SamSam ransomware appears to have had a strong start in 2018, hitting high-profile targets such as hospitals, a city council, and an ICS (Industrial Controls Systems) company.
The reported attacks include those against Hancock Health Hospital in Greenfield, Indiana; Adams Memorial Hospital in Decatur, Indiana; the town of Farmington, New Mexico; a European-based cloud-based electronic medical records provider; and an unnamed ICS (Industrial Control Systems) company in the United States. Hancock Health officials have admitted to paying the ransom demanded by the attackers, despite having backed up their data.
In the three public incidents, “victims” stated that the ransomware locks their files and displays a message with the word “sorry.” According to data provided by the ID-Ransomware service, there have been 17 SamSam-related file submissions since the beginning of the new year.
The SamSam ransomware, also known as Samas, has the ability to adapt to suit its target. The creators behind it typically scan the Internet for computers with open RDP (Remote Desktops Protocol) connections and break into networks using brute-force attacks to spread to even more computers. The Bitcoin wallet address used in the above note received its first funds on December 25. Its transactions, and therefore its attacks, have certainly increased since the account currently holds 26 Bitcoins, worth almost $300,000.
The current story should serve as a warning to companies that use computers open to remote RDP connections. These computers should be secured with a strong and unique password to avoid such situations.
