers or workstations configured to use the Remote Desktop Protocol. They then sell these remote desktop connections.

Hacked Network Equipment

Believe it or not, there are more and more vulnerabilities becoming persistent with this. As major ISPs worldwide are getting slammed with lawsuits regarding the issue, it still happens. Hackers exploit vulnerabilities of your network routers and modems, or even VPNs, and get access into the network and to the central data unit.

BOTNet Sifters

The malware and ransomware botnets go through the computers they infect and encrypt all their data. This allows them to be sold to other ransomware teams.

Fortunately, there are some defenses regarding these computer viruses. Still, the biggest problem is that many of these emerging viruses have never been seen before – let alone in the volume in which they are modified these days. Here are some of the most common computer viruses cyber attackers use nowadays.

MARS Virus

The MARS ransomware computer virus digs its heels into your data and encrypts more files than you think.

The MARS virus is extremely new – only being discovered in November 2020. What’s interesting about this is that the primary attacks seem to be coming from Russia and the surrounding areas. This ransomware acts like many others, but there is no fix for it yet (many others have decryptors for files already, but not this one).

Emotet

The Emotet malware strikes when you click the “Enable Editing” button and is one of the more complex computer viruses to remove.

This is one of the most popular and largest malware botnets out there. While most of these attacks are with ransomware teams directly, this attack is a chain of other ransomware infections. The compromised system’s data is then sold.

Trickbot

Trickbot has been making a comeback during the pandemic and is one of many computer viruses reaping havoc on RDP accounts.

Trickbot is a pretty similar botnet. Like Emotet, it is malware that allows cybercrime to take place. However, this one infects the victims but gets access to Emotet-infected systems.

BazarLoader

This one’s a doozy but acts like the backdoor trojans of yesteryears. However, it linked to the original Trickbot hacking group and became a spinoff of that project. What’s the most important problem is that they install the Ryuk ransomware.

Qakbot/Qbot

QakBot/Qbot is one of the most devastating computer viruses you can get infected with.

This one goes by multiple names. Infosec has deemed this one a slower infection than older systems. At the same time, the QakBot groups end up taking their time with their infections. However, they collaborate with other botnet networks to make them even more lethal.

SDBBot

You need to audit your network immediately if you see any computer viruses.

This one’s a more recent malware infection. It’s tied to a cybercrime group that has been seen where Clop and other ransomware computer viruses were inserted.

Dridex

Dridex helps distribute computer viruses to unsuspecting individuals.

This backdoor trojan is more of a malware downloader program. It is one of the most used spam email campaigns today and distributes the ransomware called Locky. However, they are using other newer ransomware strains to hit larger companies.

So How Do I Stay Protected?

First, you need a network solution to protect your business’s data and preserve its security. Finding the right IT support team is one of the most important things you can do. Ransomware hackers aren’t just sticking to computers and emails anymore. These days, exploits in various items around your offices can quickly become a target. And if they get access to your router, you’re in for a world of hurt. The most important thing you can do is contact your team to install some very secure firewalls, then increase your device security with a high-powered sentinel to protect your computer.

Important January 2021 Update

How One Malware Chain Became the Most Costly & How to Defend Against It

Emotet is one of the most dangerous computer viruses we have seen in a long time.

We’ve mentioned it, and you’ve probably heard about it elsewhere. Still, Emotet – the super virus of 2020 – has become the most impactful and destructive threat to small and medium businesses, government organizations, and larger corporations. While it’s not a new virus, it’s more heavily modified. It is evolving beyond a banking trojan – including selling information to other cyber attackers and infecting users with ransomware. But what is it? And how could one initially just an email phishing virus become this big?

Much Like a Worm

The super virus known as Emotet is similar to past computer viruses called worms.

Like the old viruses called “worms,” Emotet often uses phishing emails to infect other systems on a network, other people’s contacts, and much more. And just like computer viruses of the past, users don’t know that they’ve been attacked until after.

However, Emotet is not a worm, even though it acts like one. And it can be spread in similar fashions, and other attackers have been delivering it with other methods. It was initially made as banking malware but has made its way to personal and small business computers, making it one of the most widely used and dangerous computer viruses.

Trickbot is the Second Most Dangerous

Out of all the current computer viruses, the Trickbot banking trojan ranks second regarding how much damage it produces.

Also, banking trojans are constantly being manipulated, and “improved” (more like tailored to do more damage) to the point that it’s become one of the other leading ways that cyber attackers can install ransomware on individual computers. Many of these trojans are being used to take advantage of exploits in network routers, home and business network computers, and even Microsoft products. This allows users to access any educated exploit they can use against the system to damage it.

Can an Antivirus Stop the Attack?

Installing an antivirus like SentinelOne can assist in keeping computer viruses at bay.

Although it’s highly reported that most attacks can be stopped with Windows Defender and other antivirus programs, many of these trojan viruses have protection to keep the user unaware that the virus is being installed. Even many advanced firewalls are not detecting the attacks. That’s where full-service solutions like SentinelOne come into play.

