{"id":35299,"date":"2019-07-18T18:29:35","date_gmt":"2019-07-19T01:29:35","guid":{"rendered":"https:\/\/www.enxmag.com\/twii\/?p=35299"},"modified":"2019-07-18T18:29:38","modified_gmt":"2019-07-19T01:29:38","slug":"effects-of-ransomware-dont-end-with-the-ransom","status":"publish","type":"post","link":"https:\/\/www.enxmag.com\/twii\/feature-articles\/2019\/07\/effects-of-ransomware-dont-end-with-the-ransom\/","title":{"rendered":"Effects of Ransomware Don\u2019t End With the Ransom"},"content":{"rendered":"\n
\"\"<\/figure><\/div>\n\n\n\n

A Florida city is still struggling to recover from a ransomware attack two weeks after the city paid the ransom, according to the New York Times<\/em>. The attack began after a city employee downloaded a malicious document that arrived in an email.<\/p>\n\n\n\n

This document downloaded the Emotet Trojan, which in turn downloaded the Trickbot Trojan. These Trojans were then used to plant the RYUK ransomware within the city\u2019s systems. On June 10th, the ransomware encrypted 16 terabytes (more than 16,000 gigabytes) of information, including more than a century\u2019s worth of digitized municipal records.<\/p>\n\n\n\n

A city clerk who has spent years manually scanning these documents for preservation, told the Times<\/em> that it\u2019s still not clear if everything will be recovered. \u201cIt puts us years and years and years behind,\u201d Sikes said.<\/p>\n\n\n\n

The victim decided to pay the $460,000 ransom on June 25 after failing to find a workaround. Most of the cost was covered by the city\u2019s insurance provider, with the city paying a $10,000 deductible. Even though the attackers provided the decryption key, the recovery process is taking a very long time.<\/p>\n\n\n\n

Mark A. Orlando, the chief technology officer for Raytheon Intelligence Information and Services, told the Times<\/em> that attackers are improving their targeting to increase the chances that a victim will pay ransom.<\/p>\n\n\n\n

\u201cThese groups are always trying to find that sweet spot: What is enough someone will consider paying but not so much that they\u2019ll say, \u2018Forget that. It\u2019s easier to rebuild,\u2019\u201d Orlando said. \u201cThis is a situation where that amount is going up, and we have reached a new high-water mark as to what is getting paid out.\u201d<\/p>\n\n\n\n

Organizations need to maintain secure backups, but restoring from backups can be a lengthy and expensive process. Make sure you frequently test your restore procedure!<\/p>\n\n\n\n

Ideally, the attackers won\u2019t be able to gain a foothold in the first place. New-school security awareness training can teach your employees how to avoid falling for these attacks.<\/p>\n\n\n\n

Brand-New Ransomware Simulator Tool Now with Two New Ransomware Scenarios<\/strong><\/p>\n\n\n\n

The bad guys are continuing to evolve their approach to evading detection. That\u2019s why we\u2019ve updated our Ransomware Simulation tool \u201cRanSim\u201d to include two new ransomware scenarios! <\/p>\n\n\n\n

These new scenarios simulate ransomware strains like GandCrab and Rokku that encrypt users\u2019 files and demands a crypto-ransom in exchange for the keys. <\/p>\n\n\n\n

GandCrab was a very active ransomware strain all throughout 2018 as well as since the start of 2019, and it is known for requesting up to $3,000 from its victims to decode encrypted files. While the creators of GandCrab announced in May they were shutting down their operation, make sure your organization is safe from this type of infection before another group takes it over, or worse, you won\u2019t have an option to decrypt your system!<\/p>\n\n\n\n

Try KnowBe4\u2019s NEW Ransomware Simulator<\/a> version and get a quick look at the effectiveness of your existing network protection against the latest threats. RanSim will simulate 15 ransomware infection scenarios and 1 cryptomining infection scenario to show you if a workstation is vulnerable to infection. <\/p>\n\n\n\n

Here’s how RanSim works: <\/p>\n\n\n\n