The average ransom payment made by victims of ransomware attacks fell by 38% between Q1 and Q2, 2021, according to the latest report from ransomware incident response company Coveware. In Q2, the average ransom payment was $136,576 and the median payment decreased by 40% to $47,008.

One of the key factors driving down ransom payments is a lower prevalence of attacks by two key ransomware operations, Ryuk and Clop, both of which are known for their large ransom demands. Rather than the majority of attacks being conducted by a few groups, there is now a growing number of disparate ransomware-as-a-service brands that typically demand lower ransom payments. In Q2, Sodinokibi (REvil) was the most active RaaS operation conducting 16.5% of attacks, followed by Conti V2 (14.4%), Avaddon (5.4%), Mespinoza (4.9%), and Hello Kitty (4.5%). Ryuk only accounted for 3.7% of attacks and Clop 3.3%.

The Sodinokibi gang has now gone silent following the attack on Kaseya and appears to have been shut down; however, the group has shut down operations in the past only to restart with a new ransomware variant. Even if the operators have retired, the affiliates used to conduct the attacks are likely to just switch to an alternative RaaS operation so attack volume may not be affected.

The most common vectors used in attacks has been fluctuating over the past few months. In Q1, 2021 there was an increase in brute force attacks on Remote Desktop Protocol (RDP) and the exploitation of software vulnerabilities, with phishing attacks falling. In Q2, RDP compromises and software vulnerability exploits both declined and email phishing increased, with phishing and RDP compromises now equally common. The exploitation of software vulnerabilities is the attack vector of choice for targeted attacks on large enterprises, and those attacks tend to be conducted only by the most sophisticated RaaS operations with large operating budgets that allow them to purchase single day exploits or buy access to large networks.

In Q2, more than 75% of ransomware attacks were on businesses with fewer than 1,000 employees. This is because these smaller companies are less likely to invest in security awareness training for the workforce and email security to block phishing attacks. They are also more likely to expose RDP to the Internet. Smaller businesses are also more likely to outsource security to MSPs. MSPs remain a major target, as an attack on an MSP will allow the attacker to then attack all MSP’s clients.

The report indicates a fall in the effectiveness of double extortion tactics. This is where prior to file encryption, sensitive data are exfiltrated. A demand is issued for the key to decrypt data and a second payment is required to prevent the exposure or sale of stolen data. In Q2, 81% of attacks involved data exfiltration prior to file encryption, up from 76% in Q1.

However, payment to ensure data deletion is now much less likely. In 2020, 65% of victims that were able to recover data from backups paid the attackers to prevent the exposure of stolen data, but in Q2, 2021 the percentage was just 50%.

The most attacked industry sectors in Q2 were the public sector (16.2%), professional services (13.3%), and healthcare (10.8%). Coveware suggests that these industries may not be specifically targeted, instead they are simply the easiest to attack. For instance, the number of attacks on law firms increased but that was largely down to the attack by the Clop ransomware group on Accellion File Transfer Appliances, which were disproportionately used by law firms.

Coveware reports that the average downtime from a ransomware attack declined by 15% in Q2, with victims typically having 23 days of downtime following at attack; however, this was attributed to an increase in data only attacks where there was no material business interruption.

The post The Average Ransomware Payment Fell by 38% in Q2, 2021 appeared first on HIPAA Journal.

The Department of Justice and the DHS’ Cybersecurity and Infrastructure Security Agency (CISA) have announced the launch of a new web resource that will serve as a one-stop-shop providing information to help public and private sector organizations deal with the growing ransomware threat.

The new resource – StopRansomware.gov – is an interagency resource that provides guidance on ransomware protection, detection, and response in a single location.

The new resource provides general information about ransomware, including what ransomware is and how it is used by cybercriminals to extort money from public and private sector organizations. Detailed information is provided on how organizations can improve their security posture and defend against attacks, including ransomware best practices, bad practices to avoid, cyber hygiene tips, FAQs, and training material.

