Apt73 Ransomware

The Apt73 / Bashe ransomware typically gains entry into your system through several common methods, including:

• Phishing emails

• Malicious links

• Exploited vulnerabilities

• Remote Desktop Protocol (RDP) attacks

These infection vectors are often used in their broader ransomware campaigns targeting organisations.

To protect your organisation and minimise the risk of future infections, we recommend adopting a comprehensive approach to cybersecurity that includes:

• Employee training to raise awareness about phishing and other social engineering attacks

• Implementing multi-factor authentication to strengthen access controls

• Using strong, unique passwords across all systems

• Removing unused or old user accounts promptly

• Performing regular backups of critical systems and data

• Deploying timely updates and patches to all software and hardware

Additionally, since Apt73 / Bashe’s activities can disrupt your business processes and result in leaked data, it’s essential to update your business continuity and incident response plans to incorporate lessons learnt during the attack and recovery phases.

A ransomware attack presents the most significant threat to your business by:

• Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
• Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.

In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.

Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.

The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

https://www.ncsc.gov.uk/

As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.

Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.

https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/

Facing genuine pressure, there's a crucial decision to make - one that could rescue your organisation from weeks of operational standstill, reputation damage, and client data loss. Yet, the probability of a favourable outcome remains slim, emphasising the importance of engaging a specialised ransomware incident response team. They are your most viable recourse for navigating a ransomware incident.

The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home

Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.

Almost certainly, yes. If any of the compromised data qualifies as "personal data" relating to your customers, you have a legal obligation to inform them, particularly if there is a risk of public exposure. The loss or unauthorised access of such data may also require notification to the Information Commissioner's Office (ICO): https://ico.org.uk/.

Organisations targeted by ransomware groups like Apt73 / Bashe are often selected for financial gain, and attacks frequently impact core systems, undermining operational continuity. If your business operates within industrial sectors where sensitive data and supply chain integrity are critical, disclosure becomes even more important to maintain trust and comply with regulatory requirements.