Happy Birthday No More Ransom!

Today, the <a href="https://www.europol.europa.eu/newsroom/news/no-more-ransom-108-million-reasons-to-celebrate-its-third-anniversary" target="_blank">No More Ransom </a>(NMR) project turns three years old. Anomali joined the <a href="https://www.anomali.com/blog/anomali-joins-no-more-ransom-partnership-ecosystem" target="_blank">No More Ransom</a> partnership on the 25th of March, and since then, organizations and the information security community at large continue to observe devastating ransomware incidents around the world. These incidents typically cause challenging remediation efforts, operational headaches, and potentially large revenue loss. The most recent ransomware activity springs no surprises as to what has been seen previously: victims span all industries and verticals of all sizes, across the globe.<img alt="" src="https://cdn.filestackcontent.com/Hcm8kmcQmuaoVxLxg5kg"/>Figure 1. Notable publicly observed ransomware incidents from 26th March 2019Ransomware will remain a popular attack type for financially-motivated cyber threat actors due, in most cases, to its ability to scale and automate for maximum impact. In addition, there are multiple online locations where one could utilize Ransomware-as-a-Service (RaaS) and pay others to conduct cyberattacks. The scale of this threat is evident as we look at active observable data (domains, IPs, hashes, URLs, etc.) from the last 90 days in the Anomali ThreatStream platform that shows ~460k indicators that have been marked with a “ransomware” tag from Anomali Threat Research and the wider <a href="https://www.anomali.com/app-store" target="_blank">Anomali Preferred Partner network</a>.<a href="https://threatpost.com/second-florida-city-pays-hackers-500k-post-ransomware-attack/146018/" target="_blank">Recent confirmed ransom payouts</a> will also appeal to cyber threat actors and groups with the capability and potential intent. Although, at the recent U.S. Conference of Mayors which took place on June 28th to July 1st, <a href="http://legacy.usmayors.org/resolutions/87th_Conference/proposedcommittee-preview.asp?committee=Criminal%20and%20Social%20Justice" target="_blank">a resolution was agreed</a> to stand against “paying ransoms in the event of an IT security breach.” We await to see whether this move is further pursued by other bodies and communities. The resolution follows the general advice from the information security industry and law enforcement as a ransom payment is providing validation that the infection was successful, there are no assurances that the decryption process will work or keys will be provided, and ultimately this is further funding cyber threat actors and potentially other illegal activity.<img alt="" src="https://cdn.filestackcontent.com/ilCZTQSTjuVxFfxAbyqU"/>Figure 2. No More Ransom third anniversary progress infographicWe look forward to continuing the supporting partnership with No More Ransom.Ransomware prevention guidance:<ol><li>Ensure you have a back-up plan. For data and files which you consider important or sensitive, create and store back-up copies securely.</li><li>Enterprise should maintain an effective defense-in-depth posture that is aligned to satisfactory risk management principles. This will encompass, but is not limited to, the usage of asset and software inventories, robust endpoint protection, patch management, network segmentation and perimeter controls, operationalize cyber threat intelligence, finally, manage accounts and authentication mechanisms appropriately.</li><li>Everyone should be wary of links and attachments in emails, particularly those arriving from unknown senders or with unusual requests.</li><li>Stay abreast of the latest cyber threat information. Subscribe to the <a href="https://www.anomali.com/community" target="_blank">Anomali Weekly Threat Briefing</a>, and actively participate in trusted industry and regional threat intel sharing communities.