ALERT:  

 

Number of Manitoba Ransomware Victims Increasing

For those of you that still think that ransomware, viruses, or malware doesn’t happen here, or that your business is too small or insignificant to warrant CyberCriminals’ attention…I’ve got news for you!  The number of Manitoba businesses being hit with ransomare, malware, viruses, spyware, and just about anything else that CyberCriminals can dream up, has exploded in recent weeks.  AND the methods that CyberCriminals are using to trick computer users into opening scam emails, infected files and/or attachments, or providing personal/financial information are getting more and more advanced.

What Is Ransomware?

Ransomware is a serious security threat that basically kidnaps your data.  It limits access to files and/or system functions, sometimes even renders systems completely useless.  They then force their victims to pay ransom to regain access to their files and/or systems.

How to Protect Yourself & Your Business:

1.  Admit You’re a Possible Target:  The #1 step to stepping up your defenses, is to admit that your business could be a target.  If you are still in denial about this, you’ve probably already stopped reading, and there is nothing more I can do to help you.
2. EDUCATION.  EDUCATION.  EDUCATION.  The #2 key to avoid becoming a victim is, you guessed it…education.  Most new scams are being spread by social engineering and phishing scams, which are designed to trick people into thinking the emails are legit, and into opening the emails, and links or attachments.  The links and/or attachments then infect the workstation, and usually quickly spread through the network to other workstations.  Educate yourself and your employees about the dangers out there, and what to look for!  This means anyone in your business that even looks at a computer should be informed what scams are currently out there, what to look for, and how to avoid them.
3. Know How to Recognize a Scam Email:  Read our ‘Red Flag Emails‘ for clues on what to look for in suspect emails.  The general rule of thumb is:  If it looks suspect, and you can’t confirm that it’s the real deal…DELETE IT. 
4. Install Updates:  In spite of knowing the importance of installing software/hardware updates, a lot of people either put them off or skip them all together.  Either the re-boot that your computer needs after installing the updates is ‘inconvenient’, or there are always ‘glitches’ after installing updates, etc etc.  We’ve heard all the excuses.  The bottom line:  Is a 3 minute inconvenience to re-boot your computer, or putting up with potential glitches, or any other potential ‘inconveniences’ worth plugging any security holes in your computer system.  I say yes, but that’s just me…
5. Keep Hardware and Software Up-to-Date:  Outdated hardware and software is often no longer supported by the manufacturer.  You’re thinking, “So what?  I don’t need their support!”.  This is a frequent misconception.  Periodically, a manufacturer decides that it will no longer “support” older software and/or hardware, in favor of concentrating on newer, better releases.  When a manufacturer no longer supports a piece of hardware/software, this means that they are no longer releasing the updates to plug known security holes.  This means HUGE security risk for your company!  This could also mean litigation, if you handle client information, payment information, etc.
6. Do Not Click Links Within Emails:  If you receive an email that has a link to a website and/or webpage on it, especially if the link does not match the tone of the email, or if it is to something that this person (if you know them) would normally send you — DO NOT CLICK!  A good trick:  hover the mouse over the link (Do NOT Click!!).  If the ‘box’ that appears does not match what the link states — it’s a fake and will cause you & your business some trouble if you click on it.  
7. Do Not Call Companies From Phone Numbers in Emails:  If you receive an email asking you to contact ‘Tech Support’ (or anything else for that matter!), get the phone number to call directly from their website.  Lots of scams involve fake phone numbers directing you to a legit-sounding department, then proceed to ask for personal information, credit card information, log in info, etc.
8. Spam Filter:  Tens of trillions of spam email is sent every year, to inboxes across the globe.  A spam filter stops 95% of spam emails from ever reaching your employees’ inboxes in the 1st place…for less than a cup of coffee..  Because all it takes is one careless click, and your business could be compromised.
9. Backup, Backup, Backup.  If everyone had reliable backups, ransomware wouldn’t even be an issue.  If you have a reliable backup, you don’t have to pay the hundreds or thousands of dollars in ransomware (and put an even bigger target on your business, because CyberCriminals now know that don’t have backups!) to get your own files back.  Instead, your files can be retrieved from your last backup, and you’re up and running!  

Not sure how secure your network is?  Ask us about our Network Security Assessment!  Mention this post & get it FREE!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:  ‘Locky’ Gaining Momentum…and Victims

 

This new CryptoLocker strain isn’t more sophisticated than any of the other versions of the malware, but it is spreading rapidly.  The FBI has released a statement in a recent Wall Street Journal article, stating that the threat from ransomware is expected to grow exponentially.

