# MA-1034.022024: MyCERT Advisory - Security Best Practices Against Ransomware

**Date:** 22 Feb 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1034.022024  
**Advisory ID:** MA-1034.022024

---

**1.0 Introduction**
On January 26, 2024, the threat actor group R00TK1T issued a warning on a Telegram channel, declaring their intent to launch cyber-attacks on Malaysia. Their announcement indicates a plan to unleash chaos by targeting Malaysia's digital infrastructure. The group claims to possess the capability to infiltrate networks, causing havoc and destruction within governmental institutions. 
As of today, CyberSecurity Malaysia has identified 34 postings pertaining to Malaysia, with 16 incidents being detected involving 13 organizations. Each incident has been duly reported to Cyber999-CyberSecurity Malaysia, and stakeholders have been promptly notified about these developments. CyberSecurity Malaysia has observed the use of credentials from information stealer (infostealer) which is a type of malware designed to extract sensitive information from infected computers. This data was sold openly in the darkweb marketplace.
It is believed that one of the attack vectors of the R00TK1T threat actor group is using this information to do cyber-attacks such as data breach, system intrusion, network infiltration and web defacement. It also can be observed that the  R00TK1T threat actor group is orchestrating a campaign by extending invitations to ransomware threat groups to collaborate in executing a large-scale attack. These ransomware attacks might use different variants that affect servers and computers within the organisations. The ransomware attack could lead to operational disruptions and also harm the reputation of the organisations.
Ransomware is a form of attack that the adversary uses to obtain control over an organization's network and steal critical and proprietary data. This infiltration poses a significant threat to organisations, as the attacker has already abused the network for nefarious purposes. To prevent such occurrences, we urge organisations to take necessary steps to secure their systems and networks as well as recommendations for business continuity, if affected.
**2.0 Impact**
Below is the list of ransomware impacts :
- Identity theft can lead to unauthorized access.
- Network infrastructure is compromised.
- Files on the infected computer are encrypted, and the owner is unable to access the files until a ransom (usually in a cryptocurrency such as Bitcoin) is paid.
- Business operations are disrupted due to permanent or temporary loss of sensitive or proprietary data belonging to an organisation.
- Aside from financial gain it exploits sensitive data and uses it as a levy. If the ransom is not fulfilled within the given time, organisations’ confidential data are exposed, and trade secrets are compromised.
- A data breach can result in reputational harm to the government and diminish trust in government digital transformation programmes.
**3.0 Recommendations**
Below are some recommendations for immediate protection against infostealer and ransomware attacks:
**3.1  Recommendations for System Administrators:**
1. Organisations must proactively monitor and screen for compromised credentials potentially due to Infostealers infection. Infostealers could be part of a bigger attack like ransomware. Hence, compromised credentials must be immediately rectified by changing the passwords to strong passwords.
2. Implementing password revocation to enforce password changing.
3. Encourage employees to use secure password managers and longer passphrases, avoid using the same password for multiple accounts and set reminders to change passwords after several months.
4. Use multi-factor authentication to identify and protect the businesses' critical assets and access to critical information systems.
5. Restrict access authorisations according to user roles and develop authorisation policy to secure idle accounts; automatically lock accounts and alert IT staff after several failed login attempts.
6. Review Active Directory (AD) to locate and close existing backdoors such as compromised service accounts, which often have administrative privileges and are often targeted by attackers who aim to steal credentials.
7. Update security patches and antivirus software regularly.
8. Perform Data backups daily and test regularly. Place backup copies in a remote location.
9. Conduct IS awareness training for all staff at least once a year.
10. Do not download suspicious files from an unknown sender.
11. Conduct Disaster Recovery Plan review and update, if necessary.
12. Conduct Business Continuity Plan review and update, if necessary.
**3.2  Recommendations for Internet users:**
1. Users should use strong and unique passwords.
2. Users should use secure passwords  for the network.
3. Users should be wary of phishing attempts and must not simply click on any links or executables they receive via social media and other messaging applications.
4. Users should practice safe browsing and backup data regularly.
5. Users should download software or applications from reputable sources.
6. Users should be wary and suspicious of applications circulated on social media for downloads.
7. Enable and use up-to-date anti-virus software.
8. Do regular security updates and patches.
9. Contact relevant authorities such as CyberSecurity Malaysia for inquiries and assistance 
10. Users are also encouraged to report to the Service Providers or the social media platform concerning the circulation of posts or ads with suspicious links.
Generally, CyberSecurity Malaysia advises users  to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**4.0    References**
- <https://www.mycert.org.my/portal/advisory?id=MA-931.042023>
- <https://www.mycert.org.my/portal/advisory?id=MA-824.122021>
- <https://www.linkedin.com/pulse/info-stealer-malware-what-you-need-know-how-stay-safe-digialert/>
- <https://conscia.com/blog/defending-against-infostealer-malware-attacks-a-comprehensive-guide-for-organizations/>