How Are the Hackers Connecting?

One of the most common methods is accessing RDP ports and points on computers and devices that share the SMB protocols in Windows 10. The hackers are acting as brokers to help other scammers and cyber attackers alike. They aren’t just ethical hackers or cyber attackers these days – now people are giving the job a title: initial access broker. This is because they get the data and sell it to bidders on the dark web and other areas, government offices, countries, and even your competitors (yes, this happens).

RDP Endpoint Sales

RDP connections are a hacker’s dream come true when spreading computer viruses.

This is when cyber criminals succeed with brute force cyberattacks on your servers or workstations configured to use the Remote Desktop Protocol. They then sell these remote desktop connections.

Hacked Network Equipment

Believe it or not, there are more and more vulnerabilities becoming persistent with this. As major ISPs worldwide are getting slammed with lawsuits regarding the issue, it still happens. Hackers exploit vulnerabilities of your network routers and modems, or even VPNs, and get access into the network and to the central data unit.

BOTNet Sifters

The malware and ransomware botnets go through the computers they infect and encrypt all their data. This allows them to be sold to other ransomware teams.

Fortunately, there are some defenses regarding these computer viruses. Still, the biggest problem is that many of these emerging viruses have never been seen before – let alone in the volume in which they are modified these days. Here are some of the most common computer viruses cyber attackers use nowadays.

MARS Virus

The MARS ransomware computer virus digs its heels into your data and encrypts more files than you think.

The MARS virus is extremely new – only being discovered in November 2020. What’s interesting about this is that the primary attacks seem to be coming from Russia and the surrounding areas. This ransomware acts like many others, but there is no fix for it yet (many others have decryptors for files already, but not this one).

Emotet

The Emotet malware strikes when you click the “Enable Editing” button and is one of the more complex computer viruses to remove.

This is one of the most popular and largest malware botnets out there. While most of these attacks are with ransomware teams directly, this attack is a chain of other ransomware infections. The compromised system’s data is then sold.

Trickbot

Trickbot has been making a comeback during the pandemic and is one of many computer viruses reaping havoc on RDP accounts.

Trickbot is a pretty similar botnet. Like Emotet, it is malware that allows cybercrime to take place. However, this one infects the victims but gets access to Emotet-infected systems.

BazarLoader

This one’s a doozy but acts like the backdoor trojans of yesteryears. However, it linked to the original Trickbot hacking group and became a spinoff of that project. What’s the most important problem is that they install the Ryuk ransomware.

Qakbot/Qbot

QakBot/Qbot is one of the most devastating computer viruses you can get infected with.

This one goes by multiple names. Infosec has deemed this one a slower infection than older systems. At the same time, the QakBot groups end up taking their time with their infections. However, they collaborate with other botnet networks to make them even more lethal.

SDBBot

You need to audit your network immediately if you see any computer viruses.

This one’s a more recent malware infection. It’s tied to a cybercrime group that has been seen where Clop and other ransomware computer viruses were inserted.

Dridex

Dridex helps distribute computer viruses to unsuspecting individuals.

This backdoor trojan is more of a malware downloader program. It is one of the most used spam email campaigns today and distributes the ransomware called Locky. However, they are using other newer ransomware strains to hit larger companies.

So How Do I Stay Protected?

First, you need a network solution to protect your business’s data and preserve its security. Finding the right IT support team is one of the most important things you can do. Ransomware hackers aren’t just sticking to computers and emails anymore. These days, exploits in various items around your offices can quickly become a target. And if they get access to your router, you’re in for a world of hurt. The most important thing you can do is contact your team to install some very secure firewalls, then increase your device security with a high-powered sentinel to protect your computer.

Important January 2021 Update

How One Malware Chain Became the Most Costly & How to Defend Against It

Emotet is one of the most dangerous computer viruses we have seen in a long time.

We’ve mentioned it, and you’ve probably heard about it elsewhere. Still, Emotet – the super virus of 2020 – has become the most impactful and destructive threat to small and medium businesses, government organizations, and larger corporations. While it’s not a new virus, it’s more heavily modified. It is evolving beyond a banking trojan – including selling information to other cyber attackers and infecting users with ransomware. But what is it? And how could one initially just an email phishing virus become this big?

