{"id":123613,"date":"2021-06-28T13:00:16","date_gmt":"2021-06-28T20:00:16","guid":{"rendered":"\/blogs\/?p=123613"},"modified":"2024-01-16T01:05:50","modified_gmt":"2024-01-16T09:05:50","slug":"5-ransomware-threats-canadians-need-to-know","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/5-ransomware-threats-canadians-need-to-know\/","title":{"rendered":"5 Ransomware Threats Canadians Need to Know"},"content":{"rendered":"

Every day you place your personal information in the hands of companies and trust that it will remain safe. However, what happens when external threats jeopardize your\u00a0personal\u00a0data security, especially\u00a0while working remotely?<\/span>\u00a0<\/span><\/p>\n

The transition to remote work environments\u00a0and consumers\u2019 online habits\u00a0have made it more difficult for\u00a0Canadian\u00a0employees and consumers\u00a0to protect their personal information. This challenge is primarily due to\u00a0<\/span>ransomware<\/span><\/a>.\u00a0To protect yourself, you need to first understand how cybercriminals\u00a0take advantage of users\u2019 online behaviors to\u00a0launch strategic attacks against\u00a0employees\u00a0and\u00a0consumers through the\u00a0information\u00a0they glean from stolen company data.<\/span>\u00a0<\/span><\/p>\n

How Your Personal Actions Can Impact Corporate Systems<\/span><\/b>\u00a0<\/span><\/h2>\n

Ransomware has been on the rise this past year with attacks increasing 62% in 2020 according to\u00a0<\/span>Statista<\/span><\/a>.\u00a0In\u00a0fact,\u00a0<\/span>7<\/span>8% of Canadian cybersecurity professionals said\u00a0that attacks increased due to employees working remotely\u00a0in a recent\u00a0<\/span>VMware report<\/span><\/a>.\u00a0Cybercriminals\u00a0target\u00a0remote workers\u00a0primarily\u00a0through malicious links sent\u00a0through\u00a0<\/span>phishing emails<\/span><\/a>\u00a0\u2014\u00a0in fact,\u00a0o<\/span>ver\u00a0<\/span>one third of Canadian respondents<\/span><\/a>\u00a0in a\u00a0recent survey said they experienced at least one\u00a0phishing\u00a0attempt in the last year.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

Hackers pose as legitimate organizations and prompt\u00a0individuals\u00a0to\u00a0take action:\u00a0say you\u00a0decide to check your personal email on your work laptop during your lunch break. You open a message that claims to\u00a0be from one of your\u00a0favorite\u00a0retailers\u00a0claiming that you just won $500 in shopping credit \u2013 all you need to do is click on the\u00a0link and fill out your banking information. This is an example of a phishing attack that could not only wreak havoc on your personal security, but your company\u2019s as well. If the link in the message downloads a credential-stealing malware\u00a0on your work laptop, there is a good chance that\u00a0your organization\u2019s private data\u00a0or network\u00a0could be compromised.\u00a0<\/span>\u00a0<\/span><\/p>\n

Knowing that many employees will be communicating virtually instead of face-to-face, hackers\u00a0can take advantage of the remote work environment by\u00a0posing\u00a0as employees from finance departments and sending\u00a0fake invoices for products or services. The\u00a0goal of\u00a0these fake invoices is for employees to call a support phone number to investigate, whereby hackers attain credit card numbers or other information they can leverage in\u00a0<\/span>spear-phishing scams<\/span><\/a>.\u00a0Hackers can also spoof phone calls to make it look like it is coming from a legitimate number within the organization.\u00a0Revealing too much information to an unverified contact\u00a0is a risk that remote workers\u00a0must learn to identify and avoid.<\/span>\u00a0<\/span><\/p>\n

Ransomware is always evolving, making it critical\u00a0to understand the nature of these threats\u00a0so you can\u00a0better avoid them.\u00a0<\/span>\u00a0<\/span><\/p>\n

The 5 Most Dangerous Ransomware Scams <\/span><\/b>\u00a0<\/span><\/h2>\n

Cybercriminals are constantly finding new ways to automate their attacks and increase their profits.\u00a0Here is a look at five\u00a0<\/span>active ransomware variants<\/span><\/a>\u00a0cybercriminals use today\u2014and\u00a0how\u00a0they\u00a0deploy them.<\/span>\u00a0<\/span><\/p>\n