</li></ol><img alt="" src="https://cdn.filestackcontent.com/UJJfhQ0mThqxw3bDtNqx"/>Figure 3. No More Ransom third anniversary partner infographic References:<a href="https://www.europol.europa.eu/newsroom/news/no-more-ransom-108-million-reasons-to-celebrate-its-third-anniversary" target="_blank">https://www.europol.europa.eu/newsroom/news/no-more-ransom-108-million-reasons-to-celebrate-its-third-anniversary</a><a href="https://threatpost.com/second-florida-city-pays-hackers-500k-post-ransomware-attack/146018/" target="_blank">https://threatpost.com/second-florida-city-pays-hackers-500k-post-ransomware-attack/146018/</a><a href="http://legacy.usmayors.org/resolutions/87th_Conference/proposedcommittee-preview.asp?committee=Criminal%20and%20Social%20Justice" target="_blank">http://legacy.usmayors.org/resolutions/87th_Conference/proposedcommittee-preview.asp?committee=Criminal%20and%20Social%20Justice</a>Figure 1 references:<a href="https://www.bleepingcomputer.com/news/security/ransomware-hits-garage-of-canadian-domain-registration-authority/" target="_blank">https://www.bleepingcomputer.com/news/security/ransomware-hits-garage-of-canadian-domain-registration-authority/</a><a href="https://www.bleepingcomputer.com/news/security/unnam3d-ransomware-locks-files-in-protected-archives-demands-gift-cards/" target="_blank">https://www.bleepingcomputer.com/news/security/unnam3d-ransomware-locks-files-in-protected-archives-demands-gift-cards/</a><a href="https://www.databreaches.net/ia-southern-hills-eye-care-notifies-patients-of-ransomware-attack/" target="_blank">https://www.databreaches.net/ia-southern-hills-eye-care-notifies-patients-of-ransomware-attack/</a><a href="https://www.albanyny.gov/newsandevents/news/19-03-31/City_of_Albany_Outlines_Service_Availability.aspx" target="_blank">https://www.albanyny.gov/newsandevents/news/19-03-31/City_of_Albany_Outlines_Service_Availability.aspx</a><a href="https://techcrunch.com/2019/04/02/arizona-beverages-ransomware/" target="_blank">https://techcrunch.com/2019/04/02/arizona-beverages-ransomware/</a><a href="https://www.bleepingcomputer.com/news/security/genesee-county-michigan-recovering-from-ransomware-attack/" target="_blank">https://www.bleepingcomputer.com/news/security/genesee-county-michigan-recovering-from-ransomware-attack/</a><a href="https://www.scmagazine.com/home/security-news/data-breach/ransomware-attack-on-software-company-residex-may-have-exposed-data-on-assisted-living-residents-workers/" target="_blank">https://www.scmagazine.com/home/security-news/data-breach/ransomware-attack-on-software-company-residex-may-have-exposed-data-on-assisted-living-residents-workers/</a><a href="https://www.zdnet.com/article/cyber-security-firm-verint-hit-by-ransomware/" target="_blank">https://www.zdnet.com/article/cyber-security-firm-verint-hit-by-ransomware/</a><a href="https://www.wsj.com/articles/weather-channel-knocked-off-air-for-over-an-hour-11555611840" target="_blank">https://www.wsj.com/articles/weather-channel-knocked-off-air-for-over-an-hour-11555611840</a><a href="https://www.centralmaine.com/2019/04/28/augusta-cyber-attacker-sought-more-than-100k-in-ransom/" target="_blank">https://www.centralmaine.com/2019/04/28/augusta-cyber-attacker-sought-more-than-100k-in-ransom/</a><a href="https://www.a2hosting.com/blog/windows-service-update/" target="_blank">https://www.a2hosting.com/blog/windows-service-update/</a><a href="https://www.newschannel10.com/2019/04/23/potter-county-officials-computers-remain-dark-after-viruses-hit/" target="_blank">https://www.newschannel10.com/2019/04/23/potter-county-officials-computers-remain-dark-after-viruses-hit/</a><a href="https://techcrunch.com/2019/04/23/aebi-schmidt-ransomware/" target="_blank">https://techcrunch.com/2019/04/23/aebi-schmidt-ransomware/</a><a href="https://www.eastidahonews.com/2019/04/ransomware-takes-down-servers-at-local-school-district/" target="_blank">https://www.eastidahonews.com/2019/04/ransomware-takes-down-servers-at-local-school-district/</a><a