Posts

Emotet malware strikes in a cyber attack

UHS Cyber Attack and the Rise of Ransomware

The major hospital and health care network Universal Health System was hit by potentially the largest cyberattack in U.S. history so far.

The computer infrastructure of Universal Health Systems (UHS) showed signs of failure on Sunday morning throughout the United Kingdom, Puerto Rico and the United States. The attack took down UHS’ network cross the United States. As the situation worsened patients have been moved to different rooms and facilities. Appointments and test results were also delayed as a consequence of the attack.

The attack encouraged one the UHS hospitals to move towards an all paper filing system, according to some individuals familiar with the situation. UHS operates more than 400 hospitals and facilities with over 90,000 employees.

The fortune 500 company said that there was no evidence that patient or employee had been misused, stolen or copied. Bleeping Computers, the online publication that first reported on the attack, spoke to employees who determined the ransomware attack had the tell-tale signs of the Ryuk virus.

What is Ryuk Ransomware?

Justin Heard, Director of Security, Intelligence and Analytics at Nuspire, noted that up until recently, Ryuk was used solely to target financial services, but over the last several months Ryuk has been seen targeting manufacturing, oil and gas, and now healthcare.

Ryuk is a type of ransomware that uses encryptions to cut off access to systems, files, and devices until the victim pays ransom. The ransomware is placed in a system by other types of malware.

The most common is TrickBot, however Ryuk can also gain access through Remote Desktop Service.

The Ryuk ransomware takes payments through Bitcoin and instructs victims to deposit the money in a particular Bitcoin wallet. The demand is usually between $100,000-$500,000 in Bitcoin depending on the conversion price of the cryptocurrency.

Once installed, the Ryuk malware spreads through the network infecting as many servers as it can.

The Ryuk Attack

An employee told Bleeping Computer that, during the cyberattack, files were being renamed to include the .ryk extension. This extension is used by the Ryuk ransomware, reports BleepingComputer. “Another UHS employee told us that one of the impacted computers’ screens changed to display a ransom note reading “Shadow of the Universe,” a similar phrase to that appearing at the bottom of Ryuk ransom notes. Based on information shared with BleepingComputer by Advanced Intel’s Vitali Kremez, the attack on UHS’ system likely started via a phishing attack,” BleepingComputer says.

An employee of UHS told Bleeping Computer that files were being renamed to include the .ryk extension as the cyber-attack took place. Based on information provided to Bleeping Computers the attack on UHS’ system began as a phishing attack.

Many health care workers posted notes about the situation at various Universal Health facilities in a Reddit thread. One in Florida noted that it was “a hot mess in the ER today.” Ambulances with heart patients were being diverted because the facility’s catheterization lab was down, the person posted.

Another nurse in a facility in North Dakota said computers slowed down and then didn’t turn on Sunday morning.

Ransomware & Medical Facilities

Hospitals are high valued targets for cyber attackers because they hold incredibly valuable personal information that can be sold on the dark web or used as leverage for a ransom payment.
A ransomware bug called WannaCry was used in 2017 to target Microsoft Window’s operating system at the time. It spread through an exploit named EternalBlue and reached the U.K.’s National Health System.

The WannaCry ransomware impacted 80 medical facilities although there were no reported deaths as a result.

Hospitals are the perfect target for threat actors because they rely on critical and immediate care to assist patients in need. That means solutions and treatment are time sensitive and dependent on drug history and other medical information to proceed. Without this information patients can suffer or die. This makes hospitals likelier to pay a ransom instead of risking lives by delaying.

Ransomware and other Businesses

Hospitals are not the only industries suffering from malware. We’ve covered cases of schools, businesses and entire cities being impacted by ransomware attacks.

In October, 2019 the technology company Pitney Bowes, was attacked by malicious ransomware. Its shipping and mailing services were compromised and disrupted client access to their services.
Ransomware is a growing problem as over 140 attacks were reported in 2019 targeting state and local governments as well as health care providers like UHS.

As we’ve shown, hospitals and the health services industry are prime targets but are not the only targets. For this reason many businesses are adopting Managed IT services to help deal with this rise in cybercrime.

Emotet Malware

In July 2020 there was a rise in Emotet malspam campaigns. Emotet is a banking malware that infects systems to try and steal sensitive financial information.

The Emotet Malware was first identified in 2014. It was originally just a banking malware. However, later versions were designed to include spamming and malware delivery services. This made it more dangerous and easier to spread.

