Industry Intel

Girl Scouts and OpenText empower future leaders of tomorrow with cyber resilience

The transition to a digital-first world enables us to connect, work and live in a realm where information is available at our fingertips. The children of today will be working in an environment of tomorrow that is shaped by hyperconnectivity. Operating in this...

World Backup Day reminds us all just how precious our data is

Think of all the important files sitting on your computer right now. If your computer crashed tomorrow, would you be able to retrieve your important files? Would your business suffer as a result? As more and more of our daily activities incorporate digital and online...

3 Reasons We Forget Small & Midsized Businesses are Major Targets for Ransomware

The ransomware attacks that make headlines and steer conversations among cybersecurity professionals usually involve major ransoms, huge corporations and notorious hacking groups. Kia Motors, Accenture, Acer, JBS…these companies were some of the largest to be...

How Ransomware Sneaks In

Ransomware has officially made the mainstream. Dramatic headlines announce the latest attacks and news outlets highlight the staggeringly high ransoms businesses pay to retrieve their stolen data. And it’s no wonder why – ransomware attacks are on the rise and the...

An MSP and SMB guide to disaster preparation, recovery and remediation

Introduction It’s important for a business to be prepared with an exercised business continuity and disaster recovery (BC/DR) plan plan before its hit with ransomware so that it can resume operations as quickly as possible. Key steps and solutions should be followed...

Podcast: Cyber resilience in a remote work world

The global pandemic that began to send us packing from our offices in March of last year upended our established way of working overnight. We’re still feeling the effects. Many office workers have yet to return to the office in the volumes they worked in pre-pandemic....

5 Tips to get Better Efficacy out of Your IT Security Stack

If you’re an admin, service provider, security executive, or are otherwise affiliated with the world of IT solutions, then you know that one of the biggest challenges to overcome is efficacy. Especially in terms of cybersecurity, efficacy is something of an amorphous...

How Cryptocurrency and Cybercrime Trends Influence One Another

Typically, when cryptocurrency values change, one would expect to see changes in crypto-related cybercrime. In particular, trends in Bitcoin values tend to be the bellwether you can use to predict how other currencies’ values will shift, and there are usually...

The 5 most important rules for online shopping

The end of year holidays mark the busiest time of the year for online shoppers. We’re all rushing around trying to find the right gift that doesn’t break the budget. Throw in family time and stress can get out of hand.

Sadly, this time also marks one of the busiest times of year for online hackers. With the flurry of activity online, they know they’ve got ample targets.

Of course, not all targets are equal. Hackers would rather make a quick buck than spend their time forcing their way through in-depth security. That’s why it’s so important to follow the 5 most important rules for online shopping.

1. Strengthen your passwords

There’s no reason to still use the same password you came up with in high school. It’s a dirty truth that big businesses suffer data breaches – that means the longer you use a password the more likely it’s been hacked. Even if you’re not using that old website, hackers might know your information and will try logging in to common sites using your old email + password combination. We know it can be a pain to keep track of everything, and that’s why we recommend using a password manager service.

2. Visit reputable sites

We all want to score the best deals on holiday shopping, but the old adage is true – if it seems too good to be true, it probably is. You don’t need to go to sketchy sites to find the best prices. The biggest retailers have deals all season long. Plus, when you use a big site you don’t run the risk of getting a knockoff product.

3. Protect your WiFi

So much of our life is on the go, and holiday shopping is no different. Did you know that WiFi networks are often targeted by hackers and scammers? Even the one in your home can be spoofed, allowing thieves to steal your information. That’s even more true when you’re connected at the local coffee shop. With a VPN (Virtual Private Network – something all the best antivirus options offer), your information is secure no matter where you connect.

4. Invest in antivirus

You get what you pay for doesn’t just apply to your shopping. If you really want to make sure you’re safe online during the holidays, you want to make sure to invest in a reputable antivirus. No one wants a knock-off gifts – they’re low quality and unreliable. So why would you settle for a knock-off antivirus? Look for an option that has lots of good reviews, or even better go to a big box store and ask their experts for recommendations.

5. It pays to be suspicious

A healthy amount of suspicion can go a long way in protecting yourself while you’re shopping online (and let’s not get started on the sketchy ads we all get on social media). It’s always important to trust your gut. It’s also important to be wary of free money, unexpected calls from financial institutions and sites asking for personal information (rather than just billing info). And let’s not get started on the sketchy ads we all get on social media.

Holiday shopping can be stressful enough, don’t let it get worse with a stolen credit card or hacked computer. Follow the 5 most important rules for staying safe online and you can shop worry free and get back to celebrating.

