DHS Warns of SamSam Ransomware
The Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) and the Federal Bureau of Investigation (FBI) issued a warning about SamSam ransomware. NCCIC posted a bulletin warning that SamSam hackers are targeting multiple industries, some of which maintain critical functions. Hacked companies were mostly in the United States, however, some are in other countries although the bulletin did not specify where.
SamSam ransomware is also known as MSIL/Samas.
How Does SamSam Ransomware Work?
Hackers exploit Windows servers to gain access to a network. All reachable hosts are infected with the SamSam ransomware after the system is breached. SamSam hackers then grant themselves administrator privileges. Malware is injected on the server which then, in turn, runs an executable file. While many ransomware campaigns rely on a victim completing an action, such as opening an email, downloading a file, or clicking on a link, SamSam can infect an IT system without any interaction from the user.
Hackers use Remote Desktop Protocol (RDP) to gain persistent access to victims’ computer networks. Access is gained through brute force attacks or stolen login credentials. Brute force attacks are when automated dictionaries are used against a computer system to try millions of password combinations in a short period of time. Hackers can also buy login credentials on the dark web or use other information obtained through social engineering to gain access.
Like all ransomware, SamSam hackers demand a ransom in the form of Bitcoin via the dark web. After paying the ransom victims usually, receive links to download cryptographic keys to regain control of their network.
DHS and FBI recommend the following steps to strengthen system security:
- Audit your network for systems that use RDP for remote communication. Disable the service if unneeded
- Verify that all cloud-based virtual machine instances with public IPs have no open RDP ports, especially port
- Any system with an open RDP should be behind a firewall and require a virtual private network (VPN) to access it
- Force the use of strong passwords
- Lockout users after multiple unsuccessful login attempts to defend against brute force attacks
- Use two-factor authentication (2FA)
- Ensure that all hardware and software is kept up-to-date.
- Schedule regular data back-ups
- Require third party RDP service access to adhere to internal policies for remote access
- Disable RDP on critical devices.
- Regulate and limit external-to-internal RDP connections
- Restrict the ability permissions to install and run software applications.
- Scan for and remove suspicious email attachments
- Ensure the scanned attachment is its true file type meaning the file extension matches the file header)
- Disable file and printer sharing services
.
