Ransomware Attack: Impact Assessment

According to numerous open-source reports,ƒwidespread ransomware campaign is affecting various organizations with reports of tens of thousands of infections in as many as 74 countries, including the United States, United Kingdom, Spain, Russia, Taiwan, France, and Japan. The software can run in as many as 27 different languages.

The latest version of this ransomware variant, known as WannaCry, WCry, or Wanna Decryptor, was discovered the morning of May 12, 2017, by an independent security researcher and has spread rapidly over several hours, with initial reports beginning around 4:00 AM EDT, May 12, 2017. Open-source reporting indicatesƒ requested ransom of .1781 bitcoins, roughly $300 U.S.

Initial reports indicate the hacker or hacking group behind the WannaCry campaign is gaining access to enterprise servers either through Remote Desktop Protocol (RDP) compromise or through the exploitation of ƒ critical Windows SMB vulnerability. Microsoft releasedƒ security update for the MS17-010 vulnerability on March 14, 2017. According to open sources, one possible infection vector is via phishing emails.

Systems Affected:

1. Microsoft Windows operating systems.

Recommendation to prevent from being infected:

1. It is recommended to restrict access to www.gmail.com for time being as there would be chances to get malicious files accessed or links opened from this site which may prove potential threat to DOP environment as we don’t have any administrative control over www.gmail.com
2. It is required to ensure that all the systems in field must be having AV installed and up to date with latest virus/malware definitions (Symantec released virus signature update for this ransomware on May 12, 2017) to prevent possible attacks. Run Symantec AV Full scan on the systems.
3. It is recommended to not to open unknown urls(links)/files or not to download unknown attachments from any sources.
4. It is strictly recommended to use only sify network(Do not use hotspots or wifi). Also not to attach any pen drives or flash drives to systems.
5. It is required to sendƒnotification message through portal to all users of field to make them aware about this attack and preventive measures to be taken.
6. It is required to ensure that DC/DR servers of all SIs must be updated with latest patches, having latest AV definition and open vulnerabilities from scan should be closed.
7. Until required, DO NOT share any file/folder within LAN also. As it would help to propagate malware rapidly.

Symptoms ofinfected system :

1. One may observes system files are not in readable format or encrypted.
2. One may unable to start system(Screen showing some fatal/error message).
3. If any file having extension as .wncry, .wcry, .wncryt and .wnry [Do not open/download such file]
4. As per SEPM configuration, if any system is infected with such malware,ƒpopup message will be prompted to enduser [Run “Full Scan” on the systems with latest AV definition file].

Prompt action tobe taken by End-user:

1. End user should raise ticket on service desk along with abnormal behavior of system observed.
2. It is requested to run AV Full scan, if possible and attach screen shot of successfully completion of same to raised service desk ticket.
3. If the system is not accessible at all, then immediately remove the system from LAN and format the system.Restoration of the Backup Files is to be attempted only if the backup files are not infected.
4. After bringing the system up with Antivirus, use the same port to join the system into domain, to avoid mac binding issues.