Universities Hit by Cloud Computing Malware

Cloud, Ophtek, Security, Security Threats, ,
18
Aug 2020

Education is a crucial element of society, so attacks on this sector are very attractive to hackers. And this is why they are now targeting universities.

Universities, of course, are huge organizations packed full of students and tutors. As a result, these groups generate massive amounts of data every day. This makes these establishments massive data centers. And it’s no surprise that hackers can’t resist testing their defenses. Their latest attack has targeted a specific cloud computing provider in the form of Blackbaud and has affected a number of universities worldwide.

You may not work in a university, but all malware attacks contain important lessons we can learn from. Let’s take a closer look and find out what happened in the Blackbaud attack.

Attacking the Cloud

Blackbaud, a global provider of administrative and financial software to educational institutions, was targeted and attacked in May. The attack in question used a ransomware strategy to disrupt operations and demand a ransom. The exact source of infection has not been disclosed, but it would appear that the hackers began encrypting data immediately. However, Blackbaud mounted a quick response and were able to expel the hackers before the data was fully encrypted.

Unfortunately, a significant amount of data had already been copied by the hackers. And this data was of a particularly sensitive nature. It does not appear that any credit card details were copied, but phone numbers and donation histories were confirmed to have been duplicated. Blackbaud, therefore, was forced to pay a ransom in order for the hackers to destroy their copy.

Avoiding Ransomware Attacks

The Blackbaud attack may not have been the most devastating of malware attacks, but any breach is cause for concern. And, given that this attack targeted several large universities, the number of individuals affected is huge. As with all malware attacks, though, it’s possible to negate these attacks before they take hold. All you have to do is follow these simple practices:

  • Say No to Unverified Links: One of the hallmarks of ransomware attacks is the usage of malicious links. These links may promise to send you somewhere safe – such as your online banking page – but the true destination will be somewhere less safe. These malicious destinations are likely to attack your PC or install malware. Make sure that all links are checked and verified before clicking. 
  • Don’t Give Out Personal Data: Hackers will often facilitate their ransomware attacks by employing a social engineering strategy. The information gained from such an approach can be used by hackers to tailor phishing emails to appeal to you e.g. understanding who your phone provider is allows hackers to design emails from that specific provider. As a rule of thumb, never give out personal details to unsolicited callers. 

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Snatch Malware Proves That Safe Mode Isn’t so Safe

malware, Network, Ophtek, Ransomware, Security, Security Threats, , , ,
14
Jan 2020

We’ve all had to boot into safe mode on our PCs at some point and you would assume it’s a safe environment. But the Snatch malware is proving otherwise.

Safe mode is a configuration mode that you can request your PC to boot into at startup. In safe mode, your PC will only execute essential applications. The functions of your PC will be limited, but it’s the perfect environment for fixing problems and removing various forms of malware. But it appears that Snatch is a brand of malware which can thrive in safe mode.

Snatch is a multi-factor threat which can cause real damage to your business, so it’s a slice of malware that you need to be protecting yourself against. To give you a head start, we’ve put together a quick lowdown on Snatch.

What is Snatch?

Snatch is a newly discovered malware variant which contains two key threats: a ransomware function and the ability to log and steal user data. It’s not the first piece of malware to come loaded with these threats, but its infection strategies are unique. Using brute force attacks, Snatch is targeting the PCs of various organizations. So far, this sounds far from unusual as brute force attacks are a fairly conventional form of hacking. But Snatch has a unique strategy.

Following the initial infection, Snatch forces the PC to reboot. And it’s at this point that Snatch informs the PC to boot into safe mode. It’s believed that this unusual, yet clever, step is initiated in order to avoid anti-virus software which is often disabled in safe mode. From here it can execute its malicious payload. Snatch will then begin encrypting files and demanding ransoms that have been as high as $35,000. There is also evidence that surveillance threats are present in Snatch, so data harvesting is likely to start once the infection is unleashed.

Protecting Yourself from Snatch

The Snatch malware has the capability to cause extensive damage to your organization in terms of both finances and credibility. It’s also disturbingly efficient as it deletes any volume shadow copies of the files it encrypts. By deleting these volume shadow copies, Snatch is ensuring that it’s impossible to restore the encrypted files. Therefore, it’s crucial that you protect your PCs from Snatch by:

  • Practice Good IT Security: The backbone of any secure network is based upon the actions of those using it. And this is why it’s important that all your users understand the basics of IT security. By embracing these practices it’s possible to keep your PCs protected from the majority of majority of malware.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Panda Malware Continues to Thrive and Make Money

malware, Ophtek, Panda Malware, Security, , , ,
08
Oct 2019

One of the biggest threats to data security over the last few years has been crypto-malware. And, as the Panda malware proves, it can be a persistent danger.

We may think of pandas as gentle, beautiful creatures but that notion only applies when we’re talking about mammals. When it comes to malware, Panda is far from gentle. The malware in question has been active in the digital landscape since 2018 and, since then, has managed to secure close to $100,000 in cryptocurrency ransoms. And it has achieved this by constantly reinventing itself and modifying its structure. Staying one step ahead of the security experts is crucial for malware and Panda has done this with aplomb.

Understanding the motives and mechanics of Panda is important in strengthening your organization’s security, so let’s take a closer look at how it works.

What is Panda?

First identified in 2018, Panda is a form of malware which combines crypto-malware with remote administration tools (RATs) to render any infected PC under complete control of the hacker. Not only is the victim at the risk of having their data encrypted, but there’s the added danger of unauthorized access to their PC at any time. Panda achieves all of this by exploiting web applications, spreading via infected Word documents and unauthorized downloads by compromised websites. Web applications that have been found to be infected include a wide variety of industries such as social media, financial, web services and digital analytics.

