Chips from the Quarry

This is an update to my May 2016 article on Ransomware. Ransomware has shifted over the past four years from locking down data and threatening to keep it locked up or even to destroy it pending receipt of an untraceable payment. Ransomware today does this and also exports a copy threatening to expose the data. This is generally more of an issue for businesses than individuals.

Payments by individuals to release their data continue to run $300 to $400. But businesses and government agencies have paid hundreds of thousands. On June 26, UC San Francisco confirmed that it paid $1.14 million after ransomware locked down several of its School of Medicine servers. Full disclosure: While I recently retired from UCLA, this article is based on publicly available information.

The UCSF ransomware attack used NetWalker. This malware was first noted in 2019 and has been active in attacks at least from March 2020. A number of these attacks have been against medical institutions including those like UCSF heavily involved in COVID-19 research and treatment. NetWalker first exports a copy of the data, then removes shadow copies (also called snapshots) and encrypts the compromised data. So, even if the target organization quickly discovers and halts the encryption, they would not be able to restore it from the now-useless shadow copies, and the hackers would already have copies.

The operators of NetWalker then reach out to the victim and demonstrate that they have copies of the data by pointing the victim to a location on the dark web where a partial copy can be viewed. Once payment is received, often using untraceable Bitcoin, the hacker “returns” their copy of the targeted data and provides the victim with the necessary instructions to unlock it. The hackers are generally true to their word as trust is critical to the success of this RaaS (Ransomware as a Service) business model.

While the FBI discourages organizations from paying the demanded ransom, it recognizes that at times when faced with “an inability to function,” payment might be the only option, and “victims should first evaluate all options to protect shareholders and other impacted parties.” For a statement from UCSF on the attack, see https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf

In most cases, ransomware gets onto your computer through email attachments or websites that you visit. To lessen the likelihood of becoming a victim, follow standard, safe computing practices, including deleting suspicious emails, not clicking on links unless certain that they are safe, staying away from dangerous websites and maintaining current antivirus software. Do not let your guard down.

Even if careful, you may still be a victim. So, be sure to regularly back up your data to devices physically separate from your computer. Also, create and maintain a recovery drive so that, if necessary, you can reestablish a clean computer onto which you can reinstall your programs and download your backed-up data. While this will not be quick or fun, it is best to be prepared. Not sure how to do this? See https://support.microsoft.com/en-us/help/4026852/windows-create-a-recovery-drive