href="https://www.news5cleveland.com/news/local-news/cleveland-metro/ransomware-infected-cleveland-hopkins-international-airports-computing-systems-fbi-confirms" target="_blank">https://www.news5cleveland.com/news/local-news/cleveland-metro/ransomware-infected-cleveland-hopkins-international-airports-computing-systems-fbi-confirms</a><a href="https://www.14news.com/2019/04/29/malware-attack-daviess-co-library/" target="_blank">https://www.14news.com/2019/04/29/malware-attack-daviess-co-library/</a><a href="https://wolterskluwer.com/company/newsroom/news/2019/05/media-statement---network-and-service-interruptions.html" target="_blank">https://wolterskluwer.com/company/newsroom/news/2019/05/media-statement---network-and-service-interruptions.html</a><a href="https://abhomes.net/databreach/" target="_blank">https://abhomes.net/databreach/</a><a href="https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html" target="_blank">https://www.nytimes.com/2019/05/22/us/baltimore-ransomware.html</a><a href="https://finance.yahoo.com/news/southeastern-council-alcoholism-drug-dependence-000000877.html" target="_blank">https://finance.yahoo.com/news/southeastern-council-alcoholism-drug-dependence-000000877.html</a><a href="https://okcfox.com/news/local/documents-show-some-of-the-cost-of-okcps-ransomware-attack" target="_blank">https://okcfox.com/news/local/documents-show-some-of-the-cost-of-okcps-ransomware-attack</a><a href="https://eu.courier-journal.com/story/news/local/2019/05/20/louisville-regional-airport-authority-hit-ransomware-attack/3747589002/" target="_blank">https://eu.courier-journal.com/story/news/local/2019/05/20/louisville-regional-airport-authority-hit-ransomware-attack/3747589002/</a><a href="https://www.nytimes.com/2019/06/19/us/florida-riviera-beach-hacking-ransom.html" target="_blank">https://www.nytimes.com/2019/06/19/us/florida-riviera-beach-hacking-ransom.html</a><a href="https://www.eurofins.com/media-centre/press-releases/2019-06-10/" target="_blank">https://www.eurofins.com/media-centre/press-releases/2019-06-10/</a><a href="https://www.eptrail.com/2019/06/13/inside-the-cyberattack-at-estes-park-health/" target="_blank">https://www.eptrail.com/2019/06/13/inside-the-cyberattack-at-estes-park-health/</a><a href="http://www.auburn-reporter.com/news/ransomware-takes-down-auburn-food-bank-network-but-community-steps-up/" target="_blank">http://www.auburn-reporter.com/news/ransomware-takes-down-auburn-food-bank-network-but-community-steps-up/</a><a href="http://www.asco.be/news" target="_blank">http://www.asco.be/news</a><a href="https://www.nytimes.com/2019/06/27/us/lake-city-florida-ransom-cyberattack.html" target="_blank">https://www.nytimes.com/2019/06/27/us/lake-city-florida-ransom-cyberattack.html</a><a href="https://healthitsecurity.com/news/ohio-provider-pays-75k-ransom-after-serious-hack-on-it-system" target="_blank">https://healthitsecurity.com/news/ohio-provider-pays-75k-ransom-after-serious-hack-on-it-system</a><a href="https://www.kveo.com/news/local-news/city-ransomed-by-hacker/2069644320" target="_blank">https://www.kveo.com/news/local-news/city-ransomed-by-hacker/2069644320</a><a href="https://www.scmagazine.com/home/security-news/ransomware/report-ransomware-attack-disrupts-georgias-court-system/" target="_blank">https://www.scmagazine.com/home/security-news/ransomware/report-ransomware-attack-disrupts-georgias-court-system/</a><a href="https://www.thenewsdispatch.com/news/article_d9809e48-7e8d-52d5-9d08-5d6c1adab2a2.html" target="_blank">https://www.thenewsdispatch.com/news/article_d9809e48-7e8d-52d5-9d08-5d6c1adab2a2.html</a><a href="https://www.bleepingcomputer.com/news/security/monroe-college-hit-with-ransomware-2-million-demanded/" target="_blank">https://www.bleepingcomputer.com/news/security/monroe-college-hit-with-ransomware-2-million-demanded/</a><a href="https://www.wmcactionnews5.com/2019/07/18/city-collierville-files-attacked-by-ransomware/" target="_blank">https://www.wmcactionnews5.com/2019/07/18/city-collierville-files-attacked-by-ransomware/</a>