Chapter 1 Cyber Threats Singapore Faces CASE STUDY CASE STUDY Compromised Gmail Account Individual infected with Ransomware WHEN CASE ANALYSIS WHEN FOLLOW-UP ACTION February 2016 A hyperlink was observed when the mouse cursor hovered over the attachment icon. The hyperlink directed the individual to a website set up to phish information from Internet users. February 2016 As a decryption tool for this ransomware was available online, SingCERT guided the affected individual in using it to restore his files. The individual was also advised on cyber hygiene best practices to avoid being infected again. BACKGROUND An individual reported to SingCERT that his Gmail account may have been compromised. This was after he had clicked on an attachment in an e-mail that led him to a website apparently containing Google Doc templates. At the website, he was prompted to enter his e-mail password. Concerned that he might have already gone too far by opening the attachment, he checked with the sender of the e-mail, who informed him that the e-mail was fake. EVIDENCE Suspicious e-mail with a malicious document attached. 18 TACTICS, TECHNIQUES & PROCEDURES E-mail with suspicious links or malicious attachments, stealing credentials. FOLLOW-UP ACTION SingCERT advised the individual to check if his account had indeed been compromised by reviewing the log-in sessions via his Gmail security settings, a section which would show the devices that had access to his account. SingCERT also advised the individual to strengthen his e-mail account settings by activating the Two-Factor Authentication option. BACKGROUND An individual reported to SingCERT that his computer was displaying a message that his files had been encrypted, and that payment in Bitcoins was required to restore the files. EVIDENCE Ransom note displayed on computer screen, detailing steps that needed to be taken to decrypt the files. CASE ANALYSIS SingCERT found that the individual’s computer had been infected with the CryptoLocker ransomware. TACTICS, TECHNIQUES & PROCEDURES Malware infection, encryption. Screenshot of Ransom Note 19