Skip to content

79% of organizations had a ransomware attack in the past year. Are you prepared?

The frequency of ransomware attacks is increasing along with the costs to businesses. Having a plan to respond in the event of a ransomware attack is more important than ever. 

IT research firm ESG conducted a ransomware study surveying 600 enterprise IT and cybersecurity professionals across North America and Western Europe. Here’s what they found: 

  • 79% of the organizations had a ransomware attack within the past year 
  • Every sixth company gets attacked by a ransomware weekly 
  • Every eighth company gets attacked by ransomware daily 

What’s the impact of a ransomware attack? 

When an organization suffers a ransomware attack, there are many negative consequences beyond the financial losses. According to the ESG study, victims of ransomware attacks suffered the following: 

  • 40% of the organizations reported a financial loss 
  • 50% reported data loss  
  • 32% reported reputational damage 
  • 39% reported a direct impact on employees, customers, and partners 
  • 30% reported compliance exposure 

As an IT Manager or a cybersecurity leader, can you bear these consequences in the organization?  

What’s the best ransomware recovery strategy?

 

Given the high frequency of these attacks, you need a recovery strategy to mitigate damage to your organization. A successful recovery strategy can help you recover data quickly to minimize the impact on operations. 

ESG research recommends cloud backup as the best practice for cyber recovery. The survey also found that the best-prepared organizations are the ones that have a cloud backup solution. 

How Keepit can play a role in your ransomware recovery strategy

If your organization is ready to get serious about protecting SaaS data and is looking for a solution, ESG recommends that you take a good look at Keepit.

Kerry Dolan, Senior IT Validation Analyst, ESG

Keepit offers an extremely simple, secure SaaS data protection solution that uses a proprietary object store to keep data protected and tamper-proof in its independent, redundant global data centers. With automatic snapshots, no backup scheduling is required, and retention is easy to configure and manage according to your compliance requirements.

Each daily snapshot is permanently preserved so that victims of ransomware can simply roll back to a point in time before the attack and restore their data in place.

Bottom Line

With the high frequency of ransomware attacks, IT leaders should focus on protecting their organization’s mission-critical data and digital assets by preparing and practicing to recover it quickly and completely. ESG recommends cloud backup as the best practice for cyber recovery. Keepit helps you in the cloud backup strategy with a backup that is simple, secure, and fast.   

Keepit backup is: 

Cloud independent – With Keepit, data is stored in a vendor-neutral cloud instead of public platforms like AWS, making Keepit a true third-party backup. 

Immutable – preserves your data permanently, even for data types that the source SaaS applications do not protect. 

Innovative storage architecture – allows super-fast data restores and inspection while giving you predictable restore performance and a fixed storage cost. 

To learn more about how Keepit secures data, read our security guide. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Keepit
At Keepit, we believe in a digital future where all software is delivered as a service. Keepit’s mission is to protect data in the cloud Keepit is a software company specializing in Cloud-to-Cloud data backup and recovery. Deriving from +20 year experience in building best-in-class data protection and hosting services, Keepit is pioneering the way to secure and protect cloud data at scale.

UnderDefense becomes a member of MPN (Microsoft Partner Network)

UnderDefense enters strategic partnership with Microsoft Azure

Companies in various industries increasingly choose cloud as a primary location to store data or plan to migrate to the cloud. Such infrastructure is much more flexible for data modernization and analysis. But also among the main reasons for such transformation in the first place is cybersecurity and data protection.

UnderDefense selected Azure as main cloud platform to support Enterprise customers and becomes part of MPN (Microsoft Partner Network) to deliver better Incident Response and Managed Security Services.

Current UnderDefense partnerships, certifications and competence include also GCP and AWS where we serve our SMB &customers from Technology domain. The hassle we are going to solve for our Enterprise customers as part of their Cyber Resilience control include:

  • Onboarding new customers to the UnderDefense service in minutes
  • Implement MITRE ATT&CK detection coverage in a mixed Cloud environment
  • UnderDefense investigation of Microsoft Defender ATP, LogicApps SOAR and Sentinel SIEM for alerts and telemetry
  • Minimization of false positives and Massive automation with SOAR Provide on-demand
  • Inicdent Response & Cloud based Digital Forensics (C-DFIR)
  • 24×7 Cyber Incident Response Team (CIRT)

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About UnderDefense
UnderDefense, a globally top-ranked firm by Gartner and Clutch, provides cyber resiliency consulting and technology-enabled services to anticipate, manage and defend against cyber threats. We empower clients to predict, prevent, detect, and respond to threats.