Much Like a Worm

The super virus known as Emotet is similar to past computer viruses called worms.

Like the old viruses called “worms,” Emotet often uses phishing emails to infect other systems on a network, other people’s contacts, and much more. And just like computer viruses of the past, users don’t know that they’ve been attacked until after.

However, Emotet is not a worm, even though it acts like one. And it can be spread in similar fashions, and other attackers have been delivering it with other methods. It was initially made as banking malware but has made its way to personal and small business computers, making it one of the most widely used and dangerous computer viruses.

Trickbot is the Second Most Dangerous

Out of all the current computer viruses, the Trickbot banking trojan ranks second regarding how much damage it produces.

Also, banking trojans are constantly being manipulated, and “improved” (more like tailored to do more damage) to the point that it’s become one of the other leading ways that cyber attackers can install ransomware on individual computers. Many of these trojans are being used to take advantage of exploits in network routers, home and business network computers, and even Microsoft products. This allows users to access any educated exploit they can use against the system to damage it.

Can an Antivirus Stop the Attack?

Installing an antivirus like SentinelOne can assist in keeping computer viruses at bay.

Although it’s highly reported that most attacks can be stopped with Windows Defender and other antivirus programs, many of these trojan viruses have protection to keep the user unaware that the virus is being installed. Even many advanced firewalls are not detecting the attacks. That’s where full-service solutions like SentinelOne come into play.

SentinelOne can offer a large defense against these attacks and even prevent them. At the same time, it can also aid in recovering data that may have been breached – and many ransomware attackers know it. Numerous companies are threatened when the attacker realizes they’re ignoring their ransomware attacks. We’ve even mentioned in a previous post that some hackers are cold-calling their victims when they know that their demands are being ignored.

So How Can You Protect Yourself?

Aside from using a full-service solution, it would help if you instilled maximum security. This is sometimes hard to do when you’re busy working. Therefore, you must have IT specialists that provide multiple services to implement these different security solutions. This could include, but not be limited to:

• Local cloud backups of your company’s financial and critical data
• Increased email security
• Advanced knowledge of cybersecurity that they’ll happily share so you can teach your employees
• A defense and helpdesk solution lets you keep busy doing what’s important – running your business.
• Voice over Internet Protocol (VoIP) systems and phone services that extend outside of your office to local home offices
• Dedicated local web hosting solutions
• And much more
• Whatever you decide to do, it’s crucial that you avoid getting these “deadly for business” computer viruses, and give us a call at Infinity DataTel today!

Why is it so bad? First, this is one of the rare advanced ransomware infections that you can find very little (but often duplicated content) about this nasty ransomware installed on your computer. According to the information that you get with the virus in the infamous !!! MARS_DECRYPT.TXT file that goes into every folder and attacks your Microsoft Office files. But wait, there’s more.

What is this MARS Ransomware Virus?

The MARS ransomware acts similarly to other ransomware viruses out there. You can get it in numerous ways, but the most common practice these days is thanks to the SMB: CVE-2020-0796 exploit in Windows 10. Fortunately, Windows versions 1903 and 1909 have these patches available in the Windows Update store. Still, there is only a workaround (which isn’t even guaranteed to work) using a PowerShell command that ends up blocking SMB protocols.

The easiest way to deter the MARS ransomware is to turn off your computer’s SMB.

Want another workaround? Turn off SMB in your Microsoft Windows system. No. Really. All of it. Unfortunately for businesses and even home office networks, this makes file sharing between computers a pain in the butt. You can also disable Windows Services (or port 445) on your router network – but then this also can break the ability for Windows to download data from Windows services.

The virus is installed, and apparently, it seems that it is a Russian hacker with complete access. It tells you that you have so many of your office files and infects different file types. They list all that the virus is supposedly encrypting – but this isn’t all the files that get encrypted on your device. The virus then installs other malware into browsers and causes chrome to go haywire in the background, loading extremely malicious websites and installing other viruses.

