The FBI is asking businesses and software security experts for immediate help in its investigation into a devastating new type of ransomware virus being used by hackers to extort money.
“We need your help!” the Federal Bureau of Investigation said in a confidential “Flash” tip, dated March 25 and obtained by Reuters over the weekend.
Ransomware software that encrypts a victim's data so they can't access their computer, then offers to unlock the system in exchange for a payment.
Friday's FBI warning focused on ransomware, also known as MSIL/Samas.A, which the agency said seeks to encrypt data across an entire network, a worrying change because typically, ransomware has sought to encrypt data on one computer at a time.
The appeal asked recipients to immediately contact the FBI's CYWATCH cyber center if they have evidence that they have been attacked or have other information that could help their investigation.
It is the latest in a series of FBI advisories and warnings from security researchers about new ransomware tools and techniques.
“This is basically becoming a national cyber emergency,” said Ben Johnson, co-founder of Carbon Black, a cybersecurity firm that on Friday uncovered another type of ransomware that seeks to attack computers through infected Microsoft Word.
The FBI first mentioned MSIL/Samas.A in a Feb. 18 alert, which lacked the urgency of Friday's alert. The February message contained some technical details but did not ask for help. It said MSIL/Samas.A targets servers running older versions of a type of enterprise software known as JBoss.
In its latest report, the FBI said researchers have discovered that hackers have been using a software tool, called JexBoss, to automate the discovery of vulnerable JBoss systems and launch attacks, allowing them to remotely install ransomware on computers across the network.
The FBI also provided a list of technical indicators to help companies determine if they were victims of such an attack.
"The FBI distributes these indicators to trigger activities to defend the network and reduce the risk of similar attacks in the future," the advisory said.
FBI representatives did not respond to requests for comment about the confidential warning.
The sectors most affected by ransomware include industries that rely on computer access to perform critical functions, such as healthcare and law enforcement. Publicly reported attacks in which hospitals and police have paid ransoms and then recovered data have encouraged attackers to further target these groups, cybersecurity experts said.
