One week ago a global cyberattack Attack.Ransom dubbed “ unprecedented ” by Europol began infecting an estimated 200,000 of the world ’ s computers , starting a seven-day countdown to the destruction of data if victims did not pay a ransom Attack.Ransom . On Friday , those countdowns begin reaching zero . But as of lunchtime the attackers had claimed only about $ 92,000 ( €82,183 ) in payments Attack.Ransom from their widespread ransom demands Attack.Ransom , according to Elliptic Enterprises Ltd , a UK-based company that tracks illicit use of bitcoin . The company calculates the total based on payments tracked to bitcoin addresses specified in the ransom demands Attack.Ransom . The ransomware , called WannaCry , began infecting users on May 12th and gave them 72 hours to pay Attack.Ransom $ 300 in bitcoin or pay Attack.Ransom twice as much . Refusal to pay Attack.Ransom after seven days was promised to result in the permanent loss of data via irrevocable encryption . With affected institutions including the Health Service Executive ( which said it prevented the ransomware from activating ) , the National Health Service in the UK , FedEx and PetroChina , few initially paid up Attack.Ransom , leading to speculation that organisations were taking their chances on fixing their corrupt machines before the ransom Attack.Ransom forced a mass deletion of critical data . A week later , experts agree the financial gains of the hackers remain astonishingly low . “ With over 200,000 machines affected , the figure is lower than expected , ” said Jamie Akhtar , co-founder of the London-based security software firm CyberSmart . “ If even 1 per cent paid the ransom Attack.Ransom that would be $ 600k. ” Mr Akhtar said experts may never know how much larger this figure would have been if a so-called kill switch had not been accidentally triggered by a cyber security researcher , who registered an internet domain that acted as a disabling tool for the worm ’ s propagation . While the world ’ s law enforcement is pointing its resources at trying to identify the culprits , Tom Robinson , chief operating officer and co-founder of Elliptic Enterprises , says it ’ s unlikely the money taken from victims will be taken from the digital bitcoin wallets they ’ re being anonymously held in . “ Given the amount of scrutiny this has come under , I would be surprised if they moved it anytime soon , ” he said . “ I just don ’ t think the risk is worth the $ 90,000 they ’ ve raised so far. ” Mr Akhtar agrees but doesn ’ t think the criminals have given up hope while machines infected later still have time ticking on their ransom Attack.Ransom countdown . “ It seems like they are still actively trying to bring funds in , ” he said , noting a Twitter post from Symantec on Thursday , which seemed to show fresh messaging from the attackers promising to hold their end of the decryption bargain if victims paid up Attack.Ransom . Mr Akhtar believes the best thing the perpetrators can do to hide from authorities is “ destroy any evidence and abandon the bitcoin wallets ” . Of course , the hack may have nothing to do with money at all . Any movement of funds from a bitcoin wallet would act as a valuable clue for law enforcement as to who is behind the attack . Preliminary finger-pointing has already targeted groups with suspected links to the North Korean regime , but clues are still few are far between . – ( Bloomberg )

One week ago a global cyberattack Attack.Ransom dubbed “ unprecedented ” by Europol began infecting an estimated 200,000 of the world ’ s computers , starting a seven-day countdown to the destruction of data if victims did not pay a ransom Attack.Ransom . On Friday , those countdowns begin reaching zero . But as of lunchtime the attackers had claimed only about $ 92,000 ( €82,183 ) in payments Attack.Ransom from their widespread ransom demands Attack.Ransom , according to Elliptic Enterprises Ltd , a UK-based company that tracks illicit use of bitcoin . The company calculates the total based on payments tracked to bitcoin addresses specified in the ransom demands Attack.Ransom . The ransomware , called WannaCry , began infecting users on May 12th and gave them 72 hours to pay Attack.Ransom $ 300 in bitcoin or pay Attack.Ransom twice as much . Refusal to pay Attack.Ransom after seven days was promised to result in the permanent loss of data via irrevocable encryption . With affected institutions including the Health Service Executive ( which said it prevented the ransomware from activating ) , the National Health Service in the UK , FedEx and PetroChina , few initially paid up Attack.Ransom , leading to speculation that organisations were taking their chances on fixing their corrupt machines before the ransom Attack.Ransom forced a mass deletion of critical data . A week later , experts agree the financial gains of the hackers remain astonishingly low . “ With over 200,000 machines affected , the figure is lower than expected , ” said Jamie Akhtar , co-founder of the London-based security software firm CyberSmart . “ If even 1 per cent paid the ransom Attack.Ransom that would be $ 600k. ” Mr Akhtar said experts may never know how much larger this figure would have been if a so-called kill switch had not been accidentally triggered by a cyber security researcher , who registered an internet domain that acted as a disabling tool for the worm ’ s propagation . While the world ’ s law enforcement is pointing its resources at trying to identify the culprits , Tom Robinson , chief operating officer and co-founder of Elliptic Enterprises , says it ’ s unlikely the money taken from victims will be taken from the digital bitcoin wallets they ’ re being anonymously held in . “ Given the amount of scrutiny this has come under , I would be surprised if they moved it anytime soon , ” he said . “ I just don ’ t think the risk is worth the $ 90,000 they ’ ve raised so far. ” Mr Akhtar agrees but doesn ’ t think the criminals have given up hope while machines infected later still have time ticking on their ransom Attack.Ransom countdown . “ It seems like they are still actively trying to bring funds in , ” he said , noting a Twitter post from Symantec on Thursday , which seemed to show fresh messaging from the attackers promising to hold their end of the decryption bargain if victims paid up Attack.Ransom . Mr Akhtar believes the best thing the perpetrators can do to hide from authorities is “ destroy any evidence and abandon the bitcoin wallets ” . Of course , the hack may have nothing to do with money at all . Any movement of funds from a bitcoin wallet would act as a valuable clue for law enforcement as to who is behind the attack . Preliminary finger-pointing has already targeted groups with suspected links to the North Korean regime , but clues are still few are far between . – ( Bloomberg )