However, the tricky thing is that you don’t even see what websites open because the windows are invisible (Malwarebytes can catch this happening if you’re infected in real-time).

What’s MARS Ransomware’s Goal?

Like most ransomware, the MARS ransomware is after Bitcoin. Image by Aaron Olson from Pixabay

The goal of these types of ransomware is to steal bitcoin. These days, small businesses have been getting hit harder and more often regarding ransomware. The reason? It’s much easier to charge many small companies, LLCs, and freelancers these days a small amount than to go after a big company with more robust security. More people get infected for no reason – more people pay smaller amounts. This is a business tactic on its own (think about customer service. Charge less, get more customers).

The MARS ransomware infection attacks your system when malicious attachments containing malicious files are downloaded, demanding bitcoin (usually anywhere from $500-800. The encryption process happens swiftly, and you are in big trouble if you don’t have a cloud backup. They tell you to send the unique id and three files for test decryption to an outlook or Russian email address. After decryption, they send you the decrypted files and give you a bitcoin wallet to send the money to.

What Files Are Affected?

“All your important files are encrypted.
To recover encrypted files, you need:1. Buy bitcoins. The easiest way to buy bitcoins is the LocalBitcoins site. You must register, click “Buy Bitcoins,” and select a seller by payment method and price. https://localbitcoins.com/buy_bitcoins

You can also find other places to buy bitcoins and a beginner’s guide here:

“They claim that they’re only infecting office documents, but it gets much worse than that. According to their “ransom note,” they encrypt the following filetypes:

The MARS ransomware digs its heels into your data and encrypts more files than you think.

XLS, XLSX, DOC, DOCX, PPT, PPTX, ODT, ODS, PDF, PSD, FPT, PHP, and MDB files. However, it gets much deeper than that. If the virus runs for a while, then you may notice that even these files get encrypted: .bmp, .jpg, .mp4, .sav (emulator saved games), .dat, .ini, .txt, .rtf, .dotm, .cs (C#), visual studio files, .wav, .mp3, .wma, and many others.

So What Am I Supposed to Do to Be Safe?

Want to keep the MARS ransomware away? Make sure your password-protected sharing is turned on.

If you think you may be at risk, we already gave you a basic idea. Ensure that you don’t have password-protected sharing turned off, but most importantly, disable the SMB protocol on your computer. You can do this currently (until the future Windows Update) in Control Panel > Programs and Features > Windows Features and uncheck both boxes showing SMB in the title. Restart your computer after this and apply the changes. But this doesn’t necessarily mean that you’re safe.

Can I Restore the Encrypted Files?

There are numerous types of file decryption programs released by multiple companies. This ranges from Kaspersky Labs to even Trend Micro and more – but they haven’t created a decryption key for this virus, and we don’t recommend one decryption program over another. It was just discovered this month, and while some say you can use things like Stellar Data Recovery, many users complain that it doesn’t work to recover their files after decryption.

If you have a Shadow Copy from the Windows Shadow Volume Copy service, you may be lucky enough to get some of these files back if you restore them to a specific date. However, you may end up losing some files in the process still.

While a restore point may restore your programs before the attack, this may leave you vulnerable. This is why we urge all of our users to perform a cloud backup daily and, at worst, a weekly backup because it makes the recovery process much more straightforward. In many cases, the only way to fix the solution is to reset your computer using the Windows 10 Recovery Tool.

Mars Ransomware Removal

There are two ways to remove Mars Ransomware from your system. One method involves removing the malware manually with Malwarebytes Anti-Malware Premium or a similar program. Another option is to purchase an anti-malware tool such as SpyHunter, which has been proven effective against similar threats. Both methods require downloading software onto your PC. We highly advise against installing any unknown applications found online without first reading about what they do.

Manual removal requires opening each folder where the malicious application resides and deleting everything. This method is time-consuming and risky since there’s no guarantee that you’ll delete every single piece of data associated with the threat. If you’re unsure how to proceed, contact us immediately to help guide you through the steps involved.

