Tag: cyber-attacks

  • If you’re an Outlook or Gmail user, you’ll want to be aware of this ransomware warning just issued by the FBI

    If you’re an Outlook or Gmail user, you’ll want to be aware of this ransomware warning just issued by the FBI

    A new ransomware targeting Gmail, Outlook and other popular email providers has made enough waves for the FBI to issue a warning about it. In addition to targeting these email providers bad actors have narrowed their search to those in specific fields like medical and tech.

    The ransomware is called “Medusa” and it first came on the scene in 2021, emerging as part of a new group of ransomware found under the “Ransomware-as-a-Service (RaaS) umbrella. This means the hacker are not necessarily the creator of the ransomware but are instead utilizing scripting created by others as a means to profit from ransoms paid in lieu of getting your data back.

    The creators of Medusa have been linked back to a group called Spearwing, which are particularly ruthless in that they try to extort victims twice. First, they steal your data and extort payment to not expose it and they also encrypt it and will not provide victims with a method to decrypt it until they receive a second payment. Spearwings ransom demands have ranged from $100,000 all the way up to $15 million.

    There hasn’t been a definitive answer as to how the latest breaches were conducted, so it’s uncertain at this time whether the attacks were accomplished due to user error or through another method of breach. As such the FBI and CISA have recommendations as to how users can protect themselves from the Medusa ransomware that include:

    1. Mitigate known vulnerabilities by ensuring operating systems, software, and firmware are patched and up to date within a risk-informed span of time.
    2. Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization.
    3. Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems.

    Proactive services (including cyber security) are a keystone offering for Valley Techlogic. With ransomware threats becoming more sophisticated and lucrative year over year, you need a team behind you to protect against outside threats. Below are five ways Valley Techlogic approaches cybersecurity protection for our clients:

    1. 24/7 Threat Monitoring & Incident Response – We provide continuous monitoring of networks, endpoints, and cloud environments to detect and respond to threats in real time.
    2. Advanced Endpoint Protection (EPP) & Endpoint Detection and Response (EDR) – We deploy antivirus, anti-malware, and behavioral analytics tools on all endpoints and use EDR solutions to detect, analyze, and remediate suspicious activities on client devices.
    3. Security Awareness Training & Phishing Simulations – Our security awareness training educates employees on cybersecurity best practices and how to recognize social engineering attacks. We also run weekly phishing simulations to assess and improve employee readiness against cyber threats.
    4. Regular Security Audits & Compliance Management – We can conduct penetration testing, vulnerability assessments, and risk audits to identify security gaps at the client’s request. We also offer specialized support for compliance with industry regulations like GDPR, HIPAA, NIST, or CMMC to avoid penalties and data breaches.
    5. Consistent and Layered Approach to Backups – Our backup program TechVault is our multifaceted approach to backups, which includes separate backups for Microsoft (including Outlook), daily backups for servers, and an immutable copy that is write once read only. This approach gives us a wider array of options should a breach or data loss event occur.

    Interested in learning more? Schedule a consultation with us today.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.

  • Are cyber attacks still being conducted the same way in 2025? Top 8 cyber attack methods explained

    Are cyber attacks still being conducted the same way in 2025? Top 8 cyber attack methods explained

    New year, new threats? Hackers have not slowed down their efforts year over year, in 2024 the average cost of a data breach rose to 9.36 million US dollars. Of course this is taking into account the massive breaches that occurred last year with one attack costing the company that was targeted $500 million dollars.

    Still, even for smaller businesses the average cost is usually somewhere between $120,000 to $150,000 – no small sum. Year over year though, the types of attacks haven’t changed even if they’ve become more effective in scale. These top 8 attack methods remain the same (with the first one leading in effectiveness by a landside):