It ’ s safe to say that 2016 was the year of ransomware . More specifically , the year of crypto-ransomware , that nefarious variant that encrypts files and holds them captive until a ransom is paid Attack.Ransom . Since the release of Cryptolocker in late 2013 , crypto-ransomware has exploded , and 2016 was a banner year . As a matter of fact , according to the FBI , cyber criminals used ransomware to steal Attack.Ransom more than $ 209 million from U.S. businesses in just the first quarter of 2016 . And according to a recent report from Kaspersky Labs , from January to September of 2016 , ransomware attacks targeting companies increased by a whopping 300 percent . With threat actors realizing ransomware ’ s lucrative potential , they bombarded the industry with new attacks in 2016 . This variant hit the wild in early 2016 , infecting systems using AES encryption . It not only infects mapped file shares , but any networked share , so remote drives are at risk . This attack was so potent experts estimate it infected more than 100,000 victims per day at its peak . More recently , hackers went after the beloved San Francisco Municipal Transport Agency ( MUNI ) . If you were in the area in late November , you may have gotten the message “ You Hacked ” at public transit ticket kiosks . The city ’ s light rail was hit by ransomware that forced them to offer Attack.Ransom free rides for two days while they recovered the files . Or , what about Popcorn , the ingenious little in-development ransomware variant in December that turned victims into attackers by incentivizing them with a pyramid scheme-style discount . Send the infection to two of your friends , and you get your files back for free . Ransomware perhaps hit Attack.Ransom healthcare the hardest in 2016 , with some reports claiming 88 percent of all ransomware affected hospitals . Whether large or small , no provider could hide from hackers looking to nab and encrypt patient data , disrupting care until the provider paid up Attack.Ransom or recovered files . The New Jersey Spine Center and Marin Healthcare District were attacked Attack.Ransom by Cryptowall , which encrypted electronic health records , backup files and the phone system . MedStar , which operates 10 hospitals in the D.C and Baltimore area , was forced to shut down its entire IT system and revert to paper records . And the list goes on and on with names like California ’ s Hollywood Presbyterian Medical Center , The University of Southern California ’ s Keck and Norris Hospital , Kansas Heart Hospital , Alvarado Medical Center , King ’ s Daughter ’ s Health , Chino Valley Medical Center and Desert Valley Hospital , and more . Criminals have obviously realized the awesome money-making potential of ransomware , and you should expect them to double-down in 2017 . That said , how can they make an already effective threat even more widespread ? Every year I try to predict changes and evolutions to the threat and security landscape . In this year ’ s predictions , I forecast that you ’ ll see the first ever , wide-spread ransomworm . This new variant will dramatically accelerate the spread of ransomware . Years ago , network worms like CodeRed , SQL Slammer , and more recently , Conficker were pretty common . As you probably know , a worm is a type of malware that automatically spreads itself over a network , using either legitimate network file sharing features , or network software vulnerabilities . In the past , the fastest spreading worms – like the examples mentioned above – exploited Vulnerability-related.DiscoverVulnerability network software flaws to automatically propagate through networks ( whether the Internet or just your internal network ) . Although we haven ’ t seen many wildly successful network worms lately , they ’ re still a threat . All it takes is for one black hat to find Vulnerability-related.DiscoverVulnerability a new zero-day networking software flaw and wide-spread ransomworm becomes a real possibility . In fact , attackers may not even need to know a new networking flaw to create a successful ransomware . By stealing Attack.Databreach a computer ’ s local credentials , attackers can use normal Windows networking , or tools like Powershell to spread through an internal Windows network without leveraging any vulnerability at all . Now , imagine ransomware attached to such a network worm . After infecting one victim , it could tirelessly copy itself to every computer it could reach on your local network . Whether or not you want to imagine such a scenario , criminals have already added network-scanning capabilities to some ransomware variants , and there ’ s a high likelihood they will more aggressively merge ransomware and worm capabilities next year . In 2017 , I suspect you ’ ll see a ransomworm that automatically spreads very quickly and successfully , at least on local networks , if not the Internet . Since falling victim to ransomware can be a costly and time-consuming affair , how can you prepare to combat these evolving threats ? Backup – Sure , I know most people just want to prevent ransomware , but you ’ ll never have 100 percent assurances of that in information security . Backing up your data is an important part of security for reasons far beyond just recovering from a ransomware attack . If you don ’ t already backup your important data , ransomware is the best reason yet to do so . Patch your software – There are many ways ransomware might get on your systems , including just users manually doing foolish things . However , in order to forcefully or automatically install malware on your system , attackers must exploit software flaws . That said , vendors have already fixed Vulnerability-related.PatchVulnerability a huge percent of the vulnerabilities hackers use to spread malware . If you simply keep your patches up to date Vulnerability-related.PatchVulnerability , you won ’ t succumb to many of these forced or automated attacks , which could even help against ransomworms , assuming the network flaw they used was also patched Vulnerability-related.PatchVulnerability . Implement Killchain Defense – You won ’ t find one security technology that can protect you from 100 percent of ransomware by itself . However , there are many security controls that help protect you from various stages of a ransomware attack . For instance , Intrusion Prevention Systems ( IPS ) can prevent some of the exploits criminals use to spread ransomware . AntiVirus can catch some of the most common ransomware variants , and more modern advanced threat protection solutions can even identify and block new zero-day ransomware samples . However , none of these defenses are fool proof alone . The best way to protect your computer or organization is to combine all of them . Unified Threat Management ( UTM ) solutions often offer the easiest option for placing all these protections under one pane of glass