These campaigns infected victims with Trickbot and Qbot malware. If you’ve been paying attention, you’ll recognize TrickBot malware from earlier.

Emotet is a Trojan that spreads mainly through spam emails. These malicious emails might take on the disguise of legitimate emails. As a result they often persuade users to click on a link or button.
That’s how most likely how the UHS attack took place. As we’ve seen with Emotet, these ransomware attacks only get more sophisticated and more popular as their success rate increases.
Ransomware has become the most popular form of attack growing 350 percent since 2018. What’s more, ransomware from phishing emails like Emotet have increased by 109 percent since 2017.

What should be Done?

There are researchers that are calling for a ban on paying ransomware. However, that recommendation is controversial and not mainstream. They argue that refusing to pay ransomware reduces any incentive a hacker might have and will reduce the rise of malware hacks.

This solution doesn’t address the fact that hackers who gain access to company data can still use it.  Cyber attackers can sell it on the black market, or continue to freeze should the ransom remain unpaid.

The only real solution so far is to educate and train employees as much as possible to avoid malicious or fraudulent email scams.  IT services companies often play a role in educating their clients on these matters but it falls on the business to teach personnel of the risks.  IT consulting can benefit many smaller and medium sized companies who aren’t equipped with the appropriate tools needed to combat these threats.

Even the most dedicated cyber security team with the most sophisticated digital tools will mean nothing if an employee opens the wrong email, clicking on an infected link. Companies that don’t dedicate the time to training their employees turn them into liabilities and the more vulnerable your employees, the more vulnerable the company.

A data breach could cost your business everything if you don't have the correct remote cyber security measures in place.

The Cost of a Security Breach: Is it Always Business As Usual?

What is the Cost of a Cyber Breach?

A hacker stealing your information during a cyber breach is a bad situation. However, a hacker stealing your business’s information might be worse.

Running a successful business always implies a degree of risk. However, in today’s day and age, companies are finding themselves encountering a form of risk that often goes unnoticed: cyber attacks.

If a cyber criminal launches a cyber attack on your business the damage could be irreparable.

Think about it. A cyber attack leads to a huge loss of profit and productivity but thousands of dollars in fees. Not to mention the loss of business that follows.

The average cost from damage or theft of IT assets and infrastructure increased from $879,582 in 2016 to $1,027,053 in 2017.  The average cost due to disruption to normal operations increased from $955,429 to $1,207,965.

Even worse than this, according to Inc. 60% of all small business fail within 6 months due to cyber attacks.

41 percent of companies have over 1,000 sensitive files open to everyone, according to research by the Varonis Data Labs.

How Do Cyber Attacks Work?

Cyber attackers look for unsecured folders the moment they gain access to a network. Why? Because folders open to global access groups.  Global access groups include everyone, domain users and authenticated users. This gives them easy access to business plans, customer and employee data, credit card information and much more.

Overexposed data presents a huge risk to businesses of all sizes regardless of the industry or location. For small and medium size businesses, however, it could mean millions of dollars in losses, reimbursements, and legal fees that end up bankrupting the business.

Small businesses are often targets of cyber crime, yet invest less than $500 in cyber security.

What Are The Most Common Types of Attacks?

 

In the Ponemon study, 48 percent of small and medium sized businesses (SMB’s) report social engineering/phishing were the most common kind of attack.

54 percent of respondents in the study claimed data breaches occurred due to negligent employees or contractor.

Cyber Attacks in Remote Work

Phishing attacks:

Phishing is considered the top cause of data breaches. Hackers send apparently legitimate emails with dangerous links or attached documents. When a target clicks on the link or opens the attachment, a hacker gains access to their device. The link will contain malware or ransomware that corrupts and freezes important data.

Employees might work on personal devices which might not have the same protections as a company owned computer. As a result, the personal device might be more vulnerable to malware and other viruses. Make sure you use a company issued device whenever possible. Not just for the sake of the company, but for the sake of the remote employee as well. No one benefits when a device is breached.

Insecure Passwords:

53 percent of people rely on memory to keep track of their passwords. Therefore, they choose passwords that are easy to remember.  That makes it easy for a hacker to decipher an employees password by simply going through social media. It allows hackers to even access various accounts if the employee is using the same password.

