WannaCry Ransomware and How to Defend Against It

Written by Lital Asher-Dotan | May 12, 2017 6:41:27 PM

A malicious software called WanaCrypt0r 2.0 (aka WannaCry or WCry) has been affecting computers across the globe. Initial estimation states it hit 36,000 organizations, among them the UK National Health Service (NHS) and hospitals across the UK and Scotland, organizations in Spain, Russia, the Ukraine and Taiwan.

36,000 detections of #WannaCry (aka #WanaCypt0r aka #WCry) #ransomware so far. Russia, Ukraine, and Taiwan leading. This is huge. pic.twitter.com/EaZcaxPta4

— Jakub Kroustek (@JakubKroustek) May 12, 2017

Security researchers believe this widespread global ransomware attack is the result of a vulnerability called "EternalBlue" that came out of the NSA exploit dump by Shadow Brokers.

Here are a few simple steps to take to protect yourself against the WannaCry ransomware:

1 - Patch ALL Windows machines in your environment immediately. The EternalBlue vulnerability was patched by Microsoft back in March as part of MS17-010.

2 - Maintain up-to-date backups of files and regularly verify that the backups can be restored.

3- Ransomware attacks target shared network drives and cloud backups. This scenario makes it hard to retrieve the information in case of a ransomware attack. Therefore, do not rely on backup only - you must consider a protection mechanism.

4 - Ransomware is often delivered through the exact same channels as other types of malware: spear-phishing and malicious drive-by. Educate users to refrain from clicking on suspicious links, downloading email attachment and downloading software from dodgy resources.

Ransomware evolves, and new variants attack organizations and individuals every day. The Cybereason EDR platform includes a detection and response module to new to the world, never seen before types of ransomware.

View full post