Forbes claims that ‘Locky’ CryptoLocker is infecting approximately 90,000 computers per day, and is costing victims approximately .5-1 Bitcoin (approx. $420US) to unlock their systems.

Locky is spread through phishing emails containing Microsoft Word attachments.  The last few days, Locky creators has sent at least 4 million phishing emails with a zip file as the attachment.  The zip file contains a JavaScript file which downloads and installs Locky.  

How to Protect Yourself:

1. Block any and all emails with .zip extensions and/or macros at your email gateway level.
2. Disable Adobe Flash Player, Java, and Silverlight if possible.  These are all used as attack vectors.
3. Educate your employees and coworkers to the danger, so they can recognize the red flags related to ransomware attacks.
4. Check out our Red Flag Emails for clues on how to spot a spam email.  Print it, and pass it out to all employees and coworkers so they can post it at their workstation as a reminder.
5. Ask us about a Spam Filter for your company.  More affordable than you think, and a very reliable way to eliminate 90% of spam from ever entering your inbox!
6. Back up your data!  Now, more than ever, backups are an everyday essential for every business!  Ask us for a FREE quote!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:

Netflix At No Charge

 

With their recent globally launched streaming service, Netflix’s popularity is gaining steam.  

Unfortunately, in today’s world popularity equals hacker target.

There are active malware and phishing campaigns targeting Netflix users with several scams:

1.  One scam claims you need to update your payment information

2.  Another claims that there has been “unusual” or “unauthorized activity on this account”

3.  Still others try to trick you into downloading software for a cheaper version of Netflix

These are just a few of the scams currently circulating.  

How To Protect Yourself:

1. If you receive an email that looks like its from Netflix, and claims you need to update payment information, DO NOT CLICK on any links or open any attachments.
2. Do not download anything from a MMS or a email.  Only download Netflix software directly from the Netflix website or official app stores.
3. ALWAYS go to the websites yourself, instead of clicking on a link in an email.
4. If you want to be 100% sure, call their customer service directly, using the 1-800 number you find on their website.

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks

ALERT:

MS Word Ransomware

 

 

Over 400,000 workstations were infected within a few hours of it being released.  

24 hours after being released, only 3 very specialized AntiVirus detected the ransomware.  

Now, most major AntiVirus products now detect the ransomware

…but only if the user is updating their AntiVirus.

It was only a matter of time before some CyberCriminal figured out how to insert ransomware into a MS Word document.

Some professional CyberCriminal finally did it.

The new ransomware called “Locky”, was first reported in the UK by Kevin Baumont, is causing major headaches for companies all over the globe, and have been received by companies in Canada, and even here in Manitoba.

Emails contain the subject line “ATTN: Invoice J-98223146”, and a message like “Please see the attached invoice (Microsoft Word Document) and remit payment according to the terms listed at the bottom of the invoice”, or something similar.  The email looks similar to the one below:

When opened, the attachment is a MicroSoft Word document that looks like the content of the document is scrambled.  The document will display a message stating that you should enable the macros if the text is unreadable.  The attachment will look similar to this:

Once the victim enables the macros, the macros downloads an executable file from a remote server.  This file will be stored in the “%Temp%” folder and, when executed, will encrypt the files on the workstation, then both mapped and unmapped network drives.

Once this has happened, you receive the message below:

Similar to CryptoWall, Locky also completely changes the filenames for encrypted files to make it more difficult to restore the right data.  At this time, there is no known way to decrypt files encrypted by Locky.

How to Defend Yourself:

Have your I.T. person hunt for this Group Policy Setting, and set it to “Disable all except digitally signed macros”.

Now check out Trusted Locations:  User Configuration/Administrative Templates/Microsoft Office XXX 20XX/Application Settings/Security/Trust Center/Trusted Locations

Set your shared folder location URL in here, e.g. //blah.local/public/office

More details at Microsoft Tehnet here.

The user won’t see a prompt to enable the macro, nor can they from the Office options.

There is a still a small risk that the user will save the malicious email attachment to the network and open it.  However, it is a much smaller risk than before.

Here is a very small sample of how far & fast Locky has spread:

Not sure if your company is safe?  Ask us for a FREE Network Security Assessment!

Check out our “Email Red Flags”  for what to watch for in suspicious emails. 

Ask us about our “Core Security Solutions” package!

You can’t stop CyberCriminals from targeting your company or employees.

But you can be prepared for their arrival, and have full shields up.

Got CyberBugs?

Call 1-204-800-3166

For Cyber-Extermination!

#itthatworks