What do you know about the cryptolocker ransomware?

This is how companies could protect themselves against the cryptolocker ransomware.

The cryptolocker ransomware was a polymorphic virus, which was used to encrypted computer systems. The only option affected individuals had at that time was the payment of a ransom, in order to decrypt their data with a unique key. A deadline for the payment of the ransom was also determined.
 
If the deadline had expired and the ransom was still not paid, the decryption key of the cryptolocker ransomware was deleted. The data was then irrevocably encrypted. Important documents were therefore lost forever.

The cryptolocker ransomware could enter the computers in two ways. The emails and web pages were primarily used as a gateway. The users received an infected file attachment in their electronic mailbox. This could be, for example, a compressed zip or rar file, a word document or a picture – in the form of a jpeg. The attackers disguised themselves as federal institutions, online traders, applicants or business partners.
 
If the cryptolocker ransomware attack was carried out through a website, the polymorphic virus would be downloaded via an update. This could happen via Java Script or Acrobat Reader. There was the possibility to become a victim of a cryptolocker ransomware attack, even if a user just followed a link to a malicious website. On that website, the download of an infected file started automatically and the malware immediately installed itself. The tricky part was that the user did not actively noticeit. This meant that the local files were encrypted in the background without being detected. After this process was complete, a notice or pop-up window would appear, which would list the payment terms for the ransom.
t

Why you should generally never pay a ransom after a cryptolocker ransomware attack

The problem was that the victims of the cryptolocker ransomware were often denied access to their files even after paying the ransom money. For this reason, authorities and IT experts generally advise against paying a ransom to the cyber criminals. Also, the attackers will use the money to develop new threats and attacks with the ransom money.

How a cryptolocker ransomware attack could have been prevented

For an effective protection against the Cryptolocker ransomware, you will now find a list of useful tips. The following preventive measures would have been recommended during an attack by the cryptolocker ransomware and are still valid with regard to any ransomware attack.

3 ways to protect yourself against crypto ransomware

1. Backups

Businesses should always take care to secure their data at regular intervals. Short backup intervals are therefore reasonable. The time intervals between the backups should be limited to only a few days. Having access to a backup, the victims of the cryptolocker ransomware would have been able to access their backups and restore their data without major losses. However, it should be noted that during this process the backups should be saved to a physically independent drive and ideally with a versioning feature. For example, a USB hard disk would not have been sufficient.

2. Updates

Not only in relation to cryptolocker, but also other ransomware versions, the following recommendations still apply: Keep your systems of your company always up-to-date. This applies to updates of your operating system as well as to your security software. Talk to your provider regularly about new updates. Most software vendors publish their updates on a special website or inform their customers directly about the application or via email about updates.

3. Hornetsecurity Advanced Threat Protection (ATP) as an IT security service

Hornetsecurity Advanced Threat Protection (ATP) provides you with a comprehensive IT security concept that detects and protects from complex attacks such as CEO fraud, spear phishing, whaling and also ransomware. As soon as a malicious email is on its way to the recipient, Hornetsecurity ATP will detect it and prevents the delivery. Additionally, you will receive detailed information about the attack on your company.

Protection against the cryptolocker ransomware

As the last few years have shown, the area of cybercriminality should not be underestimated, especially in the case of blackmail trojans. In order to discover these complex attacks, Hornetsecurity Advanced Threat Protection (ATP) relies on a sandbox analysis engine, amongst others.
 
In practice this means the following: As soon as the user wants to open an email attachment, the attached file is carefully opened and analyzed in a protected system environment. If it actually happens to be a positive malware attachment, the delivery of the email is prevented.
 
Another recognition method used is freezing, which holds suspicious emails back or “freezes” them. Once the signatures for the scanning filters have been updated, a new scan of the retained file is performed. This ensures that the cryptolocker ransomware would not have had a chance to enter the companies’ systems.

CEO Fraud, Whaling and Phishing

The intention of many attackers is to get their hands on personal data, such as credit card information and logging data (whaling and phishing). From a financial point of view, these kind of cyber attacks are also very rewarding for the perpetrators. For example, CEO fraud tries to persuade employees under false pretenses to transfer funds, for example to offshore accounts.
 
There have already been cases where companies were scammed for several million dollars. Employee-related terminations are not a rarity in this context. Hornetsecuritys Advanced Threat Protection (ATP) provides a sustainable solution for enterprises where traditional IT security mechanisms fail. The analysis of a certain internal corporate communication structure reveals irregularities and prevents them through identity spoofing.

r

Blended Attacks

Weiterhin sichert Hornetsecurity Advanced Threat Protection (ATP) Ihr Unternehmen zuverlässig gegen Blended Attacks ab. Bei dieser Form nutzen die Cyberkriminellen gleich mehrere Vektoren, um einen Angriff durchzuführen. Recht beliebt bei den Angreifern sind PDF-Dateien oder Office-Dokumente, die der E-Mail als Anlage beigefügt sind und Links zu Drive-by-Downloads aufweisen. Gegen Blended Attacks nutzt Hornetsecurity Advanced Threat Protection (ATP) die nachfolgenden Engines: URL-Scanning, URL-Rewriting, Sandboxing und Freezing. So wären Sie als Unternehmen zuverlässig geschützt.

R

Real-time alerts and employee awareness

As soon as Hornetsecurity Advanced Threat Protection (ATP) detects an attack, the user will receive a real-time alert about suspicious digital activities, which will allow companies to react quickly. This applies both to the initiation of internal company measures as well as legal measures. The user interface of the analysis engine allows companies to receive detailed information on individual attacks. Once a threat has been identified, the communications chain within the company can be used to inform other employees about incidents. Awareness raising among employees prevents, for example, the use of further attack vectors such as telephone lines.

R

Ex Post Analysis via Hornetsecurity Advanced Threat Protection (ATP)

The analysis not only takes place in real-time, but also after the attack. This way, emails, which were initially classified as safe, can be classified by the so-called “ex post alarm” as a threat at a later date. The chief information security officer of the companies has the opportunity to carry out a further detailed analysis, which significantly prevents the spreading of the attack.

t

The Targeted Fraud Forensic Engine

The Targeted Fraud Forensics consist of several recognition automatisms. They analyze malicious emails that cannot be recognized through a link or an attachment. In addition to the recognition of certain malicious patterns by the Intention Recognition System, Targeted Fraud Forensics also uses Feign Facts Identification. The mechanism recognizes false or manipulated notifications. If you would like to receive more information, then click here. There you will also get more detailed information about cryptolocker ransomware.

Read more about IT security in our blog

The hacker: made in Hollywood?

The hacker: made in Hollywood?

A hacker is smart, much smarter than the average. With just a few clicks and a few key combinations, he’s hacked into the IT systems of governments, public authorities and large corporations. He avoids the public and acts in secret – that’s how it’s portrayed in Hollywood movies. But the profile of computer geniuses is much more diverse than expected…
The age of information: What makes your data so valuable?

The age of information: What makes your data so valuable?

Are you aware of your “data value”? In the case of a data leak in the IT systems of multinational companies, it is often reported that the damage amounts to billions. Data has even become one of the most valuable resources in the world. However, a calculator that allows users to determine the overall value of their data leaves a completely different impression: the “price” for the information provided by users is always less than one dollar. But how is this possible and is it even possible to specifically calculate the value of this “resource”?

Visit our knowledge database

Did you like our article about Cryptolocker in the knowledge database? Then click here for the overview page of our knowledge database. There you will learn more about topics such as DDoS attacks, phishing, brute force attacks, GoBD, Cyber Kill Chain and Ransomware Kill Chain.