1. ©2016 Check Point Software Technologies Ltd. 1 Latest threats…. Rolando Panez | Security Engineer RANSOMWARE

2. ©2016 Check Point Software Technologies Ltd. 2 http://blog.checkpoint.co m/wp- content/uploads/2016/04/ 4-pic.png Lawrence Abrams – Bleeping Computer

3. ©2016 Check Point Software Technologies Ltd. 3 Agenda New Attack of Choice Locky Ransomware Samsam What to do?

4. ©2016 Check Point Software Technologies Ltd. NEW ATTACK OF CHOICE 01

5. ©2016 Check Point Software Technologies Ltd. 5 Shift to Ransomware Banker malware was most prominent threat in recent years. Ransomware attacks surged in past 6 months.

6. ©2016 Check Point Software Technologies Ltd. 6 Broader Audience No need to localize or target infections

7. ©2016 Check Point Software Technologies Ltd. 7 Easy Access to funds Bank fraud alerts increase risk of banker attacks Use of bitcoins ̶ Allows transaction to remain untraceable via Tor.

8. ©2016 Check Point Software Technologies Ltd. LOCKY RANSOMWARE 02

9. ©2016 Check Point Software Technologies Ltd. 9 Initial Attacks First reported on February 16, 2016 according to Check Point Analysts. Over 50k attempts per day.

10. ©2016 Check Point Software Technologies Ltd. 10 Initial Attacks Cont’d [Restricted] ONLY for designated groups and individuals Once Macro activated – Payload is downloaded DOC, DOCM, XLS or Javascript Connection to C&C to get encryption keys Data collected: ̶ Whether the targeted machine is part of a corporate network. ̶ Server / workstation. ̶ OS UI language ̶ OS version. ̶ Statistics on each encrypted drive: number of encrypted files, failed file encryptions, and amount of encrypted raw data. Any mounted drive encrypted. (usb, local, network share)

11. ©2016 Check Point Software Technologies Ltd. 11 Evolution of Locky Change in communication pattern. Changes Domain Generation Algorithm (DGA). ̶ New top level domain list (.ru,.info,.biz,.click…) ̶ DGA value calculation more complex Change in payment and decryption instructions file name. ̶ _Lock_recover_instructions ̶ HELP_instructions.txt New Attack Vector via browser exploits Evasion Techniques

12. ©2016 Check Point Software Technologies Ltd. 12 C&C communication – IPS, Anti-Bot AV signatures Sandboxing Locky Detection

13. ©2016 Check Point Software Technologies Ltd. SAMSAM 03

14. ©2016 Check Point Software Technologies Ltd. 14 Targeted Attack Maryland’s MedStar Health hospital network ̶ Jboss Exploit used to breach environment ̶ Install tools: ̶ Credential stealing ̶ Network scanning ̶ RDP ̶ Perform Reconnaissance ̶ Gather administrative passwords ̶ Use scripts to automate Samsam installation

15. ©2016 Check Point Software Technologies Ltd. 15 Expected Evolution Use other exploits besides Jboss ̶ Web Applications most vulnerable ̶ Found via Google search Access to company servers via Mobile Apps Automation ̶ Worm Viruses Target additional industries ̶ Schools are now being targeted ̶ Certain IT departments more vulnerable than others

16. ©2016 Check Point Software Technologies Ltd. WHAT TO DO? 05

17. ©2016 Check Point Software Technologies Ltd. 17 Prevention Backup important files periodically In Windows, enable automatic backups ̶ Worth a shot….. Update AV signatures ̶ Endpoint and Gateways General best practices for avoiding malware infections. ̶ User education ̶ Do you trust sender? ̶ Keep software updated

18. ©2016 Check Point Software Technologies Ltd. 18 Mitigation Forensics Analysis ̶ Obtain malware sample and check against intelligence pools ̶ Proper forensics investigation may uncover encryption key ̶ Network logs and Endpoint Logs ̶ Analyze encrypted files ̶ Get Expert Help – Incident Response Services Stay up to date ̶ www.arstechnica.com www.arstechnica.com ̶ blog.checkpoint.com blog.checkpoint.com ̶ www.theregister.co.uk www.theregister.co.uk ̶ www.bleepingcomputer.com www.bleepingcomputer.com

19. ©2016 Check Point Software Technologies Ltd. 19 Prevention Pays Off….. Should you pay up? −Fahmida Y. Rashid - Infoworld 4 reasons not to pay in a ransomware attack Should you pay up?

20. ©2016 Check Point Software Technologies Ltd. 20 ©2016 Check Point Software Technologies Ltd.