Wi-Fi Security in a Remote environment: 

In an office environment, IT departments can protect employees and control network security. In a remote environment, however, employees probably don’t have the same protections. Hackers exploit networks with WEP security protections rather than WPA2, for example.  WEP settings are the standard Wi-Fi protection for average users.Even inexperienced hackers can download tools that allow them to break through this type of network.

Remote workers don’t realize how insecure they are until something happens. All remote employees need to consider what type of network they have at home before accessing company data. Using a VPN (virtual private network) also helps in protecting against certain types of attacks on remote workers.

During the lock-down period in 2020, there were record spikes in cyber attacks on remote workers. Hackers leverage remote workers’ devices to gain access to systems that would otherwise be more secure.

The Damage You Don’t See

Even assuming an SMB survives a cyber attack financially, the reputational damage would be just as catastrophic.

Security is everything in a business, both internally and to prospective clients. If a cybercriminal hacks your business, exposing your data, no one will want to take the risk of doing business with your company. The perception that your business is unreliable or even a liability can destroy your credibility and tank your business completely.

In the worst of scenarios, you may not even notice you’ve been breached for weeks or months, at which point recovery will be next to impossible.

One of the reasons so many businesses fail is because they have an inadequate strategy for managing cyber attacks.  SMB’s may have fire walls, anti-virus software, malware protection, and encryption but they don’t plan for the event of an actual breach.

While businesses focus on keeping attackers out, the actual data itself remains accessible and vulnerable to attack.

Businesses are losing more records in a data breach. Companies represented in the Ponemon study lost an average of more than 9,350 individual records as a result of a data breach in 2017, an increase from an average of 5,079 in the 2016.

A business needs a fully redundant system to access their applications and data and regular offline backups stored in multiple onsite and offsite locations.

Nerd Support’s experienced team can guarantee a secure business and keep your data safe. A breach doesn’t have to mean failure.

With a business continuity plan that is tailored to your needs your needs, you can get peace of mind knowing your information is safe.

Contact us today for a FREE IT Test! Or call us at 305-551-2009.

Nerds Support Contact Us Leaderboard

A team working on a an IT solution project

Three Easy Ways to Improve your Security

Cloud-based storage and computing lets you get out of the IT business and focus on doing running your business. It’s also, as we’re about to see, far more secure than traditional servers and storage.

Even now, more companies are depending on the benefits of cloud tech for remote work.

Furthermore, there are many big name companies that have found success by migrating to the cloud.

If you’re a smart business owner, you’ll see the writing on the wall. Cloud technology is essential for businesses’ success.

So without further ado, here are three ways to take advantage of cloud security:

1. Move your files to the cloud

Cloud file sharing and storage saves you from disaster. Say bye to lost attachments, file size limits and unsecure collaboration. More importantly, it puts the security of your files in the heavily-protected server room of an IT partner or technology provider – so you have a far safer back-up of all your files as well. It’s the easiest of all the cloud security steps and it dramatically improves your security overnight.

Security

Business owners use the cloud because the data stored on it is safe. Why is it safe? Because data stored on the cloud is distributed through redundant servers and never stored in just one place. Meaning, hardware failure of any kind becomes a non-issue.

If there is damage to your hardware due to a flood, storm or any other reason, your information remains secure.If a company like Cisco is vulnerable to a power outage chances are you are too.

Cloud servers also have automatic backups and multi-factored authentication to prevent data loss or theft.

This is especially helpful if your company has valuable or sensitive data. Security features on the cloud help protect against social engineering techniques like email scams. However,  there are also safe practices when emailing that can help mitigate threats.

Cost Savings

Annual operation costs drop significantly when using the cloud. Rather than pay for Internal IT software, everything is stored online or in a private server. Separate storage becomes unnecessary and so does much of your hardware and software costs.

Easy Sharing

If you’ve ever used Google Docs or Dropbox, you’re probably familiar with file sharing. File sharing is function of the cloud. A cloud environment facilitates remote work, communication and increased productivity as a result.

CIA uses the cloud for their most sensitive data and workloads

2. Move your applications to the cloud

Save over $30,000 a year by switching to the cloud per application

You probably already use cloud apps too. Facebook, Gmail, Slack or Office365 are all examples of cloud tech. However, you can also put your most important on-site apps, the ones stored on your computer, on the cloud. Application virtualization transforms any non-cloud app into a cloud-based app, easy, so your users  can access it from any device. 

