FBI Alert: Dual Ransomware Attack Surge

Wajahat Raja

October 16, 2023 - TuxCare expert team

In recent times, cybersecurity threats and dual ransomware incidents have evolved, affecting organizations worldwide. The Federal Bureau of Investigation (FBI) has issued a warning about a troubling trend pertaining to dual ransomware attack surge. Multiple ransomware strains are used in these assaults to target victims’ networks with the goal of encrypting crucial systems in less than 48 hours. This new technique has major consequences for businesses, as it results in data loss, monetary damage in the form of ransom payments, and potential business disruptions.

Understanding the Dual Ransomware Attack

The FBI alert on dual ransomware attacks indicates a troubling tendency that has been seen since July 2023. Ransomware affiliates and operators use a two-pronged approach in their attacks, deploying two separate variations. AvosLocker, Diamond, Hive, Karakurt, LockBit, Quantum, and Royal are among the versions. When these two ransomware versions work together, they create a lethal mix of data encryption, data exfiltration, and large financial losses through ransom payments.

Cybercriminals targeting with dual ransomware make it evident that these hackers are becoming increasingly sophisticated in their tactics. Traditionally, ransomware groups required at least 10 days to carry out their attacks. The landscape, however, has shifted radically. The majority of ransomware cases now happen within 48 hours, which is a significant change from the past. This increased speed poses a significant risk to organizations, leaving them with little time to respond effectively.

The Ongoing Challenge of Double-Encryption

The recent FBI warning on ransomware serves as a stark reminder of the growing threat landscape in which cybercriminals are operating. Double-encryption is not a novel concept, and certain threat actors have been employing it for many years. MedusaLocker and Globemposter, for example, are frequently used by the same threat actors against a single victim. Furthermore, initial access brokers can provide network access to several ransomware affiliates, each utilizing a distinct brand of ransomware. Both affiliates then attack the network in quick succession, aggravating the recovery process even further.

Evasion Tactics and Data Destruction

Ransomware gangs began improving their proprietary data-stealing tools, wipers, and malware to avoid detection in early 2022. In some cases, malware with data-wiping functionality lies dormant on compromised systems until a predetermined time, at which point it activates, causing periodic destruction of data on the target’s network.

An automotive supplier suffered three different breaches in less than two months, demonstrating the seriousness of these dual ransomware attacks. These assaults were carried out by LockBit, Hive, and ALPHV/BlackCat affiliates, resulting in pandemonium and severe data loss. Worse, some files were encrypted up to five times because different groups kept locating and encrypting the same files.

Defending Against Dual Ransomware Attacks

Protecting against dual ransomware attacks is crucial for businesses looking to safeguard their data and ensure business continuity. The FBI provides useful advice on how to guard against ransomware attacks:

Collaborate with FBI Field Offices: Developing close relationships with FBI Field Offices in your area will help you uncover vulnerabilities and mitigate potential risks. These connections can be quite useful in responding to ransomware situations.
Implement Mitigation Measures: Follow the mitigation steps described in the FBI’s Private Industry Notification. These methods can reduce the risk of ransomware attacks by limiting attackers’ use of standard system and network discovery techniques.
Maintain System Uptime: Update all systems on a regular basis and perform thorough scans of your infrastructure to uncover any backdoors or vulnerabilities created by attackers.
Secure Remote Access: Secure services such as VNC and RDP that only enable access via VPN with robust password enforcement and multi-factor authentication (MFA).
Implement Network Segmentation: Isolate important servers into VLANs to improve security and limit attacker lateral movement.
Comprehensive Scans and Audits: Conduct thorough scans and audits across your whole network to discover devices that may be susceptible to missing patches.

Conclusion

The rise in dual ransomware incidents necessitates increased vigilance and effective protection measures. To fight against these growing dangers, organizations need to stay aware, work with law enforcement authorities such as the FBI, and proactively deploy security practices. Protecting your systems against ransomware is much more than just data security; it’s also about guaranteeing business continuity and minimizing the devastating impact of cyberattacks.

The sources for this piece include articles in The Hacker News and Bleeping Computer.

Summary