Interested in learning about award-winning antivirus?

Discover Webroot.

Webroot™ Premium: The all-in-one protection for your devices and identity

The risk of becoming a victim of identity theft has never been greater

We are increasingly living our lives in the digital realm. Whether we’re banking, purchasing or browsing, our daily activities are most likely taking place online. Not only has this sped up our efficiency, but it has also expanded our exposure to a host of cybercriminals who are eager to use our personal information.

According to the Federal Trade Commissioner (FTC), incidents of identity theft and related fraud rose nationwide in the United State in 2021. Consumers lost more than 5.8 billion, skyrocketing over 70% from the previous year. The FTC received 5.7 million fraud and identity theft reports in 2021. Over a million of these reports were consumer identity theft cases.

The rise in identity theft and fraud means it’s especially important to secure not only the devices you use but also your personal identity.

Your identity is unique to you. Keep it that way with Webroot and Allstate Identity Protection

There are many steps you can take to ensure your identity isn’t compromised:

  • Shredding bank statements
  • Securing important documents
  • Ensuring your passwords are effectively managed
  • Investing in a quality antivirus for your devices

However, these actions won’t help you regularly monitor your financial accounts, scan for emerging threats or provide fraud or stolen funds reimbursement.

That’s where Webroot can help. Webroot has partnered with Allstate Identity Protection to offer two unique ways to preserve both your devices and identity: Webroot™ Premium and Allstate Identity Protection Add-on.

The same trusted antivirus but with the added bonus of identity protection

Webroot Premium is a combination of our top-of-the-line antivirus protection and Allstate Identity Protection.

Enjoy all the great benefits of our antivirus plus these great features:

  • Dark Web, financial and identity monitoring: Credit card and bank account transactions, 401(k) and account takeover
  • 24/7 U.S.-based customer care
  • 1 bureau credit monitoring
  • 550K in fraud expense and stolen funds reimbursement*

In addition to Webroot Premium, we’re offering existing customers the chance to keep their current Webroot subscription and just add identity protection with Allstate Identity Protection Add-on.

Experience the benefits of your current Webroot antivirus plus:                                              

  • Dark Web monitoring with social security trace
  • Financial monitoring with account takeover alerts
  • Identity monitoring, including identity health status updates
  • 24/7 U.S.-based restoration
  • $25K fraud expense reimbursement*

This holiday season, ensure your online shopping purchases remain secure while safeguarding your devices and identity with Webroot and Allstate Identity Protection.

Learn more about Webroot Premium and discover what our comprehensive protection can do for you.

Allstate Identity Protection Legal Disclaimer

*Identity theft insurance covering expense and stolen funds reimbursement is underwritten by American Bankers Insurance Company of Florida, an Assurant company. The description herein is a summary and intended for informational purposes only and does not include all terms, conditions, and exclusions of the policies described. Please refer to the actual policies for terms, conditions, and exclusions of coverage. Coverage may not be available in all jurisdictions. Product may be updated or modified. Certain features require additional activation.


Discover 2022’s Nastiest Malware

For the past year, hackers have been following close behind businesses and families just waiting for the right time to strike. In other words, 2022 has been an eventful year in the threat landscape, with malware continuing to take center stage.

The 6 Nastiest Malware of 2022

Since the mainstreaming of ransomware payloads and the adoption of cryptocurrencies that facilitate untraceable payments, malicious actors have been innovating new methods and tactics to evade the latest defenses. 2022 was no different.

The ransomware double extortion tactic continues to wreak havoc, with ransomware attackers threating to both steal your data and also leak it if you don’t pay up. But this year also saw the onset of the triple extortion method – with this type of attack, hackers threaten to steal your data, leak it and then also execute DDoS attack if you don’t pay up. As a result, many organizations are shifting away from cyber insurance and adopting layered defenses in an effort to achieve cyber resilience.

Ransom payments continued to balloon – last year at this time the average was just below $150,000 but it now stands close to $225,000 (that’s increasing faster than the rate of inflation, for those counting at home!).

In bad news (as if we needed more), malicious actors seem to have settled on a favorite target: small and medium sized businesses. Large-scale attacks make headlines, but hackers have found that smaller environments make for easier targets.

But it’s not all bad news… after all, the first step in defeating your enemy is to learn their tactics. Our researchers have been hard at work uncovering the worst offenders to better build defenses against them. With that, here are the 6 Nastiest Malware of 2022.

