Ransomware Beware: Crypto-Malware Attack Thwarted

Following the entry of crypto-malware into a user's account, which resulted in the encryption of several hundred company files, bit-x-bit examined the user account and computer system to determine the extent to which other areas of the computer may have been compromised as a result of the intrusion. Further ransoming of company files was halted due to a "flaw" in the crypto-malware which enabled the decryption of the files. bit-x-bit's work included the examination of the file system, registry hives/keys, active and deleted files, event logs, internet history, executables, as well as memory analysis which established that the attack was halted mid-point and limited to a few hundred files.

Recommendations and follow-up included among other actions a review of existing firewalls, aggressive auto-patching, particularly of third party applications, purchase of crypto-malware protection software, limit privileges associated with user accounts, user training on phishing and ransomware.

For information about the possible decryption of some ransomware, visit: https://www.nomoreransom.org