Spyhunter will scan your entire hard drive and display a list of items detected during its analysis. Click “Next,” review the results, and “Remove Selected.” The program should automatically reboot when complete. Note: SpyHunter does not provide real-time protection; therefore, please ensure you run scans regularly.

There Are Still Infinite Solutions

Suppose you feel that your cybersecurity is lacking or that your systems may be threatened by the MARS ransomware(or the possibility of getting it). In that case, you’ll want to get ahold of your local service provider and ensure that they have a full-circle IT solution ready for you to stop the attackers at the gates and not let them in. An advanced threat protection solution that offers active anti-ransomware protection is a good start.

You may even have the date on local cloud backups with your MSP provider to help you get your old files back. But suppose you see that you get infected with the MARS ransomware. In that case, you must first disconnect that infected device completely, possibly even disable or shut down your internet, and call your service provider. They can help you with the proper steps from there!

However, in the past month, there has been a new phishing attempt, a worm phishing campaign that went out of the way tenfold compared to regular attempts. It ended up being flagged by a frequent writer and exploit finding specialist for the site Medium.com.

What Was the Attack?

The worm phishing campaign started innocently enough but soon spiraled out of control affecting every account and mass emailing every contact in their database.

The attack was initially considered to be another regular attack, so the IT team ended up locking things down as usual to investigate. However, within just a matter of minutes, numerous other alerts were reaching their email inbox. The emails managed to sneak their way through all of the filtering rules, and countless people were attacked and infected quickly. The next thing they know, they realized that while they worked on a couple of the compromised accounts and recovered them, a whole slew of accounts had indeed been taken over.

All of the accounts were accessed throughout the world and sending out mass emails. Therefore, the phishing attack happened faster than usual. The company realized that either someone had been working on their accounts for a long time, or the phishing attack was instrumental. However, nobody ended up receiving an email from any new contacts on that day that seemed suspicious.

However, the emails that ended up being the worm phishing emails ended up being legitimate emails that were exchanged within the network as regular emails. How could this happen? Well, it’s a bit tricky, but it had a rapid worm-like method of operation. When an email account for the company was compromised, the account information ended up being sent to a bot remotely that would sign in and take a good look at the emails sent in the most recent days.

Every time it found a particular email chain, it would reply to the most recent one with a link to a phishing page to steal the person’s information. Compared to most phishing campaigns, the words fit just about any scenario, so the link to a document didn’t seem too strange. It would then use a reply-all method using a real email account. People had trouble figuring out which emails were different from the employees’ actual emails.

The Worm Phishing Campaign is Caught

Luckily, the bot grew so large that it expanded out of the original organization and

Over time, bots retain memory, and they end up having bugs in them that most attackers don’t think about – when they increase in size and memory after taking over so many accounts, they begin to slip. Rather than just sending the emails internally in a network, other people outside of the network will get the emails, which is how the red flags and alarms are sounded.

What Can I Do to Protect Myself?

Something as simple as using 2FA can help keep you safe from a worm phishing attack.

One thing you can do is to put 2FA, two-factor authentication, on all of your local email accounts in your company’s network. If you need help doing this, you can get ahold of your local IT managed solutions office so that they can incorporate the smart tech solutions you’ll need to have the best protection possible.

Along with the ability to protect your accounts and your local business’s technology, you’ll be able also to have ways that you can combat cyberattacks before they ever happen using the right tools – and using a managed service provider can help you save more money on costs than other corporations and regular professional IT services.

Backup Strategies You Can Count On

Creating and sticking to a backup strategy can save your business if and when things go awry.

First, let’s discuss your backup strategy. We will jump into this topic because you can’t have a crash plan without a proper backup strategy. Creating a backup scheme is fundamental to recovering from any significant incident. Your business could be hit by ransomware or an act of God like a hurricane. Either way, with a bit of preparation and testing, these things become less threatening.

There’s a tried and true rule for creating backups. That is called the 3-2-1 rule. It’s simple. Make three backups of everything. Two of those backups need to be on different media, like a tape backup and a cloud backup. One of those backups needs to be kept off-site, preferably in a different city or region.

