We know that the protection and security of business activities and processes are of paramount importance for a company. This is because, in addition to cyber invasions being vastly frequent in the virtual space, they also offer several problems for a company, especially in the case of data leaks – whose action is intolerable by LGPD rules, for example.

For this reason, we understand that virtual attacks are actions provoked by cybercriminals, who seek to steal business and customer data in order to use them for illicit purposes. Therefore, it is important to know how to prevent cyberattacks and how to better protect our systems from cybercriminals.

Do you want to learn more about it? So, keep reading our post and get all your questions answered.

What are the consequences of cyberattacks for companies?

As we all know, the importance of knowing how to prevent virtual attacks in a company is crucial, as we are not only dealing with sensitive internal data, but also with our customers’ data.

Thus, we can predict some negative consequences for an organization as a result of the virtual attacks. Take a look at them:

1. Unstable systems

In general, one of the issues that we need to take into account as a consequence of virtual attacks is the instability in the entire infrastructure of the company. In other words, this can mean weaker and slower systems, causing processes and activities to be interrupted so that the repair actions themselves can be initiated.

This process complicates the routine of work activities, disfavoring the quality and deadline for products and services to its end customers.

2. Reduction of customers

As a result of a completely inefficient system, we ended up noticing the loss of customers in the medium term. Customers dissatisfied with products and services offered by a company tend to cancel contracts immediately, generating even more losses for the organization.

That’s because employee and customer data can be exposed, which tarnishes the brand’s reputation and makes it less competitive.

3. Increasing costs

If computational and technological issues turn out to be frequent, repair and maintenance costs will also be higher.

This is because criminal attacks – when carried out efficiently – generate continuous losses, leading to the contracting of outsourced personnel for performing preventive maintenance and monitoring, in addition to the purchase of new equipment, software, and other items to stabilize internal systems.

The 4 most common virtual attacks on companies

Now that you know the concept and consequences of cyberattacks, check out the ones that occur most often in the business environment:

1. Phishing

In general, phishing is extremely well-known for being basically a strategy to clone pages, websites, messages, among others. The criminal who uses this practice seeks to win customers by having them send personal data, thinking that they are getting involved with reliable companies.

A practical example of this type of virtual attack is when we regularly see some internet pages – be it from banks, streaming services, e-mail providers – asking for personal data in exchange for benefits and advantages.

2. Ransomware

When dealing with virtual attacks, one of the most feared is, certainly, ransomware. In case you do not know, this type of attack is nothing more than an intelligent way to hijack sensitive data and information, asking for their release.

In practical terms, it can all start with malicious advertising, a social media trigger, or even a fake message.

After a certain employee of the company downloads a file with ransomware, the malware already begins to work on the computer system.

As soon as it is installed, the ransomware encrypts data and allows criminals to enter the company’s virtual systems and start browsing folders and documents, looking for personal information, data and bank accounts, strategies, among others.

When this occurs, the related processes for preventing virtual attacks become much more difficult.

3. Spear Phishing

Spear Phishing is nothing more than another type of Phishing, however, it is focused on specific companies and employees who work in the virtual environment.

Thus, we consider that it is an invasion segmented by the criminals themselves, having techniques, devices, and tools of social engineering to elaborate deceptive schemes and share them as a completely harmless email, website, process, or even a downloadable file.

4. DDoS

Currently, DDoS is considered one of the most powerful virtual attacks. This is because it is simply a “mix of actions” that are directed exclusively to the companies’ servers. In practice, it is totally controlled through a master computer, which in this case, would be the criminal behind the action.

With this, it works as if it were a type of system completely secure for the victims, and from there, it offers space for hackers and cybercriminals to exploit vulnerabilities to invade the virtual environment of companies.

Thus, one of the symptoms that the system itself can show is its poor performance.

How to avoid virtual attacks?

After understanding the seriousness of virtual invasions, we can now think of efficient ways to protect ourselves from these possible attacks:

1. Using strong passwords

One of the first tips is to have the responsibility and awareness to create increasingly strong passwords, and preferably they should be different between each account. This makes access by cybercriminals much more difficult, since complex passwords end up not being deductible.

The greater the importance of a given systemic process, the more complex the password must be. Examples: bigger passwords for banking processes and applications, less complex passwords for internet login, among others.

2. Using a good antivirus

There are several efficient antiviruses on the virtual market. So, search for the one that best fits your needs, taking advantage of all its benefits and ensuring that it understands all the fields of protection your business needs.

3. Relying on specialized security companies

If your company does not know where to start or does not have a more complete idea of the security processes its working activities must have, it can be crucial to have the support of a company specialized in this subject. Therefore, look for a trustworthy brand, which has experience in the subject and an excellent reputation in the market.