Here are this year’s wicked winners

Emotet

  • Persisting botnet with cryptomining payload and more
  • Infects via emails, brute force, exploits and more
  • Removes competing malware, ensuring they’re the only infection

Lockbit

  • The year’s most successful ransomware group
  • Introduced the triple extortion method – encryption + data leak + DDOS attack
  • Accept payments in two untraceable cryptocurrencies Monero and Zcash as well as Bitcoin

Conti

  •  Longstanding ransomware group also known as Ryuk and a favorite payload of trickbot
  •  Shutdown attempts by US gov have made them rebrand into other operations such as Hive, BlackCat, BlackByte, and AvosLockerWill leak or auction off your data if you don’t pay the ransom

Qbot

  • The oldest info stealing trojan still in operation
  • Works to infect an entire environment to ‘case the joint’ before its final stage
  • Creates ransomware Voltrons through partnerships with Conti, ProLock and Egregor

Valyria

  • Malspam botnet that starts with email attachments containing malicious scripts
  • Known for their complex payloads that can overwhelm defenses and evade detection
  • Partners with Emotet to create a two-headed monster

Cobalt Strike / Brute Ratel

  • White hat designed pen testing tool, that’s been corrupted and used for evil.
  • Very powerful features like process injection, privilege escalation, and credential harvesting.
  • The customizability and scalability are just too GOOD not to be abused by BAD actors

Protect yourself and your business

The key to staying safe is a layered approach to cybersecurity backed up by a cyber resilience strategy. Here are tips from our experts.

Strategies for business continuity

  • Lock down Remote Desktop Protocols (RDP)
  • Educate end users
  • Install reputable cybersecurity software
  • Set up a strong backup and disaster recovery plan

Strategies for individuals

  • Develop a healthy dose of suspicion toward messages
  • Protect devices with antivirus and data with a VPN
  • Keep your antivirus software and other apps up to date
  • Use a secure cloud backup with immutable copies
  • Create strong, unique passwords (and don’t reuse them across accounts)
  • If a download asks to enable macros, DON’T DO IT

New Research Exposes Hidden Threats on Illegal Streaming Sites

Regional restrictions on NFL game broadcasts and rising membership fees on streaming sites like Netflix, Hulu, and Disney Plus are just some reasons why frustrated consumers turn to illegal streaming sites. Marketed as an alternative to legitimate streaming services, illegal streaming sites have become a portal to connect criminals directly to you (their target).

Unlike official streaming platforms that generate revenue from advertising or user subscriptions, illegal streaming sites must find alternative ways to make money—even if that means giving cybercriminals access to your information. Not surprising, these sites open a gateway for criminals to access bank accounts, commit fraud, and install malicious software. While computer antivirus is effective, sometimes malware still wins. Even the most tech-savvy viewer can fall victim.

With the NFL season kicking off and a host of new fall shows and movies rolling out, findings from the UK serve as a timely reminder to sports fans and movie enthusiasts around the globe to be cautious.

Threats are Real

New research from our threat team reveals the extent to which consumers are being exposed to fraud, dangerous scams, and explicit content on illegal sports streaming sites. Analysis of 50 popular “free-to-view” sites during several major sporting events uncovered that every single site contained malicious content, while over 40 percent of sites did not have the necessary security certificate.

To help you decide whether using illegal streaming websites are worth the risk, let’s dive into some of the threats our intelligence experts uncovered during their analysis.

  • Banking trojans, a type of malware that is hidden under legitimate-looking software and designed to hack your bank accounts. For example, a banking trojan may be disguised as a mute button that, once clicked, automatically starts downloading a trojan onto your device. This type of malware acts extremely fast, and if your antivirus is not up to date, it may not recognize it.
  • Phishing webpages, the most common type of malicious threat, are websites designed to look legitimate to fool you into providing your credentials. These scams offer the ability to view premium content as long as you log into your email hub or another important account that would be later used for identity fraud.
  • Crypto scams, an increasingly popular malware that targets crypto apps on your phone. Crypto scams typically appear as pop-ups or redirects that show users fake stories of local politicians or celebrities to lure people into sophisticated financial ploys. These scams can seem very real and sometimes even imitate popular media publishing sites to sell the lie and get you to share your bank details. Another common crypto scam on these sites is malicious extensions that pretend to be a wallet for popular coins.
  • Explicit content has surged on illegal streaming sites and it’s becoming more prevalent and more extreme each year. If you frequently lend your children your device beware, you be unknowingly exposing them explicit content.

How to stay safe

Cybercriminals have a deep bag of tricks, but there are some red flags you can look out for. Most of the illegal sites analyzed ran HTTP as opposed to HTTPS. While the difference of a single letter may not seem like much, “S” is crucial as it indicates encryption. An HTTPS site isn’t a guarantee that a website is entirely safe. However, its absence should always serve as a red flag not to use it.

