By early 2020, ransomware attacks had increased by 41% over 2019 levels, and the average ransom payment had risen to more than $80,000. These numbers reflect the rapid shift from solitary hackers targeting specific businesses to large networks of cybercriminals using sophisticated AI and automation tools to continually probe all types of businesses for vulnerabilities.
That was the backdrop for one convenience retailer which experienced a ransomware attack in February 2020. The company’s business leaders were gracious enough to (anonymously) share their story to help other businesses avoid suffering the same fate. What follows is the general timeline of events and the lessons learned from the remediation efforts. Consider it a friendly wake-up call as you think about ways to boost your cybersecurity posture.
Ransomware is no longer just an abstract concept
If you haven’t yet been exposed to an attack, consider yourself lucky. But when you truly comprehend the current risk factor, you should feel a sense of urgency about the immediate threat. Ransomware has become the go-to attack method for cybercriminals based on three primary reasons:
- Robust malware and encryption tools originally developed by nation-states are now being used by cybercriminals.
- The use of encryption makes any affected data and assets inaccessible until a ransom has been paid.
- The rise of cryptocurrencies has enabled fast and easy digital payments which can easily be laundered.
In this particular case, the timeline begins when my company was contacted by the business in the middle of an active ransomware attack. Here’s a snapshot of what transpired:
- Wednesday: The company requested assistance. We immediately initiated a managed detection and response (MDR) solution to begin the triage process, discovered the malware was still active, and deployed a rapid response team to help with onsite remediation.
- Thursday: We applied network segmentation controls to prevent further outbreaks, assessed the ransomware demands, and determined whether encryption keys were needed.
- Friday: We realized all file servers and all backups were encrypted, so the company’s business leaders decided to attempt a ransom payment and data recovery, negotiating a payment of 4 Bitcoin (approximately $40,000 at the time).
- Weekend: The company engaged Coveware to speed up payment resolution.
- Monday: We received the decryption tool, vetted it thoroughly to make sure there were no hidden issues lurking, and began decrypting critical systems.
- Tuesday: We continued running the decryption process all day and night until most critical systems were back online.
During this seven-day stretch, all business operations were shut down. Imagine the last time you were locked out of your data or systems for a single hour and extrapolate that out to an entire week. And there was always a significant chance this decades-old business would have to close its doors for good. What the timeline doesn’t capture are all the frantic phone calls, stressful deliberations, and non-stop anxiety across the entire company.
Beyond the technology challenges, the logistical hurdles were just as unpredictable and difficult. For instance, most companies don’t have ready-to-use Bitcoin accounts or legal teams which are experienced in negotiating with cybercriminals. And even after the company made the payment, it was touch-and-go until we made sure the decryption software itself was not malicious.
Even though this story has a somewhat happy ending in that the company ultimately recovered its data and managed to stay in business, it was the most stressful situation any of the business leaders had faced in their careers.
In the end, the root cause of the attack was somewhat predictable in its familiarity – and easily preventable. The primary issue was an unsecured server exposed to the Internet, no multi-factor authentication (MFA) used for credentials, and insufficient segmentation between networks (such as separating financial and POS systems from inventory systems).
Preventative actions make it harder on ransomware
The good news is that defeating ransomware isn’t really a technology issue. The tools, strategies, and training to protect your business are all readily available. Addressing the challenge is more about your willingness and commitment to utilize those tools and resources. So, what can you do?
First, start by performing a security assessment to understand who your adversaries are, what’s at risk, and how you plan to manage that risk. For any of the steps below, consider engaging a reputable cybersecurity vendor to help if you lack in-house expertise to complete any of these steps on your own:
- Deploy a reliable endpoint detection and response (EDR) solution to detect and help prevent attacks before they impact your business.
- Restrict access on the edge of your business, allowing access only through firewalls, VPNs, and MFA credentials.
- Keep your IT systems patched and updated with the latest software. Remove any troublesome legacy systems everyone is afraid to change.
- Regularly train employees about security, and ensure you have a clear response plan in case an attack happens.
- Make sure you have regularly tested backups which are disconnected from your production systems (backups can be your lifeline if your data gets encrypted).
Even if it seems like ransomware is everywhere right now, you don’t have to become another victim. You control how much risk you’re willing to accept and what actions you’re willing to take. Be proactive and learn from others’ mistakes so you don’t have to learn the hard way.