    1. Phishing: Phishing remains the top attack vector in 2024, with 90% of attacks still starting with a phishing email. Our advice on how to spot a phishing email has also stayed the same.
    2. Ransomware comes in second and is preceded by a phishing email 40% of the time. In 2024 the largest single ransomware payment of all time was made to the “Dark Angels” ransomware group to the sum of $75 million.
    3. Denial-of-Service (DoS) attacks are not a new player to the game, but they are part of an overall strategy we’ve seen by attackers to weaponize operational technologies to cripple businesses – either for a payout or just to send a message.
    4. Man-in-the-middle attacks involving intercepting private conversations or data between one or two parties, a good example of this is an attacker setting up a fake Wi-Fi connection or intercepting unencrypted HTTP connections to gain user login information to a website.
    5. SQL Injection attacks are a difficult one for consumers to guard against as they’re conducted on the backend of a businesses website or database and involve “injecting” malicious code. If you’re a business owner, it’s crucial to work with competent developers when creating consumer facing websites (especially if you’re collecting sensitive data through them).
    6. Cross-Site Scripting Attacks are again difficult to guard against, these attacks are also extremely inconspicuous as the attacker in effect sets up a honey pot on the victim’s server or website and waits for it to collect data from the site’s users. Again, it’s crucial to work with a competent developer and IT provider when to protecting your data both internally and from being externally exploited.
    7. DNS Spoofing involves redirecting users from the site they were intending to visit to an unknown site where their data can be collected (usually login information for the site they intended to navigate to). One trick for telling if the page you’re on is secure is to look for the little lock symbol in your navigation bar, this is a sign the page you’re on is using a secure connection.
    8. Zero Day Exploits are the most difficult to protect against as they are attacks that are literally exploited the same day they’re discovered. Hackers are constantly looking for new ways to access your systems, and even if you’re a small business you’re never too small to be of use to them (even if it means leapfrogging past you to exploit your customers).

    There is never a better time than the start of the year to evaluate your technology systems for improvements, at Valley Techlogic we can provide you with a comprehensive report on our recommendations for your business as well as a tailored plan to bring your business up to date in 2025. Schedule a consultation today.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.

  • Western Digital suffers a ransomware attack, with hackers requesting an 8 figure sum and leaking image from internal meeting

    Western Digital suffers a ransomware attack, with hackers requesting an 8 figure sum and leaking image from internal meeting

    Western Digital is a well-known name in the data production and storage industry. Established in 1970, they were one of the original players in the process of making semiconductors and they have a storied history that began with calculator chips, included a bankruptcy as well as being at the forefront of floppy disc creation in the 1980’s to eventually the hard drives they became known for in the 1990’s. Chances are good you have had a Western Digital drive in one of your devices (you may even have one now).

    Despite being leaders in the digital storage industry, they’ve unfortunately proven no one is immune when it comes to ransomware attacks. While this story emerged mid-April (and the attack occurred March 26) we have an update as the hacker group “BlackCat” taunts Western Digital by leaking an internal video conference on the topic just this week. They leaked an image from the meeting on social media coyly dubbing the people included “the finest threat hunters Western Digital has to offer”. A clear mockery of their attempts to remediate the threat thus far.

    The hacker group is clearly trying to up the ante to get the company to fork over the ransom they’ve requested, a sum reportedly coming in at an eye watering 8 figures. For context a typical ransomware payment paid out by a business in Quarter 1 of 2022 was $228, 125. For individuals payouts hover around $6000. In a nutshell, ransomware is a lucrative business for those with unscrupulous motives.

    To make matters worse, it’s been reported that the group BlackCat has access to multiple Western Digital systems. Meaning this attack was well orchestrated and highly effective at not only making their data vulnerable but creating a disruption to all parts of their business. Western Digital has reported requested the services of outside security and forensic experts to try and recover what they can but needless to say this is an expensive lesson for their business both in money and time lost as well as their reputation in the technical industry.

    You would think being a leader in data storage that their backup recovery process would be flawless, unfortunately when hackers gain domain level access even the best laid plans for your data can go out the window. That’s why Valley Techlogic offers a multi-pronged approach to backups.

    Many clients like the idea that all their data is at their fingertips within their on-premises server. The server itself serves as a physical reminder that their data is ready and available when they need it.

    Unfortunately, having your data all in one place is not a good idea. Other than ransomware attacks such as this, it also leaves your business vulnerable if your server fails for whatever reason. We’ve seen it before; many clients aren’t expecting their servers to just give out or for something like a fire or other disaster to affect them and when it happens, they’re left scrambling. The process to recover from scratch is not always guaranteed and even if a recovery is possible, it can take as long as 3 months to get back mostly to where you were. Generally, a 100% recovery is not possible in these instances.

    That’s why at Valley Techlogic our backup solution TechVault is available and used by each of our clients. We have this chart on the benefits of our TechVault solution.

    You can also learn more about it by visiting here. If the Western Digital breach has left you concerned for the safety of your data, or you would just like more information on our backup solution you can request a consultation with our expert sales staff here.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, an IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.

  • College shuttered after 157 years due to ransomware attack

    College shuttered after 157 years due to ransomware attack

    While ransomware wasn’t the only thing behind the decision to close Lincoln College, located in rural Illinois and established in 1865, it was the final blow after taking substantial financial losses due to the COVID-19 pandemic.

    The school, which had survived through the Spanish Flu, the Great Depression, two world wars and even a fire in 1912 will close its doors for good on May 13th, 2022.