Illegal streaming sites also are flooded with pop-ups and redirects to grab your attention and convince you to click–don’t! Links are pretty common and can be disguised as anything, making users highly vulnerable. And if an offer looks too good to be true, it usually is.

Avoid anything that wants to install an extension as part of the requirement to view content. This major red flag will typically lead to malware or phishing redirects.

Of course, the best way to say safe is to avoid risky free-to-view sites. Reliable antivirus that blocks malicious webpages will prevent you from opening and falling victim to these sites.

Click here to learn more.

BrightCloud® Threat Report Mid-Year Update: Reinvention is the Name of the Game

When was the last time you secretly smiled when ransomware gangs had their bitcoin stolen, their malware servers shut down, or were forced to disband? We hang on to these infrequent victories because history tells us that most ransomware collectives don’t go away—they reinvent themselves under a new name, with new rules, new targets, and new weaponry. Indeed, some of the most destructive and costly ransomware groups are now in their third incarnation.

So, what does this mean for your business, your customers, your partners, and even your family as you vie to stay safe online and protect what matters most—data?

The OpenText Security Solutions threat intelligence team is sharing mid-year updates to our 2022 BrightCloud® Threat Report. With insight into the latest threats and trends, we are arming organizations with the knowledge they need to pivot and stay ahead of cyber criminals’ around-the-clock reinvention of malware, phishing, and brand impersonations.

MALWARE CONTINUES TO ITERATE, AND GROW

The ratio of malware that uses evasive techniques continues to iterate in the first half of 2022, with 89.3% of malware unique to one PC, up from 86.3% in the first half of 2021. Of those infected once, a secondary infection will occur with consumers (54%) and businesses (49%) indicating that consumers are still more likely to engage in riskier online behavior, increasing their likelihood of experiencing an infection

Malware Solution Option:

Windows 11 adoption remains very slow which highlights the importance of incorporating a layered security approach that includes DNS protection to help reduce infection rates.

Protective DNS services are essential components of today’s cyber resilience strategies because its protection not only offers added privacy, but also acts as a robust defense against malware. In fact, there are 31% fewer infections when endpoint and DNS protection are combined.

PHISHING PREYED ON A VOLATILE MARKET


Phishing activity was exceptionally high. Almost 20% of all first half of 2022’s attacks occurring in April, which was likely the result of tax season, the beginning of national gas hikes, and the baby food shortage.

Phishing continued to proliferate with 46% of all successful phishing attacks using HTTPS. Brands such as Google, Apple and PayPal were among the top ten so far this year for credential phishing, a process of obtaining login information from users.

Phishing Solution Option:

Consumers are still more likely to experience an infection than their business counterparts. Yet as more employees use personal phones and tablets for work, businesses must remain vigilant

Everyone benefits from ongoing security awareness training to reduce the likelihood of successful attacks that can wreak havoc on a business network and affect continuity.

The 2022 BrightCloud® Threat Report mid-year update emphasizes the need to increase cyber resilience using trustworthy and dependable security solutions like antivirus, DNS protection, and backup and recovery to help protect what matters most.

To learn more, go to: www.brightcloud.com

Strengthening cyber resilience in the UK through managed service providers

The UK government has released a National Cyber Strategy to help guide the country’s strategic approach to combating the proliferation of cyber threats. As part of this strategy, the UK government is looking to expand its regulations under the Network and Information Systems (NIS) to include managed service providers (MSPs). The government’s efforts follow a string of supply chain attacks targeting SolarWinds, Microsoft Exchange Servers and the Colonial Pipeline. The UK government has highlighted a number of barriers to proper management of supply chain risks, including low risk recognition, limited visibility and insufficient expertise and tools to evaluate suppliers.

This strategic move by the UK government involves widening the scope of the NIS regulations to include MSPs. Original NIS regulations came into effect in 2018 to optimize cybersecurity offerings provided by companies within the essential services industries – water, energy, transport, healthcare and digital infrastructure. Expansion of the NIS regulations to include MSPs informs part of the UK government’s broader strategy to improve the country’s overall cyber resilience.

MSPs provide critical digital outsourcing services for IT departments and manage key business processes for many organizations. As such, MSPs play a vital role in promoting a digital-first economy. The UK government wants to ensure MSPs are fully prepared to manage ongoing cyber threats and protect the data integrity of their customers.

As the UK government moves forward with its plans, part of its proposal involves defining what an MSP does, from a commercial perspective. Under the proposed regulations, MSPs could be required to enact reasonable and proportionate security measures to protect their network and proactively manage the risks associated with services provided to customers. As of late, the NIS regulations that are being proposed could carry reporting requirements and heavy fines for those MSPs that don’t comply.