In addition to your virtual information being under the care of highly trained specialists, you will have even more time to focus on more important business activities.

Conclusion

As we have seen, virtual attacks are extremely frequent and must be a factor to be taken into account by companies that wish to obtain excellence and quality in the market.

Anyone who works with technology has certainly heard of or uses Microsoft Exchange, Microsoft’s server solution for email and calendar. Exchange is used worldwide by companies of all sizes, being preferred for its versatility and ease of use, and billions of electronic messages pass through it daily. However, even with all these advantages, Exchange is not free of flaws.

At the beginning of March this year, the giant creator of Windows released emergency patches for zero-day vulnerabilities that were discovered and were being exploited by malicious attackers to install malicious software through Exchange. Also called ProxyLogon, these vulnerabilities allowed improper access to e-mail accounts and data extraction, in addition to lateral movement in the infrastructure, affecting other critical devices.

The four Exchange Server vulnerabilities discovered were as follows:

• CVE-2021-26855: CVSS 9.1: it is an SSRF (Server-side Request Spoofing) vulnerability, which results in HTTP requests being created by unauthenticated attackers. For this flaw to be exploited, servers must be able to accept untrusted connections over port 443.
• CVE-2021-26857: CVSS 7.8: a failure in the Exchange’s Unified Messaging Service, allowing arbitrary codes to be implemented in the server’s SYSTEM. Nevertheless, this vulnerability must be combined with others or the attacker must have stolen credentials.
• CVE-2021-26858: CVSS 7.8 and CVE-2021-27065: CVSS 7.8: Post-authentication arbitrary file write vulnerabilities in file paths.

These vulnerabilities are being exploited by a group called HAFNIUM, which operated in China and was supported by the Beijing government, and is primarily targeting organizations located in the United States. However, it is estimated that at least 10 other hacking groups are exploiting these same Exchange’s vulnerabilities in the form of ransomware or cryptoware. It is not yet known how the groups discovered the vulnerability and how the information reached the other hacker groups.

Also, automated attack scripts used in proof-of-concept have been found, which makes it possible for unknowing attackers to exploit vulnerabilities and further compromise servers around the world.

The malware developed by these groups allows the creation of a pre-authentication Remote Code Execution (RCE), which allows attackers to take full control of the servers without access to any Exchange credentials. One of the main malware created to exploit these flaws is the DoejoCrypt or DearCry ransomware.

DearCry uses a combination of AES-256 and RSA-2048 encryptions, renaming files with the .CRYPT extension, and includes a readme.txt file with instructions on how the victim can recover their original files.

If the victim has a backup of the files, one action would be to ignore the ransom requests and recover the environment. There are already records of ransom requests accounting for tens of thousands of dollars. However, even if there is no ransom payment and the files are recovered, there is a possibility that copies of the infected files are made by the ransomware, which can result in data leaks by malicious attackers.

At least 30,000 organizations of all types and sizes in the United States alone are believed to have fallen victim to campaigns orchestrated by HAFNIUM and other hacker groups based on flaws discovered by Microsoft. The total number of companies affected can reach hundreds of thousands worldwide though, as many of them are unaware that they may have been impacted by the vulnerabilities.

To try to protect Exchange users, Microsoft has launched an automated vulnerability remediation tool in March. The tool, developed mainly for customers who do not have specific security teams, allowed for a reduction in the risks associated with the exploitation of vulnerabilities while the patches were not properly applied. Microsoft has estimated that 92% of organizations applied security fixes related to the ProxyLogon vulnerabilities by the end of March/2021.

This type of attack further reinforces the need for companies to invest in specific cybersecurity teams, such as red teams, to test security controls, look for flaws and vulnerabilities, and correct them accordingly, causing the least possible impact. By structuring these teams, it is possible to ensure the proper management of assets, including e-mail servers, in addition to their respective owners. Thus, it is possible to guarantee that updates and fixes are installed as soon as they are released by the providers. The result is a reduction in the attack surface and a lower risk of cyberattacks, which can avoid millionaire sanctions provided for by data protection laws, such as LGPD and GDPR, in addition to permanent data loss, which can affect business continuity directly.

If your security team has not installed security patches yet, they must do so as soon as possible. Remember that installing updates may not ensure that your Exchange servers will not be affected by the exploitation of other zero-day vulnerabilities. Therefore, a scan of the infrastructure is recommended to find out if the environment has been affected by the exploitation of other flaws not yet discovered by the manufacturers; and if discovered, security teams should use efforts to identify and respond to any detected security incidents. This can make the difference between a minimum correction effort without major losses and loss of revenue and trust of customers, partners, and employees.