SentinelOne can offer a large defense against these attacks and even prevent them. At the same time, it can also aid in recovering data that may have been breached – and many ransomware attackers know it. Numerous companies are threatened when the attacker realizes they’re ignoring their ransomware attacks. We’ve even mentioned in a previous post that some hackers are cold-calling their victims when they know that their demands are being ignored.

So How Can You Protect Yourself?

Aside from using a full-service solution, it would help if you instilled maximum security. This is sometimes hard to do when you’re busy working. Therefore, you must have IT specialists that provide multiple services to implement these different security solutions. This could include, but not be limited to:

• Local cloud backups of your company’s financial and critical data
• Increased email security
• Advanced knowledge of cybersecurity that they’ll happily share so you can teach your employees
• A defense and helpdesk solution lets you keep busy doing what’s important – running your business.
• Voice over Internet Protocol (VoIP) systems and phone services that extend outside of your office to local home offices
• Dedicated local web hosting solutions
• And much more
• Whatever you decide to do, it’s crucial that you avoid getting these “deadly for business” computer viruses, and give us a call at Infinity DataTel today!

Why is it so bad? First, this is one of the rare advanced ransomware infections that you can find very little (but often duplicated content) about this nasty ransomware installed on your computer. According to the information that you get with the virus in the infamous !!! MARS_DECRYPT.TXT file that goes into every folder and attacks your Microsoft Office files. But wait, there’s more.

What is this MARS Ransomware Virus?

The MARS ransomware acts similarly to other ransomware viruses out there. You can get it in numerous ways, but the most common practice these days is thanks to the SMB: CVE-2020-0796 exploit in Windows 10. Fortunately, Windows versions 1903 and 1909 have these patches available in the Windows Update store. Still, there is only a workaround (which isn’t even guaranteed to work) using a PowerShell command that ends up blocking SMB protocols.

The easiest way to deter the MARS ransomware is to turn off your computer’s SMB.

Want another workaround? Turn off SMB in your Microsoft Windows system. No. Really. All of it. Unfortunately for businesses and even home office networks, this makes file sharing between computers a pain in the butt. You can also disable Windows Services (or port 445) on your router network – but then this also can break the ability for Windows to download data from Windows services.

The virus is installed, and apparently, it seems that it is a Russian hacker with complete access. It tells you that you have so many of your office files and infects different file types. They list all that the virus is supposedly encrypting – but this isn’t all the files that get encrypted on your device. The virus then installs other malware into browsers and causes chrome to go haywire in the background, loading extremely malicious websites and installing other viruses.

However, the tricky thing is that you don’t even see what websites open because the windows are invisible (Malwarebytes can catch this happening if you’re infected in real-time).

What’s MARS Ransomware’s Goal?

Like most ransomware, the MARS ransomware is after Bitcoin. Image by Aaron Olson from Pixabay

The goal of these types of ransomware is to steal bitcoin. These days, small businesses have been getting hit harder and more often regarding ransomware. The reason? It’s much easier to charge many small companies, LLCs, and freelancers these days a small amount than to go after a big company with more robust security. More people get infected for no reason – more people pay smaller amounts. This is a business tactic on its own (think about customer service. Charge less, get more customers).

The MARS ransomware infection attacks your system when malicious attachments containing malicious files are downloaded, demanding bitcoin (usually anywhere from $500-800. The encryption process happens swiftly, and you are in big trouble if you don’t have a cloud backup. They tell you to send the unique id and three files for test decryption to an outlook or Russian email address. After decryption, they send you the decrypted files and give you a bitcoin wallet to send the money to.

What Files Are Affected?

“All your important files are encrypted.
To recover encrypted files, you need:1. Buy bitcoins. The easiest way to buy bitcoins is the LocalBitcoins site. You must register, click “Buy Bitcoins,” and select a seller by payment method and price. https://localbitcoins.com/buy_bitcoins

You can also find other places to buy bitcoins and a beginner’s guide here:

“They claim that they’re only infecting office documents, but it gets much worse than that. According to their “ransom note,” they encrypt the following filetypes:

The MARS ransomware digs its heels into your data and encrypts more files than you think.

XLS, XLSX, DOC, DOCX, PPT, PPTX, ODT, ODS, PDF, PSD, FPT, PHP, and MDB files. However, it gets much deeper than that. If the virus runs for a while, then you may notice that even these files get encrypted: .bmp, .jpg, .mp4, .sav (emulator saved games), .dat, .ini, .txt, .rtf, .dotm, .cs (C#), visual studio files, .wav, .mp3, .wma, and many others.

So What Am I Supposed to Do to Be Safe?

Want to keep the MARS ransomware away? Make sure your password-protected sharing is turned on.

If you think you may be at risk, we already gave you a basic idea. Ensure that you don’t have password-protected sharing turned off, but most importantly, disable the SMB protocol on your computer. You can do this currently (until the future Windows Update) in Control Panel > Programs and Features > Windows Features and uncheck both boxes showing SMB in the title. Restart your computer after this and apply the changes. But this doesn’t necessarily mean that you’re safe.

Can I Restore the Encrypted Files?

