Categories
Security

How to protect against Labor Day ransomware attacks

On the last major American holiday, the fourth of July, IT solutions developer Kaseya announced it had become the victim of a ransomware attack — an attack that cascaded down the software supply chain, impacting more than 1,500 businesses. 

Kaseya aren’t the first and certainly won’t be the last victim of a cyberattack over the holidays. In fact, cybercriminals love to pounce when IT and security teams are out of the office for an extended time, or when employees let their guards down because they’re about to go on vacation. 

That’s why it’s important to stay alert before and during the three-day Labor Day weekend.

Weak IoT security should concern consumers, businesses as adoption increases

Labor Day weekend is nearly here, and I bet many employees’ thoughts have already turned to mini getaways, lazy afternoon binge-fests, or that one last barbeque before the weather turns crisp. Cybercriminals are banking on it, in fact, because the best time to attack is the absolute least convenient time for IT and security teams: weekends and holidays.

In fact, there’s a precedent for weekend and holiday ransomware attacks going back at least to December 2018, when cybercriminals leveled Tribune Publishing and other businesses with Ryuk ransomware on Christmas Eve. However, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint statement on August 31 warning that they have observed an increase in “highly impactful ransomware attacks” occurring over holidays and weekends in the United States over the last several months.

In the last three months alone, three massive ransomware attacks have taken place on US critical infrastructure on or leading up to holiday weekends. Just before Mother’s Day in May, cybercriminals dropped DarkSide ransomware on Colonial Pipeline, one of the nation’s biggest suppliers of fuel. After DarkSide actors gained access to the Colonia Pipeline network, they encrypted and exfiltrated the company’s data before threatening to publish it, attempting to extort them into paying the ransom. The attack resulted in a week-long suspension of operations, which led to panic-buying, price hikes, and crazy lines at gas stations up and down the east coast.

That same month, JBS, the world’s largest producer of beef and pork, was hit over Memorial Day weekend with Sodinokibi/REvil ransomware. The attack affected all US and Australian meat production plants, causing a complete halt in operations. And of course, IT solutions provider Kaseya suffered its breach and subsequent ransomware attack during the Fourth of July holiday weekend. Threat actors gained access to Kaseya’s remote monitoring and management tool, through which they deployed malicious updates to hundreds of organizations — including multiple managed service providers (MSPs) and their customers.

Ransomware has been on a meteoric rise — so much so that John Oliver devoted an entire segment of his HBO show “Last Week Tonight” to the subject last month. While Oliver blamed ransomware-as-a-service (RaaS), the popularity of cryptocurrency, and countries providing safe havens to cybercriminals as the reasons behind ransomware’s ascension, likely the answer is even more simple. Cybercriminals are opportunistic, and ransomware can easily defeat organizations when they don’t have the proper protection in place. Add to that the fact that IT is usually short-staffed over the holidays, and you have the recipe for disaster.

To avoid the fate of Colonial Pipeline, JBS, and Kaseya, take the following actions before and during Labor Day weekend:

  • Run a deep scan on all endpoints, servers, and any other connected systems to ensure there are no threats waiting to pounce when the lights go off.
  • Make an offline backup of your organization’s most critical data.
  • Run any necessary OS or software updates on endpoints to be sure that known vulnerabilities will not be exploited.
  • Employ stricter access requirements for sensitive data, such as multi-factor authentication (MFA).
  • Shut down all non-essential systems and endpoints on Friday evening.
  • Ensure there is always someone watching the network during the holiday, and make sure they are equipped to handle a sudden attack situation.

For more ways to stay safe from ransomware over the holiday weekend, check out this blog from Malwarebytes Labs: https://blog.malwarebytes.com/101/how-tos/2021/08/how-to-stay-secure-from-ransomware-attacks-this-labor-day-weekend/

For the joint statement by the FBI and CISA on increasing ransomware attacks over the holidays: https://us-cert.cisa.gov/sites/default/files/publications/AA21-243A-Ransomware_Awareness_for_Holidays_and_Weekends.pdf

And to watch the John Oliver episode on ransomware: https://youtube.com/watch?v=WqD-ATqw3js