Embrace regulatory shifts with ease

We know adapting to these new and evolving requirements can be overwhelming.

Carbonite + Webroot are here to help. We offer a suite of business solutions to help keep your customers secure with reliable always-on protection, backup and recovery solutions designed to fit your needs.

Find the best solution for your business.

Social engineering: Cybercrime meets human hacking

According to the latest ISACA State of Security 2021 report, social engineering is the leading cause of compromises experienced by organizations. Findings from the Verizon 2021 Data Breach Investigations Report also point to social engineering as the most common data breach attack method.

Social engineering is a term used to describe the actions a cybercriminal takes to exploit human behavior in order to gain access to confidential information or infiltrate access to unauthorized systems and data.

What does social engineering look like?

Social engineering can take many forms. Some malicious actors might trick you into giving your password or financial information away. They may also try and convince you to provide remote access to your computer or mobile devices. Cybercriminals are looking for ways to gain your trust and take advantage of your curiosity by sending messaging that contains malicious links or downloads.

“One method of attack bad actors use quite frequently involves spoofing legitimate vendor support centers. Cybercriminals will pretend to represent these organizations by posting sponsored ads online or through promoted search results. They will offer assistance and sell expired or stolen products of the vendor they have impersonated. These cybercriminals prey on unsuspecting individuals who offer up their personal and financial information because they believe they are in contact with the real vendor,” says Tyler Moffitt, senior security analyst at Carbonite + Webroot, OpenText companies.

Some common social engineering tactics include:

  • Impersonating someone. An urgent request from a ‘friend’ or person you may know is a common tactic used by bad actors to compromise your information by attempting to gain your trust.
  • A legitimate-seeming request from a trusted source. A phisher may send an email, message or text that appears to be from a legitimate organization you interact with. According to the latest IDG report, phishing attacks are on the rise.
  • Oversharing personal information online. Some cybercriminals will gather intel through social networking sites like Twitter or Instagram and use that information to spoof various services or places you visit.

“Oversharing personal information online is especially dangerous for public figures or prominent employees. Cybercriminals conduct research online through a user’s social media channels to determine where a person visits and what activities a person participates in. Cybercriminals will then spoof their target with seemingly legitimate messages from that vendor with attractive offers. All they need is a click,” says Moffitt.

Avoid becoming a victim

To outwit social engineering attacks:

  • Slow down and remain in control. If you receive a message that conveys a sense of urgency to act, carefully consider whether you should respond.
  • Beware of what you download. Use a reputable web browser and remain conscious of what links you are accessing before clicking on them. Avoid downloading free applications that may possess remote access trojans that can compromise your device.
  • Delete any requests to provide financial information or passwords and report them as spam. Avoid responding to requests for help or offers to assist from individuals you don’t know.
  • Invest in security awareness training. Prevent your devices from becoming compromised by common attack vectors by investing in security awareness training. Testing yourself regularly with phishing campaigns can help you learn what to avoid.

As cybercriminals continue to exploit human behavior and take great strides to make their attack vectors appear harmless, it’s important to remain vigilant of how cyber threats continue to evolve.

Webroot offers a number of solutions to help you tackle these ongoing cyber threats. Experience powerful and reliable protection from Webroot that won’t slow you down. Whether it’s updating your antivirus software or learning to spot phishing traps with security awareness training, Webroot has you covered.

Find the best solution for your home or your business.

Considering cloning? Combat data bloat with file transfers instead.

If you own a computer that seems to have slowed to a crawl, you may be thinking about replacing it. But what about all the files on your old dinosaur? You may be thinking about transferring them to an external hard drive, a time-consuming and tedious process, or you may have heard of the far simpler process known as “cloning.”

Cloning is the act of creating a direct, one-to-one copy of a hard drive. Like the term suggests, cloning a computer will leave you with an identical copy of all the particular apps, files and settings on the device, which a user can then install onto a new one or keep as a backup in case something disastrous happens to the original.

Cloning is a pretty simple procedure and there are a lot of free tools to help you do it. But one problem it won’t help you solve is data bloat. Bloat is unwanted data that slows down a computer. This unwanted data can come in all types of different forms. It could be music, photos, games and apps, spreadsheets or text documents. One specific type of bloat, known as “software bloat,” occurs from successive updates to a computer program as they’re layered over one another time after time.

Generally, bloat is the result of the steady accumulation of more and more data as it’s added to your computer. Bloat eats away at the available memory on your hard drive and can lead to performance issues, most notably, slowing it down. If you’re experiencing frequent crashes, it may also be a problem with a corrupted file trying to execute.