1. CryptoDefense<\/span><\/b>\u00a0<\/span><\/h3>\n

By the end of 2020,\u00a0<\/span>McAfee Labs<\/span><\/a>\u00a0observed a 69% increase in new ransomware, which\u00a0<\/span>Cryptodefense<\/span><\/a>\u00a0<\/span>largely drove.\u00a0This virus is\u00a0similar to\u00a0<\/span>CryptoLocker<\/span><\/a>, a trojan virus that spreads through email phishing to infiltrate hard drives and files.\u00a0Both\u00a0spread\u00a0ransomware,\u00a0use high levels of\u00a0encryption\u00a0to compromise users\u2019 files,\u00a0and\u00a0claim that these files cannot be decrypted\u00a0without a decryption key.\u00a0<\/span>\u00a0<\/span><\/p>\n

2. Maze<\/span><\/b>\u00a0<\/span><\/h3>\n

Maze\u00a0ransomware<\/span><\/a>\u00a0has been active since November of 2019 and is operated by hackers notorious for leaking victim data upon non-payment. Maze operators first gain access to a network by using valid credentials.\u00a0It will then scan the network for user devices, check these devices for additional credentials, and compromise\u00a0user files.\u00a0<\/span>\u00a0<\/span><\/p>\n

3. REvil\/Sodinokibi<\/span><\/b>\u00a0<\/span><\/h3>\n

In a\u00a0<\/span>Ransomware Task Force interview<\/span><\/a>\u00a0with an affiliate of the\u00a0REvil\/<\/span>Sodinokibi<\/span><\/a>\u00a0syndicate,\u00a0the\u00a0interviewee revealed that companies with cyber insurance are prime targets since the chances of a payout are high. This ransomware spreads through software vulnerabilities, phishing scams, and exploit kits. Once it infiltrates a device, it spreads through escalated privilege to compromise user files and systems.\u00a0<\/span>\u00a0<\/span><\/p>\n

4. Ryuk<\/span><\/b>\u00a0<\/span><\/h3>\n

Ryuk<\/span><\/a>\u00a0has been around since August of 2018 and targets large companies, critical infrastructure, and hospitals. This ransomware is almost always spread through a banking trojan called\u00a0Trickbot, used by hackers to steal financial and banking credentials. The operators behind this ransomware demand higher ransoms compared to other groups. They also use opensource tools and manual hacking techniques to bypass detection and infiltrate private networks.<\/span>\u00a0<\/span><\/p>\n

5. SamSam<\/span><\/b>\u00a0<\/span><\/h3>\n

The operators behind\u00a0SamSam\u00a0ransomware gain access through Windows servers using a Microsoft protocol that allows remote connections to other computers. Operators will then elevate their privilege to include admin rights once inside a network to infect servers with malware, requiring no action or authorization on the victim\u2019s part.<\/span>\u00a0<\/span><\/p>\n

How to Reduce the Risk and Impact of Ransomware<\/span><\/b>\u00a0<\/span><\/h2>\n

Ransomware\u00a0can affect anyone,\u00a0regardless\u00a0of whether\u00a0you\u00a0are an employee or\u00a0a\u00a0customer\u00a0of a targeted company.\u00a0Keep these tips in mind to\u00a0reduce your risk of a ransomware attack and\u00a0know\u00a0what steps to take if you fall victim.\u00a0<\/span>\u00a0<\/span>\u00a0<\/span><\/p>\n

1. Don\u2019t click on malicious links<\/span><\/b>\u00a0<\/span><\/h3>\n

Phishing emails<\/span><\/a>\u00a0are one of the most common methods a hacker will use to\u00a0infect devices and spread ransomware.\u00a0They will send links through seemingly legitimate emails to trick users into clicking\u00a0on them\u00a0and downloading malicious files.\u00a0Knowing how to spot one is the first step to\u00a0prevent infection. If you receive an\u00a0email\u00a0you suspect is a phishing scam, start by analyzing its structure: common indicators of a phishing scam\u00a0may include:<\/span>\u00a0<\/span><\/p>\n