Cicada3301 Ransomware

A Cicada3301 ransomware attack generally gains access to a target system through one or more of the following methods:

• Spear phishing and social engineering

• Zero-day and unpatched software exploits

• Abuse of VPN, RDP, or other compromised credentials

• Deployment of custom loaders and evasion tools

To defend against these threats, we recommend adopting policies to:

• Educate your staff on the importance of cyber security

• Use strong, unique passwords

• Implement multi-factor authentication

• Remove inactive or unnecessary user accounts

• Perform regular, tested backups

• Deploy timely security patches and system updates

Following recovery from a Cicada3301 attack, Zensec advises updating your business continuity plan and reviewing key materials such as the attacker’s public PGP key used for communications to understand and mitigate future risks.

The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home

Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.

The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets

A ransomware attack presents the most significant threat to your business by:

• Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
• Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.

In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.

Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.

The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

https://www.ncsc.gov.uk/

As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.

Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.

https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/

The average cost of ransomware breaches hover around £500K, while smaller email data breaches typically incur expenses of around £50K. A critical decision emerges between preserving the environment for forensic analysis or opting for swift recovery to minimise business disruption. Delays in identifying and resolving breaches only exacerbate costs.

Cybersecurity insurance claims entail a multifaceted process, encompassing reasonable expenditures for investigation and remediation, alongside coverage for legal, business interruption, criminal liability, employment liability, and ransom policies. While the insurance industry plays a pivotal role in facilitating business recovery, cyber insurance is perceived as volatile within the sector, and many policies require meticulous validation.

Yes. There's a possibility that some of the lost data contains "Personal Data" belonging to your customers. Safeguarding such data is a legal requirement, so it's important to consider notifying the Information Commissioner's Office (ICO) about this incident, as well as your customers. https://ico.org.uk/

Your insurer or legal counsel will provide guidance on the necessary steps and how to proceed in this matter. However, Zensec has experience collaborating with insurers and legal representatives and can offer assistance in managing these relationships during this challenging period.

File encryption is the process ransomware uses to lock or scramble data on a victim’s device, making files inaccessible without a decryption key. Many ransomware strains feature cross platform capabilities and are often ransomware written in multiple programming languages to target different operating systems. Before encrypting files, attackers typically perform lateral movement within a network to identify critical assets and maximise the impact of the attack.