According to the latest research data from Coveware, there is a large increase in ransoms and downtime due to the increased use of a variant of Ryuk ransomware.
Ransomware attacks are particularly disruptive as they impact an organization’s productivity and wallet. According to Coveware’s Q1 Ransomware Marketplace report in just three months, ransomware is evolving in every aspect of an attack.
According to the report, three actors (Ryuk, Bitpaymer, and Iencrypt) caused the cost of dealing with a ransomware attack to increase. In terms of Q1 2019 compared to Q4 2018, the following trends emerged:
- Ransoms increased by 89% from $6,733 to $12,762
- The average number of days to respond to an attack increased from 6.2 to 7.3 days
- Downtime increased by 47%, resulting in an average outage cost of $64,645
The good news is that 96% of organizations paying ransoms received a decryption tool.
Most ransomware attacks are the result of social engineering and/or phishing attacks. Educating users to detect these types of security attacks will help significantly reduce the likelihood of a successful attack.
5 things to watch out for:
- Don't forget to back up your files.
- Scan your network for any open RDP ports and ideally disable RDP completely on all Windows machines if possible. By default, the server listens on TCP 3389 and UDP 3389 port.
- The best practice for protecting a network from brute force RDP attacks is to implement strong RDP security settings, including restricting or disabling access to shared folders and clipboards from remote locations.
- An RDP brute force approach exposes the attacker's information on the targeted network. Therefore, automate the process of analyzing Windows Event Viewer logs, identify any compromised user accounts, identify the IP address , and block them.
- Run a Phishing Security Test and find out what percentage of your users are susceptible to Phishing. Use this percentage as a catalyst to launch a training program to raise awareness among your users.
