After WannaCry and Petya, another ransomware seems to spreading like wildfire, taking a hold of computer systems all over the globe, this time it’s being called Locky. The Computer Emergency and response team (CERT) under Government of India has raised an advisory on the spread of Locky Ransomware via spam emails.
It has been reported that a new wave of spam mails are circulating with common subject lines to spread variants of Locky ransomware. Reports indicate that over 23 million messages have been sent in this campaign. The messages contain common subjects like “please print”, “documents”, “your account attacked”, “photo”, “Images”, “scans” and “pictures”. However the subject texts may change in targeted spear phishing campaigns.
Users and administrators are advised to take preventive measures to protect their computer and mobile networks from ransomware infection / attacks and looters asking for ransom to their Bitcoin wallet:
Perform regular backups of all critical information to limit the impact of data or system loss and to help expedite the recovery process. Ideally, this data should be kept on a separate device, and backups should be stored offline.
Keep the operating system third party applications (MS office, browsers, browser Plugins) up-to-date with the latest patches.
Maintain updated Antivirus software on all systems
Don’t open attachments in unsolicited e-mails, even if they come from people in your contact list, and never click on a URL contained in an unsolicited e-mail, even if the link seems benign. In cases of genuine URLs close out the e-mail and go to the organization’s website directly through browser
Follow safe practices when browsing the web. Ensure the web browsers are secured enough with appropriate content controls.
Establish a Sender Policy Framework (SPF) for your domain, which is an email validation system designed to prevent spam by detecting email spoofing by which most of the ransomware samples successfully reaches the corporate email boxes.
Check regularly for the integrity of the information stored in the databases.
Regularly check the contents of backup files of databases for any unauthorized encrypted contents of data records or external elements, (backdoors /malicious scripts.)
Ensure integrity of the codes /scripts being used in database, authentication and sensitive systems
Application white listing/Strict implementation of Software Restriction Policies (SRP)to block binaries running from %APPDATA% and %TEMP% paths. Ransomware sample drops and executes generally from these locations.
Network segmentation and segregation into security zones – help protect sensitive information and critical services. Separate administrative network from business processes with physical controls and Virtual Local Area Networks.
Disable ActiveX content in Microsoft Office applications such as Word, Excel, etc.
Disable remote Desktop Connections, employ least-privileged accounts. Limit users who can log in using Remote Desktop, set an account lockout policy. Ensure proper RDP logging and configuration.
Restrict access using firewalls and allow only to selected remote endpoints, VPN may also be used with dedicated pool for RDP access
Use strong authentication protocol, such as Network Level Authentication (NLA) in Windows.
Additional Security measures that may be considered are
Use RDP Gateways for better management
Change the listening port for Remote Desktop
Tunnel Remote Desktop connections through IPSec or SSH
Two-factor authentication may also be considered for highly critical systems
If not required consider disabling, PowerShell / windows script hosting.
Restrict users’ abilities (permissions) to install and run unwanted software applications.
Enable personal firewalls on workstations.
Implement strict External Device (USB drive) usage policy.
Employ data-at-rest and data-in-transit encryption.
Consider installing Enhanced Mitigation Experience Toolkit, or similar host-level anti-exploitation tools.
Block the attachments of file types, exe|pif|tmp|url|vb|vbe|scr|reg|cer|pst|cmd|com|bat|dll|dat|hlp|hta|js|wsf
Carry out vulnerability Assessment and Penetration Testing (VAPT) and information security audit of critical networks/systems, especially database servers from CERT-IN empaneled auditors. Repeat audits at regular intervals.
Individuals or organizations are not encouraged to pay the ransom, as this does not guarantee files will be released. Report such instances of fraud to CERT-In and Law Enforcement agencies