The website includes a newsroom with the latest ransomware-related advice, along with alerts from CISA, the FBI, Department of Treasury, and other federal agencies about the ever-evolving tactics, techniques, and procedures used by cybercriminals in their attacks.

Victims of ransomware attacks can report attacks through the website to either the FBI, CISA, or the U.S. Secret Service, with the report of the attack automatically sent to all appropriate agencies to ensure that the incident is investigated, threat information is shared, and steps are taken to identify the perpetrators and bring them to justice.

Organizations are being encouraged to take advantage of the new resource to understand the threat of ransomware, mitigate risk and, in the event of an attack, know what steps to take to limit the harm caused and ensure the fastest possible recovery.

“Cyber criminals have targeted critical infrastructure, small businesses, hospitals, police departments, schools and more.  These attacks directly impact Americans’ daily lives and the security of our nation,” said Secretary Alejandro Mayorkas for the Department of Homeland Security. “I urge every organization across our country to use this new resource to learn how to protect themselves from ransomware and reduce their cybersecurity risk.”

The post U.S. Government Launches New One-Stop Ransomware Website appeared first on HIPAA Journal.

Managed Service Providers (MSPs) are attractive targets for cybercriminals. They typically have privileged access to their clients’ networks, so a cyberattack on a single MSP can see the attacker gain access to the systems of many, if not all, of their clients.

The recent Kaseya supply chain attack showed just how serious such an attack can be. An REvil ransomware affiliate gained access to Kaseya systems, through which it was possible to access the systems and encrypt data of around 60 of its customers, many of which are MSPs. Through those MSP customers, ransomware was deployed on up to 1,500 downstream businesses.

Small- and mid-sized businesses often do not have staff to manage their own IT systems or may lack the skills or hardware to store sensitive data and support sensitive processes. Many turn to MSPs to provide that expertise. It is often more cost effective for SMBs to scale and support their network environments using MSPs rather than manage their resources themselves.

Outsourcing IT or security functions to an MSP introduces risks, which need to be mitigated by SMBs. MSPs also need to implement safeguards to prevent their networks from being accessed and to limit the harm caused to their customers should their perimeter defenses be breached.

On July 14, 2021, The DHS’ Cybersecurity and Infrastructure Security Agency (CISA) published guidance to help MSPs and SMBs strengthen their defenses to improve resilience to cyberattacks and to limit the harm caused should such an attack succeed.

The CISA Insights report provides mitigations and hardening guidance for MSPs and SMBs, outlining important steps that should be taken to protect MSP network assets and those of their customers to reduce the risk of successful cyberattacks.

The guidance document – CISA Insights: Guidance for Managed Service Providers (MSPs) and Small- and Mid-sized Businesses – is available for download here.(PDF)

The post CISA Publishes Guidance for MSPs and SMBs on Hardening Security Defenses appeared first on HIPAA Journal.

The notorious REvil ransomware gang’s Internet and dark web sites have suddenly gone offline, days after President Biden called Vladimir Putin demanding action be taken against ransomware gangs and other cybercriminals conducting attacks from within Russia on U.S. companies.

At around 1 a.m. on Tuesday, the websites used by the gang for leaking data of ransomware victims, their ransom negotiation chat server, and command and control infrastructure went offline and have remained offline since. For one of the gang’s sites, the server IP address is no longer resolvable via DNS queries.

REvil has grown into one of the most prolific ransomware-as-a-service operations. The gang was behind many ransomware attacks in the United States and worldwide, including the recent attack on JBS Foods and the supply chain attack on Kaseya, which saw ransomware used in attacks on around 60 managed service providers and up to 1,500 of their clients on July 2. A ransom demand of $70 million was issued to supply the keys to decrypt all victims’ devices, with the demand falling to $50 million shortly after.

While it is not unusual for ransomware operations to go quiet, or for infrastructure to be temporarily taken offline, the timing of the shutdown suggests either the U.S. or Russian government has taken action. The FBI has not commented on the shutdown of the REvil servers, and the press secretary of the president of the Russian Federation, Dmitry Peskov, told TASS reporters that he had no knowledge of the reason why the servers had gone dark. It is possible that the loss of infrastructure is due to hardware failure or simply the gang deciding to lay low, especially after such a major attack.