Risk-Based Vulnerability Management Challenges & Solutions to Overcome Them

In today’s cyber landscape, efficient vulnerability management is a top priority. Organizations cannot afford to take chances with cyber-attacks on the rise and the increasing sophistication of malicious actors. Unfortunately many hold the wrong perspective of vulnerability management (VM) which can cause  recurring security challenges and  for organizations. 

In many cases targeted threat actors or untargeted ransomware attackers take advantage of an organization’s inaction. They infiltrate a network to disrupt operations, primarily for financial gain. No company should handle these issues with a kid’s glove. Looking at today’s threatscape, RBVM is critical in knowing how to combat the menace of cyber threats. 

Common Vulnerability Management Challenges & a Lasting Solution

1. Insufficient Asset Inventory: We all know how challenging it is to protect what you can’t see. One major factor facing most organizations is the incomplete asset inventory data at their disposal. At best, storage often occurs in obsolete spreadsheets or other methods. Unfortunately, the result is often incomplete or incorrect data. What organizations require is concise and up-to-the-minute data on their assets.

A company that utilizes robust asset inventory management solutions is on the road to successful vulnerability management. Asset inventories help to determine the scope of potential risks, and how to patch them safely. In-depth context on a company’s assets produces a formidable vulnerability analysis and prioritization. On the other hand,  insufficiently detailed asset profiling can make the process rather cumbersome. 

2. Inaccurate and Inefficient Prioritization of Vulnerabilities: Undoubtedly, most IT environments of organizations experience a large number of vulnerabilities. The threats range in scope and potential damage- which puts an arduous task on the security team to patch or fix. An essential factor to consider remains the exploitation or value of an asset. Therefore, a risk-based prioritization into low, medium, high, and critical-risk vulnerabilities becomes expedient. 

Every organization needs to check the connection between vulnerabilities and the presence of public exploits. Also, consider any attack with the sole aim of detecting the vulnerability of a network. Such actions help to focus more on the severity and urgency of every vulnerability. 

3. Difficulty in Detecting Vulnerabilities: Many companies use vulnerability scanning to identify weaknesses within a network to prevent the exploitation of their infrastructure. Unfortunately, while the method is suitable, it is not the most effective. Moreover, vulnerability scanning can come with specific challenges.

First, it disrupts or disables operations completely. Organizations often work with integrated systems; such disruption leads to the eventual tripping of the entire system infrastructure. Another challenge comes in the form of huge gaps between scans. The infrequency of scans during downtimes makes them out at the end of each process. This can lead to  an incomplete picture of the actual vulnerability. Furthermore, there’s reduced accuracy during the process since vulnerability scanning comes with settings. These settings help to decrease the function or force of a scan. 

What organizations need is a robust identification and tracking mechanism for vulnerabilities. Multiple agencies and services provide  penetration testing. Such platforms help to safely discover vulnerabilities within an organization. 

4. The Use of Outdated Scanning Methods: One VM challenge is the use of outdated scanning tools or manual scanning. Such methods include authenticated scanning, unauthenticated scanning, and agent-based scanning. 

Manual processes are time-consuming, thereby increasing the effort to perform scans. The outcome is a decline in accuracy and effectiveness since the  scan report  results are often redundant and inaccurate, with higher false positives and human errors.

5. Lack of a Unified View of Vulnerabilities: Organizations use various methods and scanners to detect vulnerabilities. Some of these include agent-based, authenticated, and unauthenticated scanning. The challenge is that each operates on its own. As a result, this leads to treating each vulnerability in disconnected systems. The inability to unify all vulnerabilities from multiple sources into a central system makes tracking and remediation difficult. Instead, what most companies need to gun for is a single unified view of vulnerabilities.

6. Untimely Remediation of Vulnerabilities: The remediation process of most organizations is a slow one. It takes an average of 100 days to remediate a vulnerability. The consequence is that it gives attackers a large window of opportunity to operate. However, software patching occurs daily or weekly, as the case may be. It is a complex and time-consuming process.

 Remediating vulnerabilities comes from patching, updating software, and bug fixes . The challenge is that many organizations’ pace with addressing or fixing vulnerabilities is often relatively slow. Effective vulnerability management involves patch automation controlled by a team of experts.

