Attacks on your Gmail can force you to pay ransom to keep data and secrets from cybercrooks
Ransomware does exactly what you might think it does. It holds some of your personal and most sensitive data by encrypting it and preventing you from accessing this information. However, if you pay the ransom demanded by the attacker, the victim will receive the encryption key necessary for him to access his data. An organization does not want to get caught in a ransomware scheme for fear of having its data stolen, its operations disrupted, and its financials negatively impacted.
FBI warns individuals and organizations about a ransomware attack called "Medusa"
The FBI has issued a warning about a ransomware attack called "Medusa." As of last month, more than 300 people have been victimized by the ransomware. These victims have come from various industries including the medical, education, legal, insurance, technology, and manufacturing sectors. Unlike personal malware attacks that aim to steal an individual's personal account information and credentials with the ultimate goal of cleaning out the victim's financial accounts and identities, ransomware uses a different strategy.
U.S. agencies suggest that individuals and organizations take these actions. | Image credit-CISA
The attack is aimed at high-net-worth individuals and corporations who can afford to pay a huge ransom in order to get their data back. The FBI has created a list of actions that it says organizations should take care of right away to reduce the potentially serious impact of "Medusa." These suggestions include:
- Mitigate known vulnerabilities by ensuring operating systems, software, and firmware are patched and up to date within a risk-informed span of time.
- Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization.
- Filter network traffic by preventing unknown or untrusted origins from accessing remote services on internal systems.
"Medusa" has evolved over the years and is now runs what is considered a double extortion model that encrypts victims' data and seeks to earn big bucks by giving the victim the encryption key needed to access the stolen data only if the ransom is paid. At the same time, the attackers also threaten to publicly release stolen data and other swiped information if the ransom is not paid. Most ransom notices demand that the victim acknowledge the receipt of the ransom note within 48 hours using the Tor privacy browser.
Medusa runs a .onion data leak site complete with a countdown timer. Ransom demands are posted on the site along with links to Medusa-affiliated cryptocurrency wallets. Ads offer the stolen data to interested parties before the countdown timer ends. Victims can add a day to the countdown timer by paying an addition $10,000. The attackers try to make the victims feel that paying a ransom is just another walk through a park.
You can help yourself by using long passwords for your apps and accounts changing them frequently
According to the U.S. government, Medusa developers employ initial access brokers (IABs) in cybercriminal forums and marketplaces. The IABs specialize in accessing an organization's network and sell this access to threat actors, ransomware groups, or other bad actors. The IABs typically use phishing campaigns to steal passwords and other credentials used by victims. They also exploit CVE-listed software flaws.
Whether you're dealing with your own apps and accounts, or those belonging to a company, use long passwords that you change frequently. Also consider the use of two-factor authentication. The latter requires the user to sign in online and via his phone when logging into an app or website.
As you can see, this is a very regimented attack and is one that all corporations, organizations, and even individuals need to be aware of. The FBI says to be wary of clicking on links found on emails and texts and opening and downloading attachments. Email addresses could look real even if they are fake. These addresses would be among the first places to look for proof that an email or text is dangerous. Misspelled corporate names, poor punctuation, and bad grammar are signs that an email or text is a potential bomb looking to blow up your organization or personal accounts.
![T-Mobile extends another peace offering to customers after uproar over rate increase [UPDATED]](https://m-cdn.phonearena.com/images/article/168576-wide-two_350/T-Mobile-extends-another-peace-offering-to-customers-after-uproar-over-rate-increase-UPDATED.jpg)
FCC OKs Cingular\'s purchase of AT&T Wireless
Things that are NOT allowed: