Author: Logicalis Staff

Reading Time: 4 minutesBy Ron Temske, Vice President of Security Solutions, Logicalis US Recent large-scale ransomware attacks have placed a premium on information about ransomware and what you can do to best protect your organization. Please note – ransomware attacks continue to spread, even as this blog is published, so new information may expand on (or contradict) what’s noted below. This post is current as of May 15, 2017. The attack, known as WannaCry (and many variant names such as WannaCrypt, WannaCryptor, etc.) is a derivative of an attack named Wana Decryptor which was first detected in early May attacking several UK hospitals. It quickly spread and by mid-day Saturday, May 13, 2017, an estimated 126,000 systems in over 100 countries had been impacted by this attack. There have been similar notable ransomware attacks against the National Health Service in the UK, Telefonica in Spain and FedEx in the United States. The attacker is deploying common ransomware techniques of encrypting a hard drive and demanding payment ($300 USD worth of bitcoins in this case, with an escalating ransom if not paid promptly). The attack leverages a vulnerability in the Microsoft Windows Operating System, identified in Microsoft security bulletin MS17-010. The vulnerability affects the SMB service (Server Message Block) which is used for file, print and other services within Windows. Two exploits that take advantage of this vulnerability – DoublePulsar...