How has Panda Managed to Persist?

Most malware has a relatively short lifespan due to design flaws and the talents of security experts, but Panda has persisted for over a year now. It owes this longevity to its coders and the speed at which they evolve Panda. The malware has always been an expert in stealth and this has allowed it to escape the attentions of antivirus software. Most concerning, however, is the number of additions that have been added to Panda’s arsenal since it first appeared. Reports have indicated that Panda now includes highly sophisticated exploit tools originally designed by the NSA. It’s that most dangerous form of malware: one that continues to grow in strength.

Protecting Your Business from Panda

Panda is a dangerous piece of malware, but it’s not one that you need to live in fear of. Instead, make sure you remain vigilant by implementing the following:

  • Regular training for your staff is essential in keeping your defenses as strong as possible. The knowledge that these training sessions provide is invaluable for keeping your staff up to date on current threats.
  • Crypto-malware’s main objective is to encrypt your data and then demand a ransom. Therefore it’s important that you establish a backup routine that ensures your files are kept securely in more than one location.
  • Monitor any unusual network activity. Panda may be highly skilled when it comes to stealth, but its operation is likely to lead to unusual traffic in and out of your network. Identifying this early on may allow you to limit the damage caused.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What is Hacking?

Hackers, Hacking, Hijacks, Ophtek, Security, Viruses, , , , , ,
02
Jul 2019

We all know that hacking goes on. And it certainly goes on in business. But how much do we know about it? The truth is we don’t know as much as we should.

The general consensus is that most people know what a hacker is and how they go about their business. This is why there are so many anti-hacking products available. However, using these products on their own isn’t enough to guarantee safety. In fact there is no guarantee. But you can enhance your protection significantly with an understanding of the basics of hacking. It’s important to know what a hacker is attempting to do. With this in mind you have a much better chance of preventing or resolving the hack.

What is Hacking?

Hacking causes chaos. Lots of chaos. And that’s not an understatement. But what exactly is it? It can be many things, but the basic core of hacking is to compromise devices. These can include PCs, networks and smart devices. Regardless of the device a hacker wants to gain unauthorized access to it. Sometimes this access can be used to steal data and sometimes it can be to cause sabotage. There are a wide range of techniques involved and we’ll take a look at them later.

Who are the Hackers?

The traditional image of a hacker that most people have in their minds isn’t entirely accurate. The pimply nosed, teenage hacker of cartoons may well exist in one form or another, but they’re not the only hacker out there. Due to the financial gain on offer from hacking, a number of criminal gangs are now developing sophisticated hacking methods to earn a nice income. And then there are the political gains that can be provided by hacking. There are a wide range of hackers out there, but identifying them is very difficult as they’re notoriously good at covering their tracks.

What Type of Hacks Are There?

The complexities of IT software and hardware mean that there is the potential for a variety of hacking techniques. Some of the most common methods are:

  • Ransomware: This is every organization’s worst nightmare. A relatively new form of malware, ransomware is spread through malicious emails that encourage recipients to click a link. If these links are clicked then a series of processes are executed that leave the victim’s hard drive encrypted. And the only way to decrypt the files is by paying a cryptocurrency ransom. 

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Understanding the Basics of Ransomware

Ophtek, Phishing, Ransomware, Secure Database, Secure Flashdrive, Secure Website, Security, Updates, , , , ,
07
May 2019

Ransomware has been causing trouble for businesses for many years, so it’s clearly a form of hacking which needs greater understanding to avoid its wrath.

The name ransomware sounds a little threatening and, as with all hacks, it’s hardly the friendliest of exchanges. However, whilst most forms of malware – which ransomware is a strain of – tend to disrupt day to day operations of your IT equipment by either stealing data or putting a strain on your network through DDoS attacks, ransomware is different. Not only does it disrupt your IT operations, but it also delivers a financial threat to your organization.

Due to the double whammy contained within ransomware, it’s crucial that you understand the basics of ransomware, so let’s take a quick look.

What is Ransomware?

Believe it or not, but the very first recorded ransomware attack dates back to 1989 when a hacker was able to hide the files of an infected PC on its hard drive and encrypt the file names. And, to be honest, modern day ransomware still operates in a similar, if not more sophisticated, manner.

Ransomware is a form of malware which, when executed on a user’s PC, is able to take over the victim’s system and encrypt their files. Naturally, files are essential for any organization to operate efficiently and to their maximum productivity, so this is clearly a very debilitating attack. However, to add insult to injury, the hackers then demand a ransom fee to release a key which can decrypt the files and return them to a usable state.

How is Ransomware Executed?

The most common method employed by hackers to execute ransomware on a user’s PC is through phishing emails. These emails, which appear to be genuine, are highly deceptive methods of communication which convince the recipients that they need to open an attachment bundled with the email. However, these attachments are far from genuine and the most likely result of clicking them is that malicious software such as ransomware will be executed.

How Can You Combat Ransomware?

With the average ransom fee demanded by ransomware totaling around $12,000, it’s clearly an irritation that your organization can do without. Thankfully, there are a number of actions you can take to protect your business:

  • Regularly Backup Your Data: As long as your data is regularly backed up, there should be no need to pay the ransom fee. With a comprehensive backup route in place you will be able to easily retrieve your files from an earlier restore point when they weren’t encrypted. 
  • Work with Anti-Malware Software: Most ransomware can be detected by anti-malware software, so it stands to reason that installing this software should make a significant difference to your defenses. Updating this software as soon as any patches or upgrades become available, of course, should be made a priority as it could make a real difference to falling victim to newly released ransomware. 

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 2 3 4 5 6 … 9