    The ransomware attack which occurred in December 2021 crippled their recruiting and fundraising efforts for two months, not being resolved until March 2022 as a statement on the school’s website reads.

    “Furthermore, Lincoln College was a victim of a cyberattack in December 2021 that thwarted admissions activities and hindered access to all institutional data, creating an unclear picture of Fall 2022 enrollment projections. All systems required for recruitment, retention, and fundraising efforts were inoperable.

    Fortunately, no personal identifying information was exposed. Once fully restored in March 2022, the projections displayed significant enrollment shortfalls, requiring a transformational donation or partnership to sustain Lincoln College beyond the current semester.”

    The school made attempts to avoid the closure, but the efforts came too late, and we’re sorry to say they’re far from unique in being a school that was targeted by a cyberattack. According to this report over 1043 schools suffered ransomware attacks in 2021.

    Cyber criminals don’t think twice when targeting schools, hospitals, and infrastructure that’s needed by the community. We reported on the on Colonial Pipeline hack that created a major disruption at gas stations across eastern US last May.

    Schools and hospitals are appealing targets because investing in cyber security measures is not generally a priority and they often store large amounts of PII (Personal Identifying Information) in their systems.

    Many senators have taken note of this and have called on the Department of Homeland Security to instate measures that would bolster the security of our schools, especially K-12.

    A ransomware payment isn’t the only thing attackers stand to gain when they successfully infiltrate a network, here’s a chart with the way hackers “double dip” from during their attacks:

    Hacker Motivations Infographic

    In the end Lincoln College did choose to pay the ransom to gain control of their systems again, but it sadly made no difference in saving the college.

    60% of businesses close within 6 months following a ransomware attack, and only half businesses have a cyber response plan available to quickly respond to an attack. The slow response time will only add insult to injury as you try to get back on your feet and as we’ve seen in this case, it can be fatal to your business.

    Valley Techlogic can help you not only have a contingency plan in place, but also help you enact cyber security measures in your business that will prevent an attack from occurring in the first place. Learn more today through a quick consultation.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley TechLogic, an IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.

  • As we feared, Ukraine-Russia crisis leads to a surge in cyber attacks

    As we feared, Ukraine-Russia crisis leads to a surge in cyber attacks

    As we’re nearing a month into the conflict between Russia and the Ukraine, cyber warfare between the two countries is reaching an all time peak. We covered the topic of Ukraine’s “IT Army” recently in this blog, and we mentioned growing concerns we’ve seen from users that there may be a spill over effect when it comes to cyber threats.

    Cyberwarfare was inevitable as conflicts on the ground continue on, and as Russian hackers feel the “pinch” of the effects of sanctions imposed against Russia, we may see an uptick in financial scams. Especially as both countries have turned to cryptocurrency which can often be used as a safe haven for financial transactions taking place outside the public eye. In the case of Russia it’s being used to try and liquidate funds out of the country and in the case of the Ukraine they’re using crypto to bolster support for their economy.

    We have created this chart for the types of financial scams we think may increase in the coming days (though it should be noted, financial scams were already up 70% in 2021).

    Cyber Financial Scams Chart
    Click to download the full size version.

    However, hackers have also represented a beacon in the war of information currently happening between Russia and the Ukraine. Ukraine’s “IT Army” is now over 400,000 people strong, with hackers from all over the world lending their support digitally in Ukraine’s effort to protect their democracy.

    DDoS attacks on government sites with Russian origins as well as document leaks – which includes a 360k file data dump from a Russian federal agency – are continuing to happen regularly. It’s estimate that over 90% of exposed Russian cloud databases have been compromised at this point.

    Also, with access being restricted to sites like Twitter and other social media platforms being restricted in Russia, Squad303 is a website that was created by a group of Polish programmers that can help foreigners relay information to Russian citizens. The website founders say that over 7 million text messages and 2 million emails have been sent through the site so far.

    We again want to say we don’t know what the outcome of this conflict will be, but it seems clear that consumers and businesses should be wary of the ripple effects that will occur throughout the cyber sector, possibly for years to come.

    Business owners who still believe they’re “too small” to be a target should be wary that proceeding with out cybersecurity protections may make them the low hanging fruit for hackers reacting to a state of desperation. Cybersecurity protections are a worthwhile investment in your future and the peace of mind in questionable times is priceless.

    At Valley Techlogic, we’re experts in the field of cybersecurity. We can perform an evaluation of your business and tell you where you are now and where you need to be to not worry that your business is “ripe for picking”. Schedule a consultation today to learn more.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley TechLogic, IT service provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.