You can’t clone the bloat away

Here’s where the problem with cloning comes in. Since a slow computer is a common reason for getting a new one, and cloning simply replicates all the data already stored on a device, it may not be the best strategy for getting existing files from an older computer onto a new one. Given that you’ve also probably updated your hardware, it won’t slam the breaks on your processing speeds immediately, but it’s an added burden right out of the gate.   

An alternative strategy is to back up your old device to the cloud and migrating files to the new one as needed. When done this way, all the old and unnecessary files you don’t think to update yourself aren’t taking up space on your shiny new laptop. When automatic cloud backup is installed, all the latest files from the initial computer exist online, ready to be pulled down to your device whenever a local copy is needed.

Transferring data piecemeal can also help identify anything problematic that’s causing a device to crash. Once isolated, it can be easier to uninstall or delete.

By storing the majority of your files in the cloud, you ensure free space remains on your hard drive log into the future. It’s less taxing on your device, and you’ll notice better performance as a result. There are also organizational benefits to having old files stored in one convenient location. If you’re combing for tax documents from previous years, for instance, you know where to grab them from your old drive. Without having to having to watch an old laptop inch along.

So, when it comes time to replace an old computer, think twice about cloning. Choosing cloud backup from Carbonite could help extend the life and improve the performance of that new device.

3 Reasons We Forget Small & Midsized Businesses are Major Targets for Ransomware

The ransomware attacks that make headlines and steer conversations among cybersecurity professionals usually involve major ransoms, huge corporations and notorious hacking groups.

Kia Motors, Accenture, Acer, JBS…these companies were some of the largest to be compromised by ransomware in 2021. These were mainly hit with well-known variants, sometimes unleashed by state-backed hacking groups. But it’s key to understand that no “Top 10” list of ransomware incidents paints an accurate – or at least comprehensive – picture of the impact ransomware played over the last year.

That’s because, small businesses and not-for-profit organizations are often hit the hardest by ransomware. Here are a couple factors to consider that might help reframe how we think about ransomware, who’s targeted and why small businesses can’t escape the gaze of ransomware groups.

  1. Attach Surface vs. Cybersecurity Resources

In our 2021 Webroot BrightCloud® Threat Report, we found overall infection rates to be rising fastest in the healthcare, non-profit and arts/entertainment/recreation industries. Schools, local governments and hospitals are some of the most commonly targeted types of institutions, accounting for some 2,400 breaches in 2020, according to the Ransomware Task Force’s (RTF) 2021 report.

We don’t typically think of these organizations as having excess budget earmarked for ransomware actors, so why are they so often targets? What makes them attractive to cybercriminals? It turns out, it’s exactly this lack of resources.

Often operating with limited IT budgets, hospitals, schools and local governments also typically run some of the most complex and difficult to secure networks. Spread out over multiple locations and responsible for hundreds or even thousands of devices – factors referred to as the “attack surface” in information security – make these institutions attractive targets. To make matters worse, a shortage of cybersecurity professionals and budget constraints mean they handle these challenges short-staffed.

As a result, public school systems, police departments and towns were among major compromises in recent years.

  • “Average” Ransomware Costs Can Be Misleading

Many security companies justifiably try to quantify the costs of ransomware year over year. While almost all agree both the number of attacks and the demanded ransoms are rising, these stats can obscure the real story.

Leaving aside the fact that they’re almost certainly underreported – businesses tend not to disclose ransomware incidents to avoid negative publicity and fines from regulatory agencies – a few high-profile incidents can drive up averages and distort the perceived cost to small businesses.

“I could never afford a $50 million ransom like the one hackers demanded of Acer,” the thinking goes, “so I must not be worth their time.” While understanding, this conclusion misrepresents the problem.

In fact, the median ransom demand in 2021, according to advanced findings from our upcoming threat report, was $70,000. Still potentially bankruptcy-inducing, this figure is within reach for a far greater number of businesses. Hence, a larger number of businesses are considered acceptable targets by criminals actors.

  • Ransomware as a Service Changed the Game

Maybe it was the case once, but malicious actors no longer have to be savvy behind a keyboard. Ransomware as a service (RaaS) is an increasingly popular business model among malicious actors where interested parties can buy ransomware “products” – malicious code meant to encrypt a target’s files – from a developer online.

According to the RTF, “In 2020, two-thirds of the ransomware attacks…were perpetrated by cyber criminals using a RaaS model.”

While supply chain attacks and major breaches of global corporations still require a good deal of technical sophistication, cracking the dentist’s office down the street no longer does. All that’s needed is a working knowledge of the dark web, a connection to a developer with loose morals and some startup capital to purchase the code.

