RansomHouse Ransomware

A RansomHouse ransomware attack generally enters a system in one of the following ways:

• Phishing attacks/emails

• Exploited vulnerabilities

• Purchased credentials

These methods often lead to credential access, which attackers use to move laterally and enable ransomware deployment within the victim network. To protect sensitive data and reduce the risk of such an attack, Zensec recommends adopting the following policies:

• Educate your staff on the importance of cyber security and the risks of non-compliance

• Use strong passwords

• Enable multi-factor authentication

• Remove old or inactive user accounts

• Perform regular backups

• Deploy timely updates to all software and systems

After recovering from a RansomHouse attack, Zensec advises updating your business continuity plan to incorporate the lessons learnt during such an attack and the subsequent recovery process.

A ransomware attack presents the most significant threat to your business by:

• Disabling your access to systems, which could hinder machinery operation or impede progress through your business processes.
• Blocking access to critical data concerning suppliers, shipments, customers, orders, or steps in your business workflow.

In the event of a business interruption, identifying your position in the supply chain and sustaining operations can be challenging. If the disruption continues, maintaining business continuity becomes critical. Once systems and data are restored, addressing backlogs and establishing future operational protocols are essential.

Ransomware ranks only behind receivership in terms of its capacity to incapacitate a business.

The NCSC is the UK National Cyber Security Centre. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

https://www.ncsc.gov.uk/

As a recognised Assured Service Provider by the National Cyber Security Centre (NCSC), Zensec provide comprehensive cyber risk management services that are designed to Protect, Detect & Mitigate cyber security threats across the UK.

Report Fraud is the UK's national reporting centre for fraud and cybercrime. Whether you have been scammed, defrauded, or experienced cybercrime in England, Wales, or Northern Ireland, Report Fraud offers a central point of contact for information on fraud and financially motivated cybercrime.

https://www.reportfraud.police.uk/https://www.actionfraud.police.uk/

The average cost of ransomware breaches hovers around £500K, while smaller email data breaches typically incur expenses of around £50K. One of the critical decisions during an incident is whether to preserve the environment, including domain controllers and command and control servers, for thorough technical analysis, or to opt for swift recovery to minimise business disruption. Delays in identifying and resolving breaches, such as tracing malicious IP addresses, only exacerbate costs.

Cyber security insurance claims involve a multifaceted process covering reasonable expenses for investigation and remediation, as well as legal fees, business interruption, criminal liability, employment liability, and ransom payments. Many ransomware groups, including those using double extortion tactics, increase pressure on victims, which can impact the scope of insurance claims. While the insurance industry plays a pivotal role in facilitating business recovery, cyber insurance is considered volatile within the sector, and many policies require meticulous validation to ensure coverage.

Facing genuine pressure, there's a crucial decision to make - one that could rescue your organisation from weeks of operational standstill, reputation damage, and client data loss. Yet, the probability of a favourable outcome remains slim, emphasising the importance of engaging a specialised ransomware incident response team. They are your most viable recourse for navigating a ransomware incident.

The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home

Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.

The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets

Yes. There's a possibility that some of the lost data contains confidential data, including "Personal Data" belonging to your customers. Safeguarding such data is a legal requirement, so it's important to consider notifying the Information Commissioner's Office (ICO) at https://ico.org.uk/ about this incident, as well as informing your customers.

Ransomware attackers often exfiltrate data before encrypting systems, threatening to publish or misuse this information if ransom demands are not met. They achieve this by following commands within the compromised environment to locate and steal sensitive files.

Your insurer or legal counsel will provide guidance on the necessary steps and how to proceed in this matter. However, Zensec has extensive experience collaborating with insurers and legal representatives and can offer assistance in managing these relationships during this challenging period, helping you maintain strong information security throughout the response and recovery process.