GandCrab has infected a slew of companies by targeting their MSP’s

Third-party vendor hacks, where hackers attack a company by compromising one of their business associates, have been a problem for a while. Now, the hackers behind GandCrab ransomware have gotten into the act, exploiting a year-old SQL injection vulnerability in a common remote IT support software solution to infect organizations with GandCrab through their MSP’s. ZDNet reports:

The vulnerability used by the hackers impacts the Kaseya plugin for the ConnectWise Manage software, a professional services automation (PSA) product used by IT support firms.

The Kaseya VSA plugin allows companies to link data from the Kaseya VSA remote monitoring and management solution to a ConnectWise dashboard.

Many small IT firms and other types of managed service providers (MSPs) use the two applications to centralize data from their clients and manage customer workstations from a remote central location.

Kaseya issued a patch for the vulnerability shortly after it was discovered in late 2017, but apparently, some MSP’s never installed it. Notably, the number of MSP’s who had not updated as of January 2019, when GandCrab hackers began exploiting the flaw, was relatively small in light of the popularity of the app; Kaseya reported that fewer than 130 MSP’s out of thousands were impacted. However, the first reported victim was allegedly a “local mid-sized MSP with about 80 clients,” all of whom were infected. If we were to assume that all of the impacted MSP’s had about the same number of clients, it’s easy to see the potential of this attack method to rapidly infect hundreds, perhaps thousands of new victims.

This particular incident illustrates how important it is for organizations to stay on top of software updates, as they frequently contain security patches. However, prompt software updates alone won’t inoculate against all cyber threats, and particularly not GandCrab.

GandCrab is the ransomware that keeps evolving

Cyber security is a continual game of Spy vs. Spy; the moment one vulnerability is shored up, hackers find a new one to exploit. GandCrab is the poster child for this dynamic cyber threat environment. GandCrab first emerged about a year ago and has dominated the infosec news cycle since, primarily because the hackers behind it are continually enhancing and refining it.

In addition to exploiting multiple software vulnerabilities, GandCrab has spread through JBoss and WebLogic server flaws, malicious emails, malvertising, by disguising itself as legitimate software or a cracked utility, and brute-force password-cracking attacks. GandCrab even took advantage of Valentine’s Day last week, sending out “love letters” that weren’t so loving.

Once infected, it’s notoriously difficult to rid machines of GandCrab. Bitdefender released a free decrypter for GandCrab last October, but it doesn’t work with the latest versions, starting with GandCrab 5.0.4. Some organizations turn to data recovery firms, but this can backfire. GandCrab is distributed using a ransomware-as-a-service (RaaS) model – with a twist. In addition to partnering with other hackers, GandCrab offers “discount codes” to unscrupulous data recovery firms. Here’s how the scheme works:

1. Instead of paying the ransom, an organization infected with GandCrab hires a dishonest data recovery firm to recover its files.
2. The data recovery firm logs onto its GandCrab portal, enters a special code, and pays a discounted ransom to retrieve the victim’s files.
3. The data recovery firm returns the files to the victim and charges a significant markup for their “services.” The victim ends up paying more than if they’d simply paid the ransom themselves.

Protect yourself against GandCrab

Proactive cyber security measures can prevent GandCrab infections and other cyber attacks. In addition to ensuring that your organization employs robust cyber security defenses, protocols, and procedures, vet the cyber security posture of your third-party business partners. Back up all of your systems and data so that you can restore them after a ransomware infection, another cyber attack, or a natural disaster. If you enlist the services of a data recovery firm, ask for references, do a web search on the company’s name to look for complaints, and make sure they explain how they intend to recover your data.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.

Ransomware-as-a-service lowers the bar for entering the entering the cyber extortion game

Ransomware isn’t a new threat. It first rose to prominence back in 2016, when Hollywood Presbyterian Medical Center shelled out $17,000 in bitcoin after an attack took the hospital offline. Since then, ransomware has only become more popular, especially for hackers targeting the healthcare industry or government organizations. Used to be, launching a ransomware attack required at least some technical prowess; at a minimum, hackers had to possess sufficient coding skills to write a ransomware program. Then, ransomware-as-a-service (RaaS) came on the scene and changed the game.

What is ransomware?

Before delving into RaaS, let’s quickly review ransomware. Ransomware is malware that encrypts all or part of a system, rendering it inoperable until a ransom fee, usually demanded in bitcoin, is paid to the hacker, who will then supposedly provide a key to unlock the encryption. As opposed to data breaches, which seek to steal credit card information, Social Security Numbers, and other sensitive data, ransomware doesn’t access files or data. It just locks everything down.

Paying the ransom is a dicey bet. Even after getting the money, hackers may not send a key, or they may send one that doesn’t work, or that doesn’t fully work.

What is ransomware-as-a-service (RaaS)?

At its simplest, RaaS is a criminal offshoot of software-as-a-service (SaaS), the myriad of cloud-hosted software solutions sold by legitimate vendors to both people and businesses. Just like SaaS applications, RaaS is sold on a cloud-based subscription model to anyone who can ante up the subscription fee. In some cases, there is no subscription fee; many RaaS developers use “affiliate” models where the developer collects all of the ransom money extorted by affiliates, takes out some percentage as commission, and passes on the remainder.

While RaaS applications vary in complexity, in general, they are designed to be very easy to use. They’re deployed using online portals with simple user interfaces, and no coding is required. Many enterprising RaaS “vendors” even offer online customer service, just like an SaaS developer would, to help subscribers get their ransomware campaigns up and running.

The dangers of ransomware-as-a-service

The biggest danger of RaaS is that it made it possible for just about anyone to become a cyber extortionist. Undoubtedly, the advent of RaaS contributed greatly to the exponential growth of ransomware attacks.

RaaS gives users all the benefits of a regular ransomware attack, without the hassle of writing their own code. Ransomware took off because it tends to be much more lucrative than data breaches. Once hackers breach a system and steal data, they must procure a buyer and negotiate a price. This can take time, and the data may not be worth as much as the hacker thought it would be. Ransomware and RaaS attacks come with built-in “buyers”: the businesses who are locked out of their systems, who are often not in a position to negotiate on price.

Preventing RaaS attacks

RaaS attacks are launched just like regular ransomware attacks; usually, through a phishing email. The same proactive measures employed to prevent ransomware are also used to prevent RaaS, including:

• Using email filters to prevent phishing emails from reaching employees’ inboxes.
• Using reliable anti-virus programs and other security software.
• Keeping operating systems and application software up to date.
• Educating employees on cyber security hygiene, including how to recognize phishing emails and the steps to take if they receive a suspicious email.

Organizations must also regularly back up systems and data so that they can be restored in the event of an RaaS attack, as well as have an incident response plan and business continuity and disaster plans in place. In addition to shielding your organization from some of the fallout of a ransomware attack, these measures will also mitigate the damages from other cyber attacks, real-world crime or vandalism, or a natural disaster.

The cyber security experts at Lazarus Alliance have deep knowledge of the cyber security field, are continually monitoring the latest information security threats, and are committed to protecting organizations of all sizes from security breaches. Our full-service risk assessment services and Continuum GRC RegTech software will help protect your organization from data breaches, ransomware attacks, and other cyber threats.

Lazarus Alliance is proactive cyber security®. Call 1-888-896-7580 to discuss your organization’s cyber security needs and find out how we can help your organization adhere to cyber security regulations, maintain compliance, and secure your systems.