Chapter 1 Spotlight on Cyber Threats Featured Topic Ransomware — An Evolving Threat Malware In 2019, more ransomware cases were reported to CSA. While there was an increase in the number of Command and Control (C&C) servers observed in Singapore, there were fewer botnet drones detected as compared to 2018. Big-Game Hunting Ransomware Cybercriminals have been CSA received 35 reports of ransomware cases in 2019, an increase observed to be shifting from from 21 cases in 2018. Systems across various industries including gaming, travel and tourism, manufacturing, and logistics were affected. the indiscriminate targeting of victims to enterprise ransomware attacks, or “biggame hunting”, where they Troldesh Campaign target large organisations in hope of higher payouts. Several countries were affected by that traditionally used phishing a Troldesh (also known as Shade) to obtain personal and financial campaign in February 2019, where information have also turned to sharp increases in infections with ransomware to generate more the ransomware were detected and revenue. Besides demanding a reported by various cybersecurity ransom to unlock the system or data, firms.17, 18 Delivered primarily by some cybercriminals have also been phishing e-mails and spread by spam known to expose or sell the data that containing malicious zip attachments, they have obtained. Precautions Troldesh uses a strong encryption against ransomware attacks include algorithm to encrypt files. It also mines encrypting important or sensitive cryptocurrency on compromised data, to minimise damage even if systems, and generates traffic to the data is accessed, as well as websites to earn revenue from online regularly backing up important files advertising. Affected systems typically and storing them offline. In the event receive many identical ransom notes of a successful attack — and where Multiple city and local governments in the USA, as well as manufacturers such as Norwegian aluminium company Norsk Hydro, were affected by ransomware strains such as Ryuk, RobbinHood, and LockerGoga in targeted attacks. In Singapore, a logistics company and an IT equipment supplier were infected with Ryuk in October and December 2019, respectively. Ransomware globally are stealthier and designed specifically to written in both Russian and English. decryptors are unavailable — data restoration can then be performed in Singapore were infected by the with the back-up after reformatting ransomware as well. the system to remove the malware. These strains are unlike Given the evolution of cybercriminal earlier strains that usually tactics in combining ransomware menace. Cybersecurity firm FireEye attacks with threats to leak the noted how the successful monetisation affected data unless victims pay of ransomware attacks have further up, companies also need to develop contributed to an increase in overall contingency plans to deal with ransomware cases.19 Cybercriminals such incidents. 17 18 19 14 exploit, propagate and take down the networks of targeted organisations. relied on e-mails or system vulnerabilities to spread, such as during the 2017 WannaCry and NotPetya malware outbreaks. Arntz, Pieter. “Spotlight on Troldesh ransomware, aka ‘Shade’,” Malwarebytes Labs, 5 March 2019, https://blog.malwarebytes.com/threat-analysis/2019/03/spotlight-troldeshransomware-aka-shade. Delos Santos, Ace. “Russian Spam Delivers SHADE Ransomware via Link Embedded in PDF,” Trend Micro — Threat Encyclopaedia, 13 February 2019, https://www.trendmicro. com/vinfo/be/threat-encyclopedia/spam/689/russian-spam-delivers-shade-ransomware-via-link-embedded-in-pdf. FireEye Mandiant M-T’rends 2020 Report, https://www.fireeye.com/current-threats/annual-threat-report/mtrends.html. SINGAPORE CYBER LANDSCAPE 2019 for files containing illegal content, and then demanded ransom payments disguised as “penalty notices” after threatening their victims with fake legal proceedings, or having their personal data and illegal content leaked. Targeted data breaches, such as that in 2017 when a hacker compromised the network of media company HBO and threatened to release stolen files unless the US$6 million ransom was paid, can also easily lead to data being held hostage. In late-2019, operators behind the Maze ransomware retaliated by publishing files allegedly stolen from their victims who refused to pay the ransom. Such tactics — combining extortion and doxxing — were subsequently adopted by other ransomware operators behind Sodinokibi, BitPylock and Nemty. This is not the first time similar tactics have been observed. Earlier in 2016, the Ransoc ransomware scanned systems As the ransomware threat continues to evolve, robust cybersecurity practices remain the best defence. Systems and networks should be regularly patched, while individuals should not reuse credentials across accounts. They should also be wary of cyber threats posed by both phishing and malspam — or malicious spam — e-mails. After all, as the adage goes, prevention (of ransomware infections) is better than cure. strains used in such attacks A number of companies operating Ransomware will continue to be a To counter global initiatives20 aimed at mitigating the scourge of ransomware, and ensure their ransom demands are met, cybercriminals are leveraging the ability of new ransomware strains to exfiltrate data in addition to encrypting it, by forcing organisations to choose between paying the ransom and facing the consequences of having the stolen data released publicly. The exfiltration of data highlights how ransomware incidents should also be regarded as data breaches. 20 The No More Ransom project, led by various law enforcement agencies and private cybersecurity firms, aims to help ransomware victims retrieve their encrypted data without having to pay the cybercriminals. According to Europol, as of July 2019, free decryption tools offered by the project have prevented cybercriminals from making at least US$108 million in ill-gotten gains. The National Cybersecurity Centre of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) in the USA has also developed a recovery guide “Data Integrity: Recovering from Ransomware and other Destructive Events” to help ransomware victims mitigate related issues. 15