Just when you think you have malware figured out, someone has to go and make a customizable version that can be executed by just about anyone; even if he or she isn’t much of a techie.
PandaLabs researchers have come across a type of malware that allows the attacker to choose which computers on a network and/or which files on a computer to encrypt. It comes equipped with a user-friendly interface that the attacker uses to set up the malware the way he or she sees fit before sending it out into the corporate world.
According the PandaLabs researchers, it is a WYSIWYE malware: What You See Is What You Encrypt. It accesses a network (typically a corporate one) using brute-force techniques through the remote desktop connection.
Recommendations for those in charge of a network are to make sure all RDP connections are closed to the Internet. If remote access to computers is needed, require the users to install a VPN. Once they are logged into the network through that, an RDP connection can be opened.
In addition, change the default port for RDP connections from 3389 to something else. Then block access to 3389.
This is yet another example of how the cybercriminals are staying one step ahead of the tools and techniques used against them. That is why an organization should continue to remind its users that they are also an important link in the chain of defense for corporate security.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
