Now trending: 4 easy steps to protect against the latest in cybercrime

We “hacked the hackers.”

Earlier this year, the FBI announced they disrupted the efforts of the prolific ransomware group, Hive, by intercepting their operations through secret surveillance and by stealing digital keys used by the group to extort data. This high-profile case, saving 300 people from losing over $130 million in ransomware demands, was one of the largest cybercrime operations in recent history.

As the Department of Justice continues to fight back against ransomware attacks, they fear Hive’s operators will rebuild. Now is the time to keep your organization informed as the threat landscape continues to evolve.

Ransomware as a Service (RaaS) – a human-operated ransomware campaign

Hive targeted public infrastructure operations by infiltrating victims’ computer networks and demanding ransom. While they were responsible for most of the hacking operation, Hive sold out software to affiliates who would then hold the data in exchange for a percentage of the overall ransom. This act is known as Ransomware as a Service, or human-operated ransomware, and is actively run across the dark web.

You may be asking yourself, “Why don’t these cybercriminals just run the whole operation themselves?” It’s important to note that by utilizing RaaS, attackers can expand the scope of their criminal practice while also making it harder for authorities to identify the developers behind the operation. With a variety of revenue models, criminal enterprises are able to rent out their tools for others to conduct ransomware attacks.

There is no one specific order in which a RaaS attack occurs, as many of the attacks depend on the opportunities hackers find once they penetrate a target system and evolve based on the environment. Sometimes, if a system has multiple vulnerabilities, they will immediately deploy ransomware, while other times they need to take the time to disable security products. Either way, a RaaS attack is scalable, dangerous, and sometimes hard to even detect. So, what can we do to protect our organizations?

Mitigate the risk of ransomware

Prevention is the first step to successfully evading a ransomware attack. Proactively creating an effective security strategy is imperative to warding off cybercriminal activity. These practices can keep you on track to defend against cyber threats:

1. Keep software current

Most of the time legacy software no longer receives security updates, leaving your applications and operating systems vulnerable. Keeping software up to date gives you a fighting chance against an attack.

2. Implement Active Directory security

Active Directory is a cloud-based service that allows your employees to securely access internal and external resources. This centralized management system is a primary target for ransomware attackers because it offers access to vital resources and data. By using network segmentation to secure areas within Active Directory, you can limit potential damage from a ransomware attack.

3. Back up your data

Make sure your critical systems can be easily restored after an attack. Securing a backup is just as important as securing the data itself. Begin performing regular backups and ensure your recovery strategy includes multiple copies of backups stored in isolated locations.

4. Establish trusted access with multi-factor authentication

Multi-factor authentication, or two-factor authentication, creates a barrier by protecting important credentials and limiting access to company resources. With more complex gateways and reduced access, you can decrease the likelihood hackers will be able to break through the required combination of factors during authentication.

As the cybercrime industry continues to grow, organizations must counter the threat of ransomware by making sure critical parts of the business are protected. That’s where we come in.

Simplify and prioritize your security strategy

Ransomware attacks can happen to anyone. Strengthening your security posture while educating your employees on how to avoid falling victim to malicious content is a great place to start. SHI can work with you to establish a framework to prevent attackers from getting through to your critical data. Our experts can also work with you to help remediate damage and restore systems if it’s already too late.

Contact your SHI security experts to learn more about how to protect your organization from Ransomware as a Service.