Lock down Remote Desktop to your servers / computers
Discussion
I am pretty sure most will have already done this, but if you haven't get on it pretty quick.
There is a hacking group brute forcing RDP passwords and then using Diskcryptor to encrypt the whole hard drive and demand a payment in bitcoin for the password. This is impossible to undo without the password due to the level of encryption diskcryptor (a legitimate tool) uses.
We have had one company contact us after the horse has bolted and we had to help them pay the ransom / wipe servers and reset everthing up.
A friend of mine also with an IT company has had the same thing for a business, but interestingly it was the same group of hackers / email address to contact.
It seems they are well organised.
If you need any help, drop me a message.
Andy
There is a hacking group brute forcing RDP passwords and then using Diskcryptor to encrypt the whole hard drive and demand a payment in bitcoin for the password. This is impossible to undo without the password due to the level of encryption diskcryptor (a legitimate tool) uses.
We have had one company contact us after the horse has bolted and we had to help them pay the ransom / wipe servers and reset everthing up.
A friend of mine also with an IT company has had the same thing for a business, but interestingly it was the same group of hackers / email address to contact.
It seems they are well organised.
If you need any help, drop me a message.
Andy
They may not realise it, but many companies are playing roulette. Two recent examples that we have worked with include a small accountancy firm (6 employees) and a mid sized (250 staff) engineering company.
I was working with two different clients earlier in the week - one who's Network Admins, use their sys admin / root accounts for all tasks (not just the tasks that require privileged access) and another who's password policy drove users to make minor changes every 90 days, and cycled them sufficiently well to circumvent the intent of the PW policy. Neither has a contingency plan, other than to hope their (not very regularly tested) backup/restore process would recover them.
There is a lot that can be done (at little/no cost) to reduce the likelihood of being infected (EFFECTIVE password policy, patch management, DR plan, correct configuration of Firewall etc), and then if the risk is still considered to high, depending on the clients approach some more specific tools. Two we like, and therefore sell are InterceptX from Sophos, which is endpoint focussed, and tries to prevent, and BullWall, which restricts impact in the event that Ransomware gets through the other layers of protection.
So - yes, change those RDP passwords, but I strongly recommend you go a step further, and make sure you review your security, and make informed decisions about your process, policies and the products you rely on.
I was working with two different clients earlier in the week - one who's Network Admins, use their sys admin / root accounts for all tasks (not just the tasks that require privileged access) and another who's password policy drove users to make minor changes every 90 days, and cycled them sufficiently well to circumvent the intent of the PW policy. Neither has a contingency plan, other than to hope their (not very regularly tested) backup/restore process would recover them.
There is a lot that can be done (at little/no cost) to reduce the likelihood of being infected (EFFECTIVE password policy, patch management, DR plan, correct configuration of Firewall etc), and then if the risk is still considered to high, depending on the clients approach some more specific tools. Two we like, and therefore sell are InterceptX from Sophos, which is endpoint focussed, and tries to prevent, and BullWall, which restricts impact in the event that Ransomware gets through the other layers of protection.
So - yes, change those RDP passwords, but I strongly recommend you go a step further, and make sure you review your security, and make informed decisions about your process, policies and the products you rely on.
Gassing Station | Business | Top of Page | What's New | My Stuff