Ransomware gangs have faced a great deal of scrutiny following the attack on Colonial Pipeline by the DarkSide ransomware gang. Shortly after the attack, the White House announced that efforts to target ransomware gangs and their infrastructure would be stepped up. Following the attack, the DarkSide RaaS operation shut down, due to a silent takedown of their infrastructure by law enforcement.

At the Geneva summit, President Biden spoke with Vladamir Putin about cyberattacks conducted on U.S. companies from cybercriminal groups operating within Russia and urged him to take steps to disrupt the gangs, even though the attackers were not sponsored by the state.

A few days ago, President Biden called Putin demanding action be taken against ransomware gangs operating out of Russia. Biden told reporters after the call that the United States would be taking steps to get the servers of ransomware gangs taken down if Russia did not.

Some news outlets, such as the BBC, have reported the shutdown was due to action taken by the United States to disrupt the group’s infrastructure. A BBC reporter spoke to one individual, allegedly an REvil affiliate, who said the group had shut down its infrastructure following a partial takedown by federal law enforcement and increasing pressure from the Kremlin.

Bitali Kremez of Advanced Intel said “Upon uncorroborated information, REvil server infrastructure received a [Russian] government legal request forcing REvil to completely erase server infrastructure and disappear. However, it is not confirmed.”

It is too early to tell what has happened and whether the shut down will be temporary or permanent. As is often the case following the shutdown of a Ransomware-as-a-Service operation, the gang may simply return under a different name, as REvil has done in the past.

This story will be updated as further information becomes available.

The post REvil Ransomware Websites Disappear Fueling Speculation of Law Enforcement Takedown appeared first on HIPAA Journal.

Kaseya has announced a security update has been released for the Kaseya KSA remote management and monitoring software solution to fix the zero-day vulnerabilities recently exploited by the REvil ransomware gang in attacks on its customers and their clients.

The vulnerabilities exploited in the attack were part of a batch of seven flaws that were reported to Kaseya in April 2021 by the Dutch Institute for Vulnerability Disclosure (DIVD). Kaseya had developed patches to correct four of the seven vulnerabilities in its Virtual System Administrator solution and released these as part of its April and May security updates; however, before patches could be released for the remaining three vulnerabilities, one or more of them were exploited by an REvil ransomware affiliate.

The attack affected approximately 60 customers who had deployed the Kaseya VSA on-premises, many of which were managed service providers (MSPs). The REvil ransomware gang gained access to their servers, encrypted them, and pushed their ransomware out to approximately 1,500 business clients of those companies.

Following the July 2, 2021 attack, Kaseya advised its customers to shut down their on-premises VSA servers until the exploited vulnerabilities were addressed and its SaaS servers were shut down as the SaaS solution also had vulnerabilities, although its cloud-based service was not affected by the attack. Those servers are now being restarted incrementally and the final three patches have been released in the VSA 9.5.7a (9.5.7.2994) update.

The three vulnerabilities addressed in the latest security update are a credential leak and business logic flaw tracked as CVE-2021-30116, a cross site scripting vulnerability – CVE-2021-30119 – and a 2FA bypass vulnerability – CVE-2021-30120. Kaseya says a further three vulnerabilities in the solution have also been addressed by the update. These are a failure to use a secure flag for user portal session cookies, a flaw that allowed files to be uploaded to a VSA server, and an issue where a password hash was exposed, which made weak passwords vulnerable to brute force attacks.

Kaseya has recommended a process for applying the update to minimize risk. This involves ensuring the VSA server is isolated and not connected to the Internet, searching for Indicators of Compromise (IoCs) to determine if servers or endpoints have already been compromised, then applying the update.

The full process for updating on-premises VSA servers and securing them is detailed in the Kaseya On Premises Startup Readiness Guide.

The post Kaseya Security Update Addresses Flaws Exploited in KSA Ransomware Attack appeared first on HIPAA Journal.