Examples include :

1 . Quickbooks

2. Descartes

3. Thomas Reuter

For example, Nerds Support is a Quickbooks hosting provider. Which means businesses looking to adopt Quickbooks application services through us. Cloud based applications like Quickbooks are the best options for businesses that need to work remotely. Quickbooks hosting for remote work is a popular option among medium and small business for its accessibility.

Those times that you leave your laptop at home and have to rush back to pick it up before your 10 am meeting are gone. You can access that Excel and Powerpoint presentation in an instant.

Automation & Backups 

Creating data backups is among the biggest issues businesses face. Between dealing with complex client data, customer service, and business operations, it’s hard to remember to back up files and valuable information. This makes you vulnerable to data loss. With cloud storage, data backups are automated and routinely performed to prevent data loss or correct data mistakes that may arise. 

Data backups are good for medium and small businesses for many reasons. They also prevent ransomware attacks like the ones that plagued New Orleans in 2019.

3. Move your desktops to the cloud

Managing many PCs is a lot of work and can lead to many unsecure devices. Simply because businesses don’t have good data management practices. Your users can work on any device, any browser, anytime. And if they leave their laptop in an Uber, the airport, or at home, no problem.

Contact us today to start migrating your apps to the cloud. 

Outsourcing your tech responsibilities creates opportunities to scale and grow your business. But also consider what kind of cloud provider you’re trusting with your operation? You also need to establish a cloud migration plan. 

Nerds Support has over 17 years of experience, working with small and medium sized businesses in IT Cloud Solutions.

Nerds Support Contact Us Leaderboard

Outdated technology causes issues for future situations

Outdated System Creating Issues For Those Filing For Unemployment

Outdated Systems

As the temporary shutdown forces millions of people out of a job, millions of Floridians struggle to file for unemployment due to the Florida Reemployment Assistance Program’s outdated website.

These website crashes leave many Floridians confused and desperate to find work. The system used by the Florida Economic Opportunity is called CONNECT. The CONNECT system runs on a software that dates back to 2013. Some of the system framework used to build the application seems to date back to the time of Governor Rick Scott.

Connect Keeps Crashing

The CONNECT system doesn’t seem to have been designed with an end date in mind. In other words, there was no plan put in place to replace or update it.

This results in slow and unstable connection to the site when users open the program from a P.C. using Windows 7 or newer.

The Cloud is Constantly Connected

To avoid the hassles of running complex software and storing and processing large chucks of data, businesses and government agencies outsource these processes to cloud service providers like Amazon Web Services or Nerds Support. That way, applications and programs are scalable and operate more efficiently.

The CONNECT system was developed before the time of cloud computing was as popular as well known. Governor Ron Desantis himself has acknowledged a flaw with the website.

“The website would be down more than half the time, it would take seven second just to connect through,” he said. ” It may have been okay in 1996, not in 2020.”

Old Browsers Beat Beyond Belief

Considering Windows 7 itself has recently reached the end of life period, you can image how problematic it is for people trying to use the current system.

This is why so many people in Florida struggle to file for unemployment.

This, however, is not an isolated incident.

Labor Department Lagging Log ins

New York’s State Department of Labor also experienced a flood of traffic to their website as people try to apply for unemployment as well.

The governor of New York got various tech companies to work on the infrastructure of the website. Furthermore, it increased server capacity and assigned 700 staff members to an unemployment insurance hotline.

Filing Formula Fixes Freeze

The State Department of Labor also asks to reduce the surge of traffic by scheduling when citizens file. For example, people with last names A- F apply on Monday, last names G-N apply on Tuesday, and last names O-Z apply Wednesday.

In Florida IT experts admit the existing website hasn’t been developed beyond earlier browsers. In order to navigate through the existing site, users would have to use an older, or outdated browser that functions better with the site.

Wednesday, April 8, Florida did provide a second website that was easier to use on smartphones and tablets. This helped ease the influx of traffic but many of the findings from the Office of Florida Auditors have not been addressed.

Word To the Wise From the Web

This should be cautionary tale for businesses with outdated IT or unaudited systems. This period of remote working should be an opportunity to review your IT network and infrastructure and ensure everything from security to data and filing systems are updated.

Even outsourcing some of these tasks to a cloud provider can dramatically increase the productivity and efficiency of your business.

If you’d like more information on cloud, cyber security, remote work or managed services visit our blog or contact us at 305-551-2009.

