Ransomware Threat Brief

Presenter Date Bill Wright 6/29/2017 Government Affairs Evolution path MISLEADING APP FAKE AV LOCKER RANSOMWARE CRYPTO RANSOMWARE

2005-2009 2010-2011 2012-2013 2014-2017

“FIX” “CLEAN” “FINE” “FEE”

o Highly profitable o Low Barrier to Entry - Multiple Software as a Service offerings available

3x as many new ransomware families in 2016

101

30 30

2014 2015 2016

Ransomware Detections by Country

o With 34% of all attacks, US the region most affected by Ransomware o Attackers target countries that can pay the largest ransom o Number of internet connected computers also effect the numbers o But US also has characteristic that is driving up the cost of the ransom

Average Ransom Demand The average starting ransom $1,077 o demand soared in 2016. Once infected many threats o raise price if ransom not paid by deadline Some criminals will o negotiate Targeted businesses will see o higher demands Highest ransom demand for $294 o single machine seen in 2016 - $28,730 (Ransom.Mircop) 2015 2016

What is Driving Up the Ransom Demand?

Percentage of Consumers Who Pay Ransom 64% US o There does not appear to be price sensitivity among victims, especially in the 34% US Globally - As long as victims willing to pay, criminals can raise the price

WannaCry Ransomware Generating Significant Global Attention

Security Stack Internet

• Microsoft announces SMB vulnerability and patch within MS17-010 • Shadowbrokers release EternalBlue in their datadump which exploits this Microsoft SMB vulnerability • WannaCry is seen in the wild and initial compromise vector unknown • WannaCry encrypts files for ransom on host and propagates to other unpatched/unprotected hosts

• Code used/borrowed from other Lazarus attacks • Earlier versions of WannaCry found on computers with Lazarus tools • Precedence exists: SWIFT Attacks $81million

DHS’s National Cybersecurity and Communications Integration Center (NCCIC)

Cyber Threat Alliance

Thank You!

Symantec delivers protection to Symantec delivers further Microsoft announces block SMB exploitation of MS17-010 updates to protect against Continuous Protection vulnerability MS17-010 including blocking for EternalBlue for WannaCry is first potential new variants for and releases patch SEP14, SEP12 and Norton seen in the wild SEP14, SEP12 and Norton Critical Systems Protection (CSP) Data Center Security (DCS) March 14 April 14 May 2 May 12 – 1AM Central US May 12– 3PM Central US Cloud Workload Protection (CWP) IT Management System (ITMS) Control Compliance Suite ShadowBrokers Symantec Endpoint Symantec Global (CCS) release Advanced Machine Intelligence Network Malware Analysis / Cynic EternalBlue Learning and Norton instantly adapts providing MSSP automatically block most protection to SEP14 and Cyber Security Services variants of WannaCry Blue Coat ProxySG