INC Ransom Ransomware

INC Ransom commonly gains initial access through phishing or spear-phishing emails, exploiting unpatched vulnerabilities, purchasing stolen credentials, and poor software maintenance.

Once inside, attackers move laterally using compromised servers, remote desktop software, or Remote Desktop Protocol (RDP). They escalate privileges by compromising domain admin accounts and enumerated domain groups, gaining wide network access. The ransomware often runs as a user mode service, using command line arguments to deploy the encryption of victim’s data while remaining stealthy.

To reduce risk, organisations should:

• Train staff on cyber security awareness

• Enforce strong, unique passwords

• Enable multi-factor authentication

• Regularly audit and remove outdated user accounts

• Maintain secure, regular backups

• Apply patches and updates promptly

After recovery, Zensec recommends updating business continuity and incident response plans based on lessons learned.

A ransomware attack presents the most significant threat to your business by:

• Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
• Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.

In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.

Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.

The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

https://www.ncsc.gov.uk/

As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.

Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.

https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/

The average cost of ransomware breaches hover around £500K, while smaller email data breaches typically incur expenses of around £50K. A critical decision emerges between preserving the environment for forensic analysis or opting for swift recovery to minimise business disruption. Delays in identifying and resolving breaches only exacerbate costs.

Cyber security insurance claims entail a multifaceted process, encompassing reasonable expenditures for investigation and remediation, alongside coverage for legal, business interruption, criminal liability, employment liability, and ransom policies. While the insurance industry plays a pivotal role in facilitating business recovery, cyber insurance is perceived as volatile within the sector, and many policies require meticulous validation.

Navigating the nuances requires experience, which is where Zensec comes in.

Facing genuine pressure, there's a crucial decision to make - one that could rescue your organisation from weeks of operational standstill, reputation damage, and client data loss. Yet, the probability of a favourable outcome remains slim, emphasising the importance of engaging a specialised ransomware incident response team. They are your most viable recourse for navigating a ransomware incident.

The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home

Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.

The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets

To detect threats early on targeted systems, it’s essential to monitor for suspicious activity that may signal an ongoing attack. Key steps include:

• Deploy Endpoint Detection and Response (EDR) tools to identify malicious behaviours such as attempts to encrypt victims’ data, unusual processes, or efforts to launch malicious payloads on endpoints

• Monitor network traffic closely for signs of network discovery, such as scanning tools or unexpected lateral connections between systems

• Watch for unusual login attempts, privilege escalations, or the use of compromised valid accounts

• Maintain detailed logs of file access, user authentication, and outbound traffic to detect any suspicious attempts to exfiltrate data, especially critical data

• Conduct regular audits to spot unauthorised software, unexpected user mode services, or suspicious activity involving service control mechanisms or remote access tools like Remote Desktop Protocol (RDP)

By keeping vigilant over these indicators, organisations can identify compromise early and respond before attackers cause significant harm.

Common cyber threats include ransomware, which can encrypt the victim’s data and hold it hostage during ransomware deployment. Attackers often perform internal reconnaissance to map networks and gather collected data before moving laterally across compromised endpoints. Other threats include phishing, malware, insider threats, and attacks exploiting vulnerabilities, sometimes via tools like Internet Explorer, to gain unauthorised access.