Although most of the damage caused by ransomware comes from indiscriminate, untargeted attacks using software such as Locky and GlobaImposter, devastating, sniper-like targeted attacks are on the rise.
In a targeted attack, criminals select a vulnerable organisation and tailor their approach to cause maximum damage and disruption. This gives them greater leverage to extort large ransoms.
One popular tool for hackers operating in this way is SamSam ransomware, also known as Samas.
SamSam attacks are relatively rare and appear to focus on the healthcare, government and education sectors. No two attacks are the same, although they share common elements. The SamSam software configuration and ransom demands vary from victim to victim, with demands reaching US$60,000.
Bitcoin addresses linked to SamSam have received over US$1 million in ransom payments this year.
Given the nature of these attacks, precise details are scarce. SophosLabs has investigated recent attacks and uncovered new information about how the ransomware has evolved over the past few months. For more details, please read our white paper SamSam Ransomware Chooses Its Targets Carefully.
Protect your business!
Although the hackers’ approach varies from target to target, exploiting each organisation’s specific weaknesses, there are common themes that deserve particular attention.
1. Close every door
SamSam attacks often begin with attackers exploiting weak passwords on RDP accounts.
If you don't need RDP, disable it.
Make sure users have strong passwords.
Enable two-factor authentication (2FA) wherever possible.
Only accept RDP connections from authorised computers.
Set a lockout policy to limit the number of password attempts.
2. Patch all vulnerabilities
SamSam attackers are also believed to have gained access to targets' networks by exploiting Java deserialisation vulnerabilities and unpatched JBoss systems, taking advantage of security flaws such as CVE-2010-0738, CVE-2012-0874 and CVE-2010-1428.
Of course, it is reasonable to assume that the SamSam hackers will exploit any publicly known vulnerability that serves their purposes, so this is not an exclusive list - the usual advice to keep up to date applies.
3. Keep things clean and tidy
If an attacker gains access to your network, shutting them out is rarely as simple as spotting a single, obviously malicious file. Many of the tools used in SamSam attacks are chosen precisely because they are legitimate pieces of software already present on your network, such as PsExec, Powershell, WScript or CScript.
If you are already a Sophos customer, you can use Application Control to manage access to legitimate applications within your organisation. For example, you can ensure that administrators who need Powershell have access to it, while ordinary users do not.
SamSam has been used with PsExec to help it spread across networks. By default, our products detect and block PsExec as a potentially unwanted application (PUA).
Administrators should ensure that PUA scanning is enabled and that PsExec has not been added to the authorised list. If you need to use PsExec, you can authorise it only for the users who need it and revoke that authorisation once you have finished.
4. Get a good watchdog (or two)
Each layer of security you have is designed to address a different type of threat, and a defence-in-depth strategy using multiple overlapping layers of protection remains the best approach.
Sophos Endpoint and Server block current versions of SamSam as Troj / Samas-F, Troj / RansRun-A and Mal / Kryptik-BV.
Customers with Intercept X or Exploit Prevention are protected against SamSam by our CryptoGuard anti-ransomware protection.
For customers with Central Server Advancedlicences, Server Lockdown (allowlisting) can be used to protect your servers against unauthorised changes.
Customers using Sophos Central in combination with the XG Firewall can use the Security Heartbeat ™ feature, which enables your endpoints to communicate with your firewall and lets you create policies that automatically isolate a machine when a detection is reported.