This means casting a wider net with smaller ransomware demands threatens to ensnare more small and midsized businesses than before this business model emerged.

Securing small businesses in the crosshairs

Business owners and the MSPs that secure them can see how a set of factors are converging to increase the cybersecurity risks to businesses of all sizes. Luckily, there are a few steps, relatively easy to implement, that can help these organizations reduce their risk of falling victim to ransomware – or to limit the scope of any successful attacks.

These include:

  • Locking down Remote Desktop Protocols (RDP) – As the trends from 2021 emerge, it’s become clear that open RDP ports are the most common method of compromise among small businesses. They’re simply too easy for cybercriminals to discover and exploit, so lock them down.
  • Educate end users – The next common method of compromise is phishing attacks, independent of company size. But our research suggests that regular phishing simulations can dramatically reduce click-through rates among frontline users.
  • Install reputable cybersecurity software– What used to be the main method of defense against malware is now only a single method of defense, but it’s still a critical one.
  • Set up a strong backup and disaster recovery plan– Misconfigurations and user-enabled breaches are almost impossible to stop entirely. Having backups of critical files can reduce the pressure to pay a ransom and undermine the leverage cybercriminals have against a business.

Interested in learning more about ransomware and its effects on businesses? Download our eBook on the Hidden Cost of Ransomware.

Threat hunting: Your best defense against unknown threats

Threat actors are becoming more sophisticated, agile and relentless in their pursuit of stealing personal information for financial gain. Rapid and evolving shifts in the threat landscape require the knowledge and solutions to prepare and prevent threats that could spell disaster for organizations’ reputations and operations.

Organizations of all sizes remain at risk. Small to medium-sized businesses (SMBs) and managed service providers (MSPs) are especially vulnerable to the stealth efforts of bad actors. With fewer financial resources, a ransomware payment demand could mean the difference between staying in business and closing up shop.

Government entities are also prone to attack. In December 2021, Belgium’s Ministry of Defence experienced a cyberattack exploiting the Log4j vulnerability that paralyzed the ministry’s computer network. Within the same month, Australia’s utility company, CS Energy, experienced a ransomware attack involving the well-known ransomware Conti.

Evolving cyber threats can be unpredictable, but that doesn’t mean businesses have to tackle them alone. A robust security stack can help businesses stay protected and prepared. Establishing this level of resilience involves partnering with a provider that has human-powered threat hunting resources.

What is threat hunting?

Threat hunting involves actively searching for adversaries before an attack is carried out. Threat hunting involves the use of tools, intelligence and analytics combined with human intervention. Threat hunting centers around the proactive containment and identification of potentially damaging files before malicious vectors can cause severe damage to an organization’s operations.

What does a threat research analyst do?

“At Webroot, we focus our efforts on analyzing customer data. Our threat research analysts examine this data to determine if malicious files are present. Our analysts are constantly looking for files that possess certain characteristics that make up various types of malware. If we identify and determine that critical elements of a suspicious file are present, we classify and block them. Making determinations can be approached in different ways. One avenue of determination is carried out by creating isolated conditions to run the suspicious file to see what results it presents,” says Marcus Moreno, manager, threat research at Carbonite + Webroot, OpenText companies.

“Since our database is comprised of mass quantities of SMB and MSP data, we can continue to make determinations from a large and evolving data set. This is why SMBs and MSPs can derive value from partnering with Webroot,” adds Moreno.

Take your security stack to the next level

Cyberattacks will continue to be a concern for businesses, governments and individuals. Combatting cyber threats means adopting a cyber resilience approach. Cyber resilience is the ability to remain operational in the face of threats – whether human or maliciously-based. One important element of a solid cyber resilience strategy is to remain in a pre-emptive and proactive stance. Avoid costly ransomware payment demands, bolster customer confidence and minimize downtime for business operations by investing in a solutions provider backed by threat hunting capabilities.

Discover how Webroot’s solutions can protect your business.

Report: Phishing Attacks Sustain Historic Highs

Phishing attacks sustain historic highs

In their latest report, IDG and the pros behind Carbonite + Webroot spoke with 300 global IT professionals to learn the current state of phishing. We learned that 93% of IT executives are still concerned about phishing – and it’s no wonder, as companies averaged 28 attacks each over the previous 12 months.

Luckily, the report details how to fight back. With the right preparation and the right protection, companies can prevent all but 0.3% of attacks.

Phishing capitalizes on COVID

Phishing attacks have been part of the cybercriminal arsenal for years. But it’s only recently that phishing has flourished into the scourge it is today. That’s because cybercriminals have found success by targeting COVID-19 fears with their schemes.

