Tag: RAAS

  • If you’re an Outlook or Gmail user, you’ll want to be aware of this ransomware warning just issued by the FBI

    If you’re an Outlook or Gmail user, you’ll want to be aware of this ransomware warning just issued by the FBI

    A new ransomware targeting Gmail, Outlook and other popular email providers has made enough waves for the FBI to issue a warning about it. In addition to targeting these email providers bad actors have narrowed their search to those in specific fields like medical and tech.

    The ransomware is called “Medusa” and it first came on the scene in 2021, emerging as part of a new group of ransomware found under the “Ransomware-as-a-Service (RaaS) umbrella. This means the hacker are not necessarily the creator of the ransomware but are instead utilizing scripting created by others as a means to profit from ransoms paid in lieu of getting your data back.

    The creators of Medusa have been linked back to a group called Spearwing, which are particularly ruthless in that they try to extort victims twice. First, they steal your data and extort payment to not expose it and they also encrypt it and will not provide victims with a method to decrypt it until they receive a second payment. Spearwings ransom demands have ranged from $100,000 all the way up to $15 million.

    There hasn’t been a definitive answer as to how the latest breaches were conducted, so it’s uncertain at this time whether the attacks were accomplished due to user error or through another method of breach. As such the FBI and CISA have recommendations as to how users can protect themselves from the Medusa ransomware that include:

    1. Mitigate known vulnerabilities by ensuring operating systems, software, and firmware are patched and up to date within a risk-informed span of time.
    2. Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization.
    3. Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems.

    Proactive services (including cyber security) are a keystone offering for Valley Techlogic. With ransomware threats becoming more sophisticated and lucrative year over year, you need a team behind you to protect against outside threats. Below are five ways Valley Techlogic approaches cybersecurity protection for our clients:

    1. 24/7 Threat Monitoring & Incident Response – We provide continuous monitoring of networks, endpoints, and cloud environments to detect and respond to threats in real time.
    2. Advanced Endpoint Protection (EPP) & Endpoint Detection and Response (EDR) – We deploy antivirus, anti-malware, and behavioral analytics tools on all endpoints and use EDR solutions to detect, analyze, and remediate suspicious activities on client devices.
    3. Security Awareness Training & Phishing Simulations – Our security awareness training educates employees on cybersecurity best practices and how to recognize social engineering attacks. We also run weekly phishing simulations to assess and improve employee readiness against cyber threats.
    4. Regular Security Audits & Compliance Management – We can conduct penetration testing, vulnerability assessments, and risk audits to identify security gaps at the client’s request. We also offer specialized support for compliance with industry regulations like GDPR, HIPAA, NIST, or CMMC to avoid penalties and data breaches.
    5. Consistent and Layered Approach to Backups – Our backup program TechVault is our multifaceted approach to backups, which includes separate backups for Microsoft (including Outlook), daily backups for servers, and an immutable copy that is write once read only. This approach gives us a wider array of options should a breach or data loss event occur.

    Interested in learning more? Schedule a consultation with us today.

    Looking for more to read? We suggest these other articles from our site.

    This article was powered by Valley Techlogic, leading provider of trouble free IT services for businesses in California including Merced, Fresno, Stockton & More. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on X at https://x.com/valleytechlogic and LinkedIn at https://www.linkedin.com/company/valley-techlogic-inc/.

  • The Extreme Side of RAAS (Ransomware As A Service)

    The Extreme Side of RAAS (Ransomware As A Service)

    When many people think ransomware they usually think on the small scale, someone’s email or computer being held hostage until a small sum is paid or an IT professional can assist with the problem (for the lucky ones).

    Or perhaps you think of the major breaches where millions of accounts are leaked to the public, usually containing emails, phone numbers and other identifying information. As a whole the public has become desensitized to these sort of breaches (even though they’re still a serious problem).

    What we probably do not immediately jump to is a full-scale terrorist level attack that can cripple large swaths of the country – such is the case with the Colonial Pipeline Hack.

    Tech News #10

     

    While it’s still an ongoing situation, here are the details in summary.

    Systems were shut down Friday at the Colonial Pipeline, a pipeline which supplies 45% of the fuel used on the East Coast. FBI has confirmed the pipeline was shutdown voluntarily to prevent future damage and to assess the situation, however this has left much of the country in limbo as gas prices climb and many states have declared a state of emergency.

    It’s being urged that residents in those states do not stock pile gas as that will only prolong the problem of shortages once operations resume. As of Wednesday, operations are still down but they say they hope to resume operations by the end of the week.

    It’s also been confirmed by the FBI that the RAAS (Ransomware As A Service) group DarkSide is responsible for the attack. They create hacking tools that are then used in attacks on businesses, the group itself usually targets for profit businesses in English speaking countries.

    As a relatively new hacking group, they have since August 2020 conducted attacks on various businesses trying to extort money from them by threatening to release the data they obtain in their hacking efforts. They claim to donate all or part of their ill-gotten gains to charity organizations. Their ransomware demands range from $200,000 to $2 million.

    They claim to operate with a code of ethics and will not attack hospitals, schools etc. However, this pipeline attack will have a trickle-down effect to those services and the public at large.

    Ransomware in any form is disruptive and violating and it’s clear more needs to be done to stamp out these attacks.

    Raising public awareness about cyber security and the efforts required to be safe online will help. In addition to that, requiring businesses to have protective measures in place will cut off these groups before they’re able to acquire the funding they need to become large hacking organizations.

    We need to work together to making hacking less lucrative, because as it’s been shown our way of life and public safety may be at stake.

    If you run a business and need help with your cyber security services, we’re here for you. We have tailored cyber security plans for businesses of all sizes, and we would be happy to guide you through the process of protecting your business. Schedule a free consultation here today.

    Update: As of Thursday, the Colonial Pipeline has resumed operations. It’s unknown how long the gas shortages caused by the outage will last.

    Looking for more to read? We suggest these tech articles from the last week.

    This article was powered by Valley TechLogic, an IT provider in Atwater, CA. You can find more information at https://www.valleytechlogic.com/ or on Facebook at https://www.facebook.com/valleytechlogic/ . Follow us on Twitter at https://x.com/valleytechlogic.