There are numerous types of file decryption programs released by multiple companies. This ranges from Kaspersky Labs to even Trend Micro and more – but they haven’t created a decryption key for this virus, and we don’t recommend one decryption program over another. It was just discovered this month, and while some say you can use things like Stellar Data Recovery, many users complain that it doesn’t work to recover their files after decryption.

If you have a Shadow Copy from the Windows Shadow Volume Copy service, you may be lucky enough to get some of these files back if you restore them to a specific date. However, you may end up losing some files in the process still.

While a restore point may restore your programs before the attack, this may leave you vulnerable. This is why we urge all of our users to perform a cloud backup daily and, at worst, a weekly backup because it makes the recovery process much more straightforward. In many cases, the only way to fix the solution is to reset your computer using the Windows 10 Recovery Tool.

Mars Ransomware Removal

There are two ways to remove Mars Ransomware from your system. One method involves removing the malware manually with Malwarebytes Anti-Malware Premium or a similar program. Another option is to purchase an anti-malware tool such as SpyHunter, which has been proven effective against similar threats. Both methods require downloading software onto your PC. We highly advise against installing any unknown applications found online without first reading about what they do.

Manual removal requires opening each folder where the malicious application resides and deleting everything. This method is time-consuming and risky since there’s no guarantee that you’ll delete every single piece of data associated with the threat. If you’re unsure how to proceed, contact us immediately to help guide you through the steps involved.

Spyhunter will scan your entire hard drive and display a list of items detected during its analysis. Click “Next,” review the results, and “Remove Selected.” The program should automatically reboot when complete. Note: SpyHunter does not provide real-time protection; therefore, please ensure you run scans regularly.

There Are Still Infinite Solutions

Suppose you feel that your cybersecurity is lacking or that your systems may be threatened by the MARS ransomware(or the possibility of getting it). In that case, you’ll want to get ahold of your local service provider and ensure that they have a full-circle IT solution ready for you to stop the attackers at the gates and not let them in. An advanced threat protection solution that offers active anti-ransomware protection is a good start.

You may even have the date on local cloud backups with your MSP provider to help you get your old files back. But suppose you see that you get infected with the MARS ransomware. In that case, you must first disconnect that infected device completely, possibly even disable or shut down your internet, and call your service provider. They can help you with the proper steps from there!

The Pros of the Dropbox Password Manager

The Dropbox password manager has quite a few pros and benefits of interest to your business.

There are many benefits to using password managers for business applications.

1. The Dropbox password manager can protect your employees’ information.
2. It allows you to have particular concrete policies that protect your business.
3. It allows you to have the ability to set and enforce your passwords that may change regularly – but still allow employees to sign in seamlessly as if nothing has changed.
4. It can improve productivity and overall workplace efficiency.
5. They’re often more secure for your business. You’re more likely to have a cyber attacker try to phish the pertinent information from you than they are to get into your password manager.

Is Third-Party the Best Solution?

Not all password managers are created equal; some are downright awful regarding security. The Dropbox password manager is still in Beta, but it’s looking to change the game.

While you need to know that any third party may be liable for the information should you have a data breach, you want to ensure all of your company’s passwords are safe. Therefore, you must do homework before signing up for a service like the Dropbox password manager. These third-party services are always subject to attack. At any given point, they aren’t as good as dedicated services designed to provide ONLY password management to your company.

Software Solutions for Password Management

Partnering with the right MSP can be highly beneficial for password management and all facets of IT.

There are other things that you can have instilled into your business for security. These are often browser-based, but if you talk to your IT team, you may be able to have them find a quality software solution that can protect you more on the local level. These services are just as secure because you have everything stored on a local server, but you still run the risk of attacks if you don’t have one of the best cybersecurity suites to keep hackers out from the base of their attack points.

With the right managed service provider, you can get a locally owned solution rather than trust some third-party corporation that you may even have trouble calling customer support. And they’ll be able to provide cloud backup services and password management software. What’s the downside to this? If you have all your passwords stored on a local device, you are ultimately waiving the right for another company to maintain responsibility.

How to Protect Yourself

Network security is dependent on employee education, first and foremost. But did you know that password security is just as important? The Dropbox password manager will make it easier and safer to store different passwords for every site and program you need.

First, when you sign up for a service that uses a password manager, you will have a master password in place. You may want only to give your IT support team access to this and nobody else. Otherwise, your IT team may be able to have one, and you need it to be completely secure and nearly impossible to thwart and discover. There are all kinds of hacker tools that can try to find string passwords, so you need to have a good mix of capital and lowercase letters, symbols, and numbers to protect yourself.

If you forget the master password, you may have some trouble. And what’s worse? It doesn’t mean you’re safe. Suppose your attacker should find a Windows Office exploit to operate your system remotely or even install a keylogger on your system. In that case, they can end up getting that master password and gaining access to EVERYTHING that you have secured in your company. Not even The Dropbox password manager can protect against something like this.

How Can I Avoid This?

It never hurts to have your passwords stored somewhere, but you want to ensure that you have them in the safest place possible. Talk to your network or secure VoIP provider to see what you can do regarding password maintenance and see if the Dropbox password manager is right for you. While you may want to get with the times and utilize these services, sometimes it’s best to have those million post-it notes or a spreadsheet printed out in a secure place or file cabinet!