In fact, phishing attacks spiked by 510% from just January – February 2020, according to the 2021 Threat Report. These increases leveled off by the summer, but phishing attacks still increased 34% from September – October 2020. Overall, 76% of executives report that phishing is still up compared to before the pandemic.

COVID-based tactics might purport to have new info on a shutdown, to share COVID stats or even suggest info from your doctor. But in each case, cybercriminals are looking to steal your information.

Who’s getting attacked?

IT departments are feeling the brunt of these attacks, with 57% of them targeted by phishing. Carbonite + Webroot Sr. Security Analyst Tyler Moffitt says, “Even if malware targets someone with lower-level access, the attack will move laterally to eventually find an IT administrator.”

He goes on to say that attackers can then linger for a week or more to find valuable data or steal a balance sheet that gives an indication of how much ransom to charge.

Because they often have important credentials, top executives and finance groups are also common targets. Public-facing customer service employees also offer easy access.

Consequences of phishing

75% of global IT executives say they’ve suffered negative consequences from phishing attacks. That includes:

  • 37% suffered downtime lasting more than a day
  • 37% suffered exposure of data
  • 32% lost productivity
  • 19% had to pay legal or regulatory fines

A layered approach to security

But it’s not all bad news. Yes, phishing is using new tactics to target businesses. But there are ways to fight back.

The report cites training as one of the most effective tools. But the frequency of training varies greatly, and 25% of those who use it don’t include phishing simulations. By using security awareness training that offers regular simulations, you can reduce phishing by up to 70%.

But even with great training, the report notes that people will still click some of the time. That’s why a multi-layered approach gives peace of mind that not all is lost if one person messes up.

No layer is 100% effective, but taken together many layers get very close. A defense in depth security posture utilizing DNS and endpoint detection as well as a sound backup strategy can give you confidence that you’re prepared to withstand even a successful phishing attack.

Ready to start protecting yourself and your business? Explore how Carbonite + Webroot provide a full range of cyber resilience solutions.

Download the IDG report.

Data Privacy Week 2022: The Security Awareness Canary in the Coalmine

Whether you’re shopping for the latest tech gadgets or checking your work email, your online presence is susceptible to malicious threats. No industry or sector is immune. Even in the early days of 2022, a hospital in Jackson, Florida, experienced a ransomware attack that left medical professionals struggling to access patient records. Attacks like this not only have implications for patient care, but they also serve as a stark reminder of ongoing privacy issues in the online realm. As consumers and businesses are becoming increasingly more concerned about their data privacy, understanding how to protect that information becomes vital.

This week, the global community is rallying together to raise awareness about online privacy through Data Privacy Week.

What is Data Privacy Week?

Data Privacy Week began as a day of awareness in the United States, Canada and Europe and to commemorate the signing of Convention 108, the first internationally binding agreement addressing privacy and data protection. This year, the initiative has expanded to a week-long effort to generate awareness.

As data privacy and security implications become important for both businesses and individuals, there are a series of steps everyone can take:

  • Adopt privacy mindfulness. Whether it’s for your home or your business, ensure you take privacy into account when you agree to the terms and conditions of items available for download from the internet or when you create a program that may expose your employees to online risk.
  • Educate yourself. Avoid common attempts to compromise your information and identity by investing in security awareness training. Participate in simulated modules to test your knowledge and learn what traps to avoid.
  • Back up your precious files. Not ready to part with your personal information? Make sure it’s backed up. That way, if you experience accidental or malicious data loss, your information is secure and accessible.
  • Use antivirus software. Ensure online activities like shopping and browsing are secure by investing in a reliable antivirus. Adhere to updates and always renew your subscription to avoid a lapse in protection.
  • Partner with a reliable provider. Some providers offer free protection and backup solutions, but can you really trust them? Always do your research and select a reputable provider to keep your devices and data safe.

From the rise of ransomware as a service (RaaS) to the use of malware to disrupt the political landscape, security, privacy and governance remain at a crossroads. With no signs of a resolution apparent, it’s important for everyone to take stock of their security stack.

One reliable approach is to adopt cyber resilience. Cyber resilience is a multi-layered, defense in depth strategy to ensure continuous access to your personal and business data no matter what happens.  Establishing cyber resilience begins by assessing your current defense approach and employing the tools and know-how to remain protected and prepared for unknown threats. Whether it’s taking the time to educate your staff, upgrading your antivirus solution or investing in a reliable backup provider, make cyber resilience a priority.

This Data Privacy Week, let’s move beyond just becoming more aware of bad actors. Let’s take action to protect our data and our privacy.