 

Scammer calls citizen who just collected their stimulus check

How to Stay Protected Against Stimulus Check Scams

Stimulus Check Scams

President Donald Trump signed a Coronavirus Aid plan that would guarantee millions of Americans stimulus checks from the government.

Although many may see this as a positive, there are scammers looking to profit off this plan. Remember there is no sign-up required to receive the stimulus check. The process is automatic for all qualifying Americans.

How Will I Be Contacted?

The IRS always contacts taxpayers through traditional mail. Therefore, if you receive a phone call, email or text message from an “IRS official” stating you need to apply or register, it’s likely a scam.

The treasury department makes it clear on their website: “If you receive calls, emails, or other communications claiming to be from the Treasury Department and offering COVID-19 related grants or stimulus payments in exchange for personal financial information, or an advance fee, or charge of any kind, including the purchase of gift cards, please do not respond.”

How Much Will I Receive?

Americans will receive up to $1200 per person in the coming weeks and parents will receive an additional $500 for each child under 17 years of age.

Furthermore, the IRS clarifies that the agency will post any additional information when it’s available at www.irs.gov/coronavirus.

How Will I Get The Stimulus Check?

Those who file their tax returns electronically and provide the IRS with their bank information will likely get their payments earlier via direct deposit. Some 88% of individual returns were filed electronically in 2018.

Individuals who file their tax returns electronically get their payments earlier through direct deposit.

What if I Don’t Have Direct Deposit?

Those who did not provide the IRS direct deposit information on their 2019 or 2018 tax return will get that opportunity in a new government online portal. This way, citizens won’t have to wait for the check in the mail.

Paper checks are expected to take longer to arrive.

However, details about this online portal have not been released. Until the IRS releases an official web address and further guidance, don’t give out your personal banking information online.

What Types of Scams?

Scammers are taking full advantage of Americans’ financial vulnerability right now.

Details regarding the portal have not been made public, however. So, until the IRS releases more information on the website provided above, don’t give out any personal information.

Scammers target financially vulnerable people the most. The greater the desperation the easier it is to extort and manipulate them.

There have also been reports of fake checks going around. However, if one is informed they have a better chance of not falling victim to these scams.

How Do I Know I’m Being Scammed?

Any and all checks delivered by mail now are scams or fraudulent. It will take the government at least a few weeks to mail out considering the bill was only passed Friday, March 27.

Additionally, any check you receive in the mail that requires online verification or contacting a given number is also fake. Be skeptical of checks for odd amounts of money, specifically checks with a cent amount.

The government stimulus will be for an even amount of money regardless of the amount received.

What Kinds of Scams should I Expect?

Any emails with suspicious links, text messages or even voice messages you receive regarding payment is probably a social engineering scam. If you receive an email that fits the description above, don’t open anything. Simply file a complaint with the FBI or Federal Trade Commission.

This applies to businesses as well. If you are working remotely and find yourself reading an email regarding the stimulus check, contact your IT department immediately. It is always better to be safe than sorry.    

According to CNBC report, coronavirus phishing scams are rising.

The Federal Trade Commission and Federal Deposit Insurance Corp. issued warnings for Americans to be keep aware of cybercriminals who attempt to steal form users with COVID-19 related content.

Scammers work best when they hide behind legitimacy. Therefore, they use headlines, current events, trends and personal information to trick victims into giving up valued information.

Stoking fear and uncertainty is a tried and true method of manipulating a victim. Capitalizing on ignorance is the best method.

Those who don’t keep up with the news or are unclear about the specifics of the stimulus plan passed by President Trump’s administration are likelier to make a mistake than those who aren’t.

What Do These Attacks Look Like?

Scammers launch phishing attacks, through email and text to take advantage of those who have received checks. Often, these messages appear authentic, usually with a call-to-action such as “download our guide to using check” or “Get your money now, click here.”

If you are currently working remotely, contact your fellow employees, team members or IT department to verify any and all emails received. Have a strong cyber security plan in place.  There is strength in numbers and communicating doubts is the best way to deal with uncertainty.

Make sure you have a VoIP system in place to coordinate and communicate with your team, employers, or IT department at all times. This could be Skype, Zoom or any other online communication system.

Hackers are using this time of social distancing and isolation to their advantage, hoping that victims won’t verify the phishing emails they send out.

Having a reliable network of trusted experts or peers is good way to protect yourself from falling into one of these scams.