7. Lack of Vulnerability Asset Mapping: Many organizations fail to list all assets at their disposal, making it challenging to match vulnerabilities during analysis. However, the process is a must to get them prioritized for remediation. Vulnerability asset mapping helps to determine the attack surface of an organization. Such information is vital in providing visibility to the vulnerability landscape and allows the security team to gain a clear idea of the affected assets.

8. An Episodic Approach to Vulnerability Management: The vulnerability management approach for most companies is sporadic. As a result, controlling the flow of vulnerability becomes challenging. A progressive approach is a prerequisite to reducing vulnerability management risks. It would certainly not do any good to work with a backlog of security issues and incur more vulnerability debt. Instead, the goal should be to improve and harden the security posture.

Tracking the VM Process

Most organizations conduct one-time vulnerability assessments due to the manual effort involved. This process challenges the security team in managing the entire VM process from  beginning to the end. One of the reasons is that it’s hard to keep track of the entire process whether it’s making patches or keeping track of asset inventories, vulnerabilities, and remediation. It also entails updating information in real-time, refreshing relevant data, and more; the entire manual process can be quite cumbersome.  

Final Thoughts 

As much as we agree that VM challenges are part of the VM process, they shouldn’t be recurring. Where they are, organizations must take action. These challenges become easy to overcome with improved security tools and services.  Accurate Risk-Based Vulnerability Management requires contextualizing vulnerability intelligence (VI) to an organization’s assets that is comprehensive, detailed, and timely. 

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

The Curious Consequences of the Crypto Collapse

Let me state from the start that I am crypto agnostic. I have no strong feelings about whether crypto should or will succeed, fail, or take some third track. What I do feel strongly about is that crypto and the technologies behind it are fascinating, whether as tomorrow’s emerging breakthroughs or today’s false promises (or both).

So it has been interesting to observe the continuing crypto collapse, which has seen coin prices plummet for months amid more than a few high-profile failures. Crypto evangelists are circling the wagons (while secretly sweating). The naysayers, meanwhile, are celebrating the situation as proof they were right all along (while doubting this is actually the end of crypto). No matter which side you fall on, right now looks like a big moment in crypto history – and what happens next is anyone’s guess.

My powers of prognostication are no better than anyone else’s. But as a close crypto observer, I have noticed some odd effects during the recent downturn that, in one way or another, will undoubtedly impact the future of crypto. I want to use this blog to highlight a few of those, then turn it over to the community to unpack what exactly they mean.

Cyber Criminals Take Downturn in Stride

The value of Bitcoin has dropped more than 60% so far in 2022 and plunged 32% in just June. Since Bitcoin is the preferred way to pay ransomware demands, you might expect the huge price drop to impact the criminals behind these attacks. And you would be right – but the results hardly inspire optimism.

Cheaper Bitcoin simply leads attackers to demand more of it – no surprise there. Price drops are bad for people who treat Bitcoin as an investment. But for those who treat it as a fiat currency, the exchange rate hardly matters at all. Ransomware remains as lucrative as ever.

So how to explain the 20% drop in ransomware recorded between Q1 and Q2 2022 (basically in parallel with the crypto collapse)? The disruption of the Russian ransomware gang Conti accounts for a lot. There has also been a recent rise in business email compromise (BEC) schemes, which forgo cryptocurrency but, more importantly, yield higher profits historically.

Crypto volatility creates some extra challenges for hackers, certainly. But recent history proves that swings (or collapses) in crypto will not lead to fewer attacks or lesser losses. As often happens in cybersecurity, the risk changes, but it does not go down.

Crypto Technology Comes Under Scrutiny

Crypto has always had its skeptics, of course, but they are suddenly getting a lot more attention, credibility, and funding than they did before. Just one example is research highlighting numerous flaws in blockchain technology and the philosophy behind it. The research proposes several ways that blockchains are neither decentralized nor immutable, as their proponents claim. The research also shows that 21% of blockchain nodes (the infrastructure of the blockchain) are running an old, vulnerable client, creating a target so obvious it begs to be attacked.

People have criticized crypto in the past – since its inception. But those criticisms were often economic or ethical in nature, not technological, and they were rarely given a platform on NPR (or other major outlets) like the research above. People debate the value of investments all the time. But if the crypto conversation starts to focus on the strengths and weaknesses of the underlying technology instead, as appears to be the case, it could change the trajectory dramatically.

