# MA-824.122021: MyCERT Alert - Tips on Protection and Business Continuity Against Ransomware

**Date:** 14 Dec 2021  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-824.122021  
**Advisory ID:** MA-824.122021

---

**1.0 Introduction**
MyCERT observes the growth of ransomware incidents in the past weeks. These ransomware incidents include different types of variants, such as Eight, Lockbit 2.0, and LV, targeting various sectors in Malaysia. Many organizations reported ransomware incidents that affected servers and computers within the organizations.
Today’s ransomware evolution, steering the threat towards a different perspective. Ransomware is another trophy won by the adversary, yet the real threat is the long-overdue infiltration suffered by organizations, losing sensitive and proprietary data against the adversary who already exploited its network for malicious activities. 
In order to prevent such occurrences, we urge organizations to take necessary steps to secure their systems and networks as well as recommendations for business continuity, if affected.
**2.0 Impact**
- Network infrastructure is compromised
- Files on the infected computer are encrypted and the owner is unable to access the files until a ransom (usually in crypto-currency such as Bitcoin) is paid
- Business operations are disrupted due to permanent or temporary loss of sensitive or proprietary data belonging to an organization
- Aside from financial gain it exploits sensitive data and uses it as a levy. If the ransom is not fulfilled within the given time, organizations’ confidential data are exposed and trade secrets are compromised
**3.0RecommendationsBelow are some recommendations for protection against ransomware attacks:*Information Systems Protections:*
- Use multi-factor authentication to identify and protect the business-critical asset and access to critical information systems
- Restrict access authorizations according to user roles and develop authorization policy to secure idle accounts; automatically lock accounts and alert IT, staff, after several failed login attempts
- Review Active Directory (AD) to locate and close existing backdoors such as compromised service accounts, which often have administrative privileges and are often targeted by attackers who aim to steal credentials
- Encourage employees to use secure password managers, longer passphrases and avoid using the same password for multiple accounts, and set reminders to change passwords after several months
- Secure configurations references and monitor systems on  workstations, laptops, servers, and mobile devices using centralized management
- Install antivirus software on all devices and update regularly
- Develop Disaster Recovery Plan
- Develop Business Continuity Plan according to organizational requirements to minimize the impact
- Perform Data backups daily and test regularly. Place backup copies in a remote location
- Conduct IS awareness training to all staff, at least once a year
- Do not download suspicious files from an unknown sender
*Network Operations Protections:*
- Implement and update intrusion detection/prevention system
- Monitor end-point security regularly
- Update traffic filtering between internal network and internet
- Follow a strict patching protocol for operating systems and their applications including network appliances such as firewall and VPN settings
- Complete regular vulnerability scans and penetration tests across the network
- Implement network segmentation to separate critical areas from non-critical areas to prevent threat propagation and strengthen organizations security policies
- Perform periodic assessments using third-party tools like Censys or Shodan to identify publicly accessible services and ports across public-facing IP address space, then close them
- Restrict access to port 3389 (RDP) to staff who use VPN to remotely access any systems. Restrict VPN access to specific IP addresses, ranges, or geographies within organization control
- Implement real-time monitoring to identify and, if required, lock unusual account activity immediately
- Enable spam email filters, use digital signatures and anti-spoofing controls as well as web filtering
- Conduct periodic cyber drill exercises in the organization to assess controls and policy effectiveness
*Sensitive and proprietary data protection:*
- Appoint a data protection officer in the organization to ensure documents adhere to security controls
- Monitor protection of personal data regularly to ensure compliance with laws and regulations
- Notify Data Protection Authority (DPA) of the personal data processing implemented by the organization to obtain applicable DPA authorization
- Implement Data Breach Response Plan and communicate roles clearly towards functional team members
**Below are recommendations for business continuity after ransomware attack:**
- Identify affected machines and isolate affected systems. Disconnect them immediately to prevent ransomware from spreading
- Identify the ransomware variant using [Crypto Sheriff](https://www.nomoreransom.org/crypto-sheriff.php?lang=en) by [The No More Ransom! Project](https://www.nomoreransom.org/en/index.html) to  understand the tactics and techniques used by the variant to infiltrate the network
- Re-image infected machines for investigation and postmortem
- Restore systems using backup and perform a password reset exercise to all systems after restoration complete
- Review existing security tools logs to detect vector/vulnerability causing the intrusion and patch it during the recovery process to prevent a future attack
- Implement a set Business Continuity Plan (BCP). Ideally, operational departments, key decision-makers, and relevant stakeholders are familiar with the plan and able to execute it accordingly
- According to previously reported cases, malware binary often terminates/deletes itself. You may find the recovery key in the system memory provided it is not shut down or reformat. However, modern variants do not leave the key in memory as the malware is self-deleted and the machine is rebooted
- We advise victims to avoid paying the ransom as this increases malicious activity and often, the decryption key does not guarantee full recovery of the encrypted data.
Generally, MyCERT advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting)
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. https://www.chubb.com/content/dam/chubb-sites/chubb-com/cz-cz/for-business/financial-risk-professional-liability-insurance/documents/pdf/chubb-cyber-erm-proposal-form.pdf
2. https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf?cmp=26061
3. https://www.csa.gov.sg/singcert/Advisories/ad-2020-006
4. https://blog.emsisoft.com/en/36921/8-critical-steps-to-take-after-a-ransomware-attack-ransomware-response-guide-for-businesses/