Following this rule used to be a lot more complicated. With the availability of cloud services today, there is no reason not to follow this rule. Even better, all your backups can be completely automated and still follow this rule.

What Software Should We Use?

Office 365 and Google’s G Suite are both viable options when it comes to backups.

Let’s start with user PCs. These are the computers that each business assigns to employees to get work done. Today, most companies subscribe to Office 365 or Google’s G Suite. Both subscriptions include a cloud syncing service with an important feature.

Office 365 has a syncing feature called OneDrive. G Suite has its Backup and Sync service, also called Drive. Both applications will sync data stored within a designated folder on a user’s PC to the cloud. Once in the cloud, employees can access their data on the go. They can also easily send and share files stored in the cloud with customers and co-workers.

Syncing Data

Syncing your data daily or even weekly will keep your files and backups updated if an emergency occurs.

Both cloud syncing services offer two powerful features. First, if a user’s PC needs to be re-imaged or replaced, restoring those synced files is easy. The applications must be configured and given a little time to restore these files.

It’s important to note that both services will only sync data stored in those configured folders for each app. Make sure that employees are saving their data to these folders. It might be wise to set this specific sync folder as the standard Documents library in Windows. That way, files are saved to this location automatically.

The second important feature that both apps have is a file versioning feature. This is especially important for ransomware. If files are encrypted and synced, or if a user accidentally saves a file after making an unwanted change, data can be rolled back from the cloud to previous working versions.

Server Talk

Some businesses choose to back up their files on a dedicated server. Others like to use both local storage and cloud services.

Now, let us discuss servers. Servers can take a bit more work to back up, but they are not challenging. Applications like Veam can make images of current servers and backup specific folders. These features can also be used for essential computers that employees regularly use.

You will want to spend a little time deciding which computers and servers need to be backed up, and you need to determine how regularly they need to be backed up. There are many strategies to discover the answers to these questions, but the easiest way to decide is to figure out how much data you could lose before your business is impacted. Is it one day, three days, or a week?

After backups are made, they need to be stored somewhere. Thankfully, data storage has become very cheap today. There are various solutions, whether you are a small, medium, or large business. For small businesses, a simple NAS might work best. They can be purchased or built for about the price of a laptop. They can also hold a lot of data!

Once that data is saved somewhere locally, you need to think about getting it off-site. Your IT staff can help you decide on the best solution for that. There are a lot of useful applications that will save backups to online storage facilities. With services like AWS S3, Azure, and Wasabi, plenty of reasonable solutions would work for your business.

Have You Prepared for a Crash?

Restoring your information from your backup only works if you know how to do it and have a plan ahead of time.

Now, let’s talk about your crash plan. Backing up data doesn’t mean much unless you know how to restore it. So, it would help if you created a plan to restore your data.

Unfortunately, giving everyone a concrete recovery plan is beyond the scope of this article. Creating a crash plan depends on the methods you use to back up your data. Create a program built around how you would retrieve that data from wherever you are storing it. Keep in mind that you may also need to get your off-site copies.

After you have made that plan, break things down. It’s not suggested to break computers that are in active operation, so use a spare computer. Better yet, try your crash plan on different hardware as well. Let’s say a server has a hardware problem and goes down. That hardware can no longer be replaced, and you are forced to buy new computers. Can you restore your data and configure that new machine?

This is the point of testing your crash plan. Make sure it works. Chances are, your crash plan will never work on the first attempt. You need to find the holes in that plan and fill them. If you are having difficulty and can’t find the holes to fix, you can contact us, and we’ll find them for you.

‘Being Hacked’ comes in many forms. The term hacked is a catch-all statement that encompasses many attack vectors. These can include:

• Having data stolen
• Having your website taken over
• Being infected by a cryptovirus
• Having an intruder snooping around your network
• Etc.

While it’s impossible to answer every single response a business should take after being hacked within this article, we can discuss some basic strategies to consider.

Identify How You Have Been Hacked

The first thing to do after you’ve been hacked is to get ahold of your Managed Service Provider or IT security team. The second thing you should do is figure out how it happened.