The Resistance Gets Organized and Aggressive

A group of 1500+ computer scientists, engineers, and technologists sent a letter to Congress in early June questioning the value of blockchain technology and calling for stricter crypto regulation. They don’t mince words; the letter paints a bleak picture of the crypto ecosystem and suggests that things will only get worse.

What effect, if any, this will have on Congress is unknown. Still, the size of the group behind the letter along with the strength of their language suggests that opposition to crypto is getting larger and more organized. And coming from some interesting sources; the blockchain research highlighted above was sponsored by DARPA. It’s too conspiratorial to call this “the establishment” fighting back against the crypto insurgents, but it’s nonetheless interesting to consider how the Defense Department and the government more broadly might think about blockchain moving forward. If they’re not on board, will anyone else be?

It’s too early to tell. And the same goes for crypto as a whole, which could conceivably bounce back from this dip to reach new highs…or crash and burn completely. Either way, crypto will face stronger opposition and possibly more regulation from here out.

As a crypto agnostic, I think that’s the best possible consequence of the crypto collapse. Good ideas will survive scrutiny and skepticism, while bad ideas will get exposed and eliminated. Whatever remains of crypto and blockchain after that is, hopefully, the best it has to offer. I, for one, can’t wait to see what that looks like.

#blog #crypto #ransomware #bitcoin #fintech #DARPA #regulation

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

ESET Research discovers new threat to Mac users: CloudMensis spies on them in targeted operation

  • ESET researchers discovered a previously unknown macOS backdoor that spies on users of compromised Macs.
  • ESET has named the malware CloudMensis because it uses cloud storage services to communicate with the operators and uses the names of months as directory names.
  • This macOS malware uses cloud storage as its Command and Control channel, supporting three different providers: pCloud, Yandex Disk, and Dropbox.
  • CloudMensis can issue 39 commands, including exfiltrating documents, keystrokes, and screen captures, from compromised Macs.
  • Metadata from the cloud storage services used reveal that the first Mac compromised by this recent campaign was on February 4, 2022.
  • The very limited distribution of CloudMensis suggests that it is used as part of a targeted operation.

BRATISLAVA, MONTREAL — JULY 19, 2022 —  ESET researchers discovered a previously unknown macOS backdoor that spies on users of compromised Macs and exclusively uses public cloud storage services to communicate back and forth with its operators. Named CloudMensis by ESET, its capabilities clearly show that the intent of the operators is to gather information from the victims’ Macs by exfiltrating documents and keystrokes, listing email messages and attachments, listing files from removable storage, and screen captures.

CloudMensis is a threat to Mac users, but its very limited distribution suggests that it is used as part of a targeted operation. From what ESET Research has seen, operators of this malware family deploy CloudMensis to specific targets that are of interest to them. The use of vulnerabilities to work around macOS mitigations shows that the malware operators are actively trying to maximize the success of their spying operations. At the same time, no undisclosed vulnerabilities (zero days) were found to be used by this group during our research. Thus, running an up-to-date Mac is recommended to avoid, at least, the mitigation bypasses.

“We still do not know how CloudMensis is initially distributed and who the targets are. The general quality of the code and lack of obfuscation shows the authors may not be very familiar with Mac development and are not so advanced. Nonetheless, a lot of resources were put into making CloudMensis a powerful spying tool and a menace to potential targets,” explains ESET researcher Marc-Etienne Léveillé, who analyzed CloudMensis.

Once CloudMensis gains code execution and administrative privileges, it runs a first-stage malware that retrieves a more featureful second stage from a cloud storage service.

This second stage is a much larger component, packed with a number of features to collect information from the compromised Mac. The intention of the attackers here is clearly to exfiltrate documents, screenshots, email attachments, and other sensitive data. Altogether, there are 39 commands currently available.

CloudMensis uses cloud storage both for receiving commands from its operators and for exfiltrating files. It supports three different providers: pCloud, Yandex Disk, and Dropbox. The configuration included in the analyzed sample contains authentication tokens for pCloud and Yandex Disk.

Metadata from the cloud storage services used reveal interesting details about the operation, for example that it started to transmit commands to the bots as of February 4, 2022.

Apple has recently acknowledged the presence of spyware targeting users of its products and is previewing Lockdown Mode on iOS, iPadOS, and macOS, which disables features frequently exploited to gain code execution and deploy malware.

For more technical information about CloudMensis, check out the blogpost “I see what you did there: a look at the CloudMensis macOS spyware” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

Outline of how CloudMensis uses cloud storage services

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Need help? Our team is just a message away