Paul Ferrillo | June 8th, 2016

Just Say No to Ransomware

Aside from the presidential election, the other big piece of news this week (at least in the corporate environment) is the continuing Ransomware plague that continues to affect U.S. businesses by encrypting its files. Though clearly The Bern and The Donald swamped news cycles earlier in the month, some very alarming statistics came out this week that all businesses should pay attention to.

One report, by a noted cyber security research company called PhishMe, noted that 93% of all phishing email (the kind of email which tries to trick you to open its attachment or to click on the link) contains ransomware. A related article noted, “According to PhishMe, its analysis of phishing email campaigns from the first three months of 2016 has seen a 6.3 million increase in raw numbers, due primarily to a ransomware upsurge against the last quarter of 2015. That is a staggering 789% jump”, see Ransomware Sends Phishing Volumes up Almost 800%. Other reports noted this week that various Ransomware variants (apparently distributed by random cybercrime groups) have morphed over the past few weeks and have gotten even more dangerous. Some morph and change every 15 seconds to make internal modifications to the malware infections sought to be inflicted. Other variants actually make fun of cybersecurity researchers attempting to break the variant, saying in effect, “’you cannot hack me, I am very hard.’ See ‘Black Shades’ ransomware taunts researchers in its source code.” When malware makes fun of you, you know things have gotten pretty bad.

Why is ransomware such an awful, painful problem? Simply put, it is spread by the mere link or attachment to a spear phishing email received by an employee or co-worker, which cries out to be opened or clicked.  These types of phishing or spear phishing emails can be very convincing. Some allegedly come from your bank or a perhaps a big box retailer offering a discount or credit card application. Others say, “open me please” so you can “update your personal information.” Regardless of the sender and regardless of content, every one of these spear phishing emails contains an awful package which can encrypt all your files and everyone else™’s on the network. Some ransomware variants attempt to encrypt your back up files as well. Lastly, yet another variant tries to steal your password and personal information while it encrypts your files. Of course, you say, “Just don’t open the attachment,” or “Don’t click on the link!”  But most Americans unfortunately cannot help themselves. They want to open the attachment. They want a good credit deal. They want “riches and fortune” from the Sultan of Arabia.  But unfortunately, they don’t get any of that when they click on the link. They and their company get a barrel of hurt. 

How do we attempt to stop the ransomware plague? Here are some good tips (several of which were just published by FireEye, in a publication entitled, “Ransomware Response Strategies”): 

1.       Train your employees, C-Suite, and directors about the perils of clicking on attachments or links of unknown origin — no matter how normal the email looks, if it comes from an unknown address or person, it might contain ransomware. Employee training and awareness works. It just needs to be done at all levels.

2.       Back up your network – I know this sounds novice, but many small to medium size businesses do not have back up or business continuity plans, do not regularly back up their networks, or do not back up their networks to an off-site or off-the-grid to solution so that the backup media does not become encrypted.  There are many easy solutions out there for back up protocols and media, including cloud based solutions that are pretty easy to use.  Believe us, having a ready to go and tested backup solution is a necessity in any environment.  In today™’s ransomware environment, it is a “must have.”

3.       Finally, though it costs a bit more, consider installing on your network one of the various email filters that several of the top flight cyber consultants market in order to pre-screen and block potentially malicious your email before it ever gets to an employee™’s desktop computer.  Given that not all training is effective, automated approaches to potentially malicious emails may be the best approach for many businesses.

Paul Ferrillo is counsel in Weil, Gotshal & Manges’ Litigation Department.