Preventing the Next Ransomware Attack

As we move further into 2018, it’s evident that cyber adversaries are continuing their relentless efforts to exploit vulnerabilities and compromise systems for their own gain. While we haven’t seen a large-scale attack like WannaCry or NotPetya from 2017, new trends in attacker methods are emerging, with a focus on diversifying tactics.

One such trend is the rise of cryptomining attacks, taking advantage of the booming cryptocurrency market. Cryptomining malware, like WannaMine, targets system resources to mine for cryptocurrency. This type of attack is particularly stealthy, as it doesn’t necessarily focus on data theft but rather on exploiting the machine itself to generate revenue for hackers.

WannaMine, for example, leverages the EternalBlue exploit – the same exploit used in the WannaCry and NotPetya attacks – to infiltrate systems and mine cryptocurrency. This poses a unique threat to enterprises, as hackers can siphon off resources and power from the organization to fund their illegal activities.

To combat these evolving threats, security teams need to adopt proactive measures to enhance their organization’s defenses. Here are some key tactics to bolster immunity against ransomware attacks:

1. Patch Management: Regularly applying patches is crucial in preventing attacks like WannaCry and EternalBlue. Legacy vulnerability scanning may not provide accurate assessments of patch status, so organizations should ensure their tools offer real-time visibility into the system environment for proper prioritization of threats.
2. Behavioral Analytics: Instead of relying on signatures, organizations should focus on tracking Indicators of Attack (IoAs) to identify ransomware behavior. Behavioral analytics can help detect both known and unknown ransomware threats by monitoring malicious activities like deletion of backups or unusual file system behavior.
3. AI and Machine Learning: Implementing AI and machine learning capabilities can enhance threat detection by identifying new and evolving threats that traditional antivirus solutions may miss. Machine learning algorithms can learn to distinguish malicious files and behaviors without constant updates.
4. Proactive Threat Hunting: Rather than waiting for ransomware to strike, proactive threat hunting involves actively monitoring system behavior to detect and shut down potential threats before they escalate. Skilled threat hunting teams can identify subtle signs of malicious activity that automated tools may overlook.

   As we brace ourselves for future cyber-attacks, it’s essential for organizations to adopt a multi-faceted approach to cybersecurity. By implementing strategies like patch management, behavioral analytics, AI and machine learning, and proactive threat hunting, security teams can stay one step ahead of cyber adversaries and protect their systems from evolving ransomware threats.