CyptoWall 4.0 is out in the wild. This is the newest version of a piece of malicious code that has stolen data and extorted more than $325 million from its victims worldwide (half of that from the U.S. alone). This latest code release (so-called) even attempts to sweet talk it’s victims by welcoming them to their growing community!
And while this strain of ransomware just gets more effective, an FBI agent at the recent Cyber Security Summit 2015 was quoted that if you had no data backup, it was best to pay the ransom to get your files back.
The ransomware is that good,” said Joseph Bonavolonta, the Assistant Special Agent in Charge of the FBI’s CYBER and Counterintelligence Program in its Boston office. “To be honest, we often advise people just to pay the ransom.”
The guy behind this and other related ransomware strains is on the FBI’s most wanted list of cybercriminals: Russian hacker Evgeniy Bogachev.
Is this starting to resemble all those old wild west movies or what? Bad guy on the loose with every lawman trying to match up guys down at the local saloon with the description on the most wanted poster? In reality, the FBI in all likelihood knows where Bogachev is at but they can’t touch him due to lack of jurisdiction with no extradition, either. In the meantime, the attacks continue.
My takeaway is this: The police are effectively powerless to stop the cyber shakedown of regular citizens and organizations of all types and sizes, including local police departments.
If you are an executive decision maker at your organization, this new external reality is something you need to factor into your strategic planning. Your organization needs to have a cybersecurity program that will protect you from small incidents (like single computer takeovers by CrytpoWall) up to big business email compromises that can wipe out your new product budget (just ask the folks over at Ubiquiti Networks who recently got duped out of $46 million).
Whatever course of action you take, don’t act out of fear! That’s just what cyberbullies like Bogachev want. Instead, try to see this as a great opportunity to make your organization more resilient to all sorts of natural and man-made disruptions. After all, preparing for one type of disruption helps you get ready for all of them. Get a copy of NIST’s latest cybersecurity framework and evaluate yourself against it. Find the gaps and put together a program to close them.
And, if you see Bogachev at happy hour, give the FBI a tip!