June 2018 - MonsterCloud

What Is Qnbqw Ransomware

June 29, 2018

Security analysts who specialize in ransomware removal have found out a powerful cryptocurrency ransomware named as Qnbqw Ransomware. It follows the modus operandi of traditional ransomware as it blocks access to the computer files with its extension and demands ransom in return of the data. It mainly attacks users with Windows as their operating systems. Moreover, ransomware removal security experts have said that risk associated with this ransomware is too high compared to others.

What is Qnbqw Ransomware

As the cryptocurrency fever has overtaken the entire world with trading and mining, attackers have entered into this space too through various viruses. One of them is Qnbqw Ransomware.

Qnbqw differs from other ransomware through its encryption algorithm AES-256(Advanced Encryption Standard). Once it enters into your machine, it can block access to any file with any format including multimedia files, office documents and IT files like databases.

The infected files are renamed with a .qnbqw extension after which they cannot be opened. The attackers then infiltrate the system with a text document with the name “Notice.txt” which encompasses their motives and ransom related demands.

This document carries information about payment. Since Qnbqw is a cryptocurrency ransomware, thus the payment is mostly in the form of a cryptocurrency like Bitcoin. It also contains the guide for registration of accounts on a crypto exchange through which the attackers can receive payments.

Moreover, an email address [email protected] is also provided to establish communication with the attackers. The amount of ransom is not specified in the file as cybercriminals first analyze the hacked files and then quote an amount with accordance to their importance. After following their demands, user get an encryption key to remove ransomware.

Characteristics of Qnbqw

Once Qnbqw enters into your computer it not only encrypts your file through its extension but also does a greater damage. Firstly, it intercepts the user’s access to system files. It then starts modifying these files as well reconfigure other system settings. Then it will proceed towards undermining the speed of your computer. Finally, it will invalidate Windows Firewall.

Ransomware removal security experts do not advise to pay any ransom to the attackers.

3 Recent Ransomware Attacks in Healthcare Industry

June 28, 2018

Last week has been pretty bad for the healthcare industry as it was involved in the following ransomware attacks.

RISE WISCONSIN

RISE Wisconsin revealed recently that it was attacked on June 7 by a ransomware. More than 3500 patients’ data has been compromised. The data consisted of personal information like names and addresses as well as health related information including patient’s history and diseases.

It took RISE 24 hours to detect the ransomware and it then proceeded to shut down its systems. RISE has not acknowledged whether it paid any ransom or not though they have hired security analysts to remove ransomware.

AFLAC

Meanwhile a week earlier AFLAC also found out a breach and estimated the number of clients’ exposed as 10,000 while reporting to Office for Civil Rights (OCR). AFLAC believes that these clients might have been attacked when Microsoft Office 365 email accounts in the hands of third parties were hacked. Some data that was exposed was Protected Health Information (PHI) while some was Personally Identifiable Information (PII).

AFLAC then moved towards implementing security measures in order to remove ransomware by the isolation of these email addresses and communicating to the affected third parties about the breach.

Michigan’s Health Equity

Moreover, Michigan’s Health Equity was also found out to be compromised and they revealed it on June 12. The attack was made possible by the hacking of an employee’s account through which the attacker was able to gain access to Protected Health Information.

Unlike the previous ransomware attacks, experts found out while ransomware removal that the data exposed was not related to patients. Instead it was related to employees of Health Equity as their employees’ names, Identity Document (ID), Social Security numbers and other data was exposed.

Moreover, it was found out while removing ransomware that the attack happened two months back on April 11 while Health Equity was able to detect it on April 13. One of the first steps taken by its security team during ransomware removal was to eliminate the account of that hacked employee and then the team began to check for the ramifications of the ransomware.

Ransomware is the Biggest Corporate Cyber Threat and CIOs are in Agreement

June 27, 2018

Every other day, a survey is conducted on the landscape of cyber threats and they often suggest that ransomware attacks are constantly hurting individuals and companies. An Ireland-based IT company has recently conducted a survey among corporate Chief Information Officers (CIO) in 23 countries.

The survey concludes that the majority of CIOs are in agreement that cryptovirological attacks and subsequent extortion activities are the leading cyber threat faced by the corporate sector. This shows that ransomware removal measures have become a huge cause of concern for digital security departments. It is important to note that majority of the companies are still working without robust and independent IT security departments. Therefore, they have to resort to full-time professional digital security services for ransomware removal.

Ransomware Tops the Chart

According to the survey, more than 70 percent CIOs term ransomware and corporate extortions as the biggest cyber threat they are facing today. DDoS attacks, social engineering outings, and identity theft are rated second, third and fourth most dangerous cyber threats respectively. Meanwhile, the insider foul play is considered the least menacing cyber threat by CIOs.

It is also important to note that sometimes social engineering outings set the template for a ransomware attack. Similarly, the line between DDoS and ransomware attacks is also getting blurred with time. Now many ransomware attacks are aimed at denying the services instead of locking down the data. Especially in a corporate environment, it’s lucrative for operators to ask for extortion money to restore the affected services.

Snail-Paced Digital Transformation is the Culprit

Nearly one-third CIOs have confessed that many projects end up in cancellation because of the digital security apprehensions. A reluctant digital transformation is the main reason why the corporate sector is bearing the losses due to cyber attacks.

But it is encouraging to know that more than half of the surveyed corporations are willing to replace and streamline their existing digital infrastructure. These changes will help them in building their own in-house digital security teams, resulting in efficient ransomware removal measures.

Ransomware 101: History of Ransomware (The Ultimate Development of Crypto Ransomware)

June 1, 2018

During the nascent phase, we saw how crypto ransomware was introduced in its most basic form. But due to easy and quick ransomware removal, they couldn’t properly take off to become a viable business option for cybercriminals.

However, by 2013, the cryptovirological developers overcame the majority of the issues in their scripting to make their attacks more supple, effective and lethal. The threat of ransomware organizations and individual users facing today had acquired this form five years ago.

Crypto ransomware of today is very effective with its encryption algorithm. Moreover, it is more effective in infiltrating networks and devices. For that reason, ransom demands have also become pricey. An average extortion demand is now $300 for a regular ransomware attack. In addition, more comprehensive and exhaustive ransomware removal activities are now required to disinfect the affected devices.

What Crypto Ransomware Operators Learnt From Earlier Mistakes?

First thing crypto ransomware operators did was to drop symmetric encryption and adopted asymmetric algorithms. However, it also became ineffective after some time after security experts developed ransomware removal measures for it. Later, cryptovirological operators integrated Triple Data Encryption and Advanced Encryption Standard in their crypto strains.

This transition drastically improved the encryption regimen of crypto ransomware. Moreover, they started to develop unique decryption keys for multiple activities of the same strain. Earlier, a single decryption key could be used for ransomware removal on multiple devices affected by a similar strain. Crypto ransomware operators have also stopped to store decryption key in the payload because security experts started to succeed in retrieving it.

Nevertheless, some loopholes are still dug by security experts to neutralize the activity of crypto ransomware. Moreover, the growing trend of maintaining data backups has also factored in making ransomware activities ineffective.

This is the reason ransomware operators are now shifting their focus to target entities working in public domain. For instance, healthcare ventures are the new pick of ransomware operators because they severely get affected regardless of backups and quick ransomware removal measures.

It seems like this unannounced scuffle between cryptovirological operators and security experts will continue.