This may seem like such a ‘duh’ statement, but sometimes the answer isn’t always obvious. Do you have a cryptovirus spreading through your network? Was your website taken over? If you had data stolen, what was taken?

Accurately identifying the issue will help develop the solution. Each of these hacks listed can have very different diagnostics and remediation methods. Fully understanding what is happening within your IT infrastructure will help develop those solutions.

Create and Implement a Mitigation Plan

After you’ve been hacked, you’ll need to make a plan on how not to get hacked again.

Here’s where the process starts to get tricky. After a business identifies precisely what happened, they need to develop a plan to mitigate any further damage. That mitigation plan then needs to be implemented quickly to prevent any further damage from occurring. Aside from preventing further damage, the business also needs to ensure any evidence isn’t destroyed. That evidence will be required for both filing police reports, if required, and analysis to create future mitigation steps.

Many hacks could be considered what’s known as an advanced persistent threat. This is what happened to Sony in their hack years ago. Sony had intruders walking through their network for four years before they realized they had an issue. Sony had everything from trade secrets, to employee information, to games and movies stolen from them.

Crypto viruses, also known as ransomware, are now a popular attack method. They are designed to extort businesses. One of the reasons crypto viruses are such potent attacks is that they hop from PC to PC and server to server by themselves. Crypto viruses then attempt to encrypt important files on each of these systems. The more data a cryptovirus can encrypt throughout the network, the more devastating the attack becomes.

Identify How the Hack Occurred

Now comes the arduous work. After the threat has been neutralized, the business must identify how the attack occurred. How did an intruder break into the network? How did a cryptovirus sneak its way in?

Unfortunately, answering this question can sometimes be impossible. Though it’s always best to know exactly what happened, sometimes businesses must rely on theories. Trained professionals and cybersecurity experts can develop very accurate ideas on how an attack occurred and what the most likely attack vectors were. Businesses will need to know this to create a strategy to prevent another attack from happening.

Implement a Solution

After you’ve identified how you were hacked and made a plan not to get hacked again, you’ll need to execute said plan.

The hack has been mitigated, and the businesses now have a pretty good idea of how it happened. So, what’s next? Now the company needs to start fixing things, so this doesn’t happen again.

Solutions can come in all shapes and sizes. This is why all of those previous steps are so important. It helps to understand the entire situation, identify the stakeholders, and create an effective solution.

For instance, if a cryptovirus hit your business, that virus most likely entered the network through social engineering. Someone probably tricked an employee into downloading a file. That file launched the cryptovirus on their computer.

Once on the computer, that virus started encrypting all the essential files on that employee’s drive. While it started this process, the virus found other vulnerable PCs and storage drives on the network and spread.

The solution for a cryptovirus is complex and will require multiple steps. Here’s a broad overview of some of them:

1. Wipe and restore any affected machines. It’s better to wipe a device altogether and start from scratch. Some viruses will go dormant and emerge again later.
2. Perform social engineering audits on employees. This will identify which employees may need extra training. On-going training for all employees will also need to be provided.
3. Ensure backups are working and are not affected. At the same time, many businesses don’t invest in backup solutions. This is a mistake. Backup solutions don’t have to be pricey. On the other hand, by not having a backup solution when one is needed, it could be a costly mistake.
4. Test backups. Just because a business has a backup doesn’t mean it will work properly. They need to be tested regularly.
5. A security audit of all PC configurations must be performed. The original crypto viruses depended on SMB 1.0 to spread. Making sure these types of protocols are turned off and aren’t needed, plus making sure user account permissions are correctly set, will go a long way towards preventing a cryptovirus from striking. Ensuring PCs are correctly configured, and proper permissions are set for user accounts can prevent viruses than most anti-virus software can.

This plan will change drastically, depending on the type of hack that occurred. Creating mitigation and remediation plans is a complex subject. It’s best to seek outside help to analyze the hack and figure out how to resolve it when one occurs. Better yet, start planning for that eventual hack now. Planning for it before that hack happens can help mitigating it from it ever occurring in the first place.

For more information about what you can do before/after you are hacked, please send us a message or call 480-493-5999 today!