SamSam malware puts 2,100 servers at risk of Ransomware attack
A new study by Cisco Talos revealed that more than about 2,100 servers across 1,600 different networks have been compromised. The research by Cisco security personnel shows that, 'In past few months a ransomware campaign is going on which has changed the landscape of ransomware delivery.'
Cisco researchers discovered this SamSam malware last month; researchers find SamSam pretty different from the previous malwares - which encrypted data and demand ransoms. SamSam is not launched via user focused attack vectors, such as phishing campaigns and exploit kits.
This particular family seems to be dispense via compromising servers and using them as a foothold to move laterally through the network to compromise additional machines which are then held for ransom. The industries which may be targeted in coming days because of SamSam server attacks are; government departments, aviation companies, schools and universities.
According to the Cisco Talos blog post, "we scanned for machines that were already compromised and potentially waiting for a ransomware payload. We found just over 2,100 backdoors installed across nearly 1600 ip addresses."
Cisco researchers discovered this SamSam malware last month; researchers find SamSam pretty different from the previous malwares - which encrypted data and demand ransoms. SamSam is not launched via user focused attack vectors, such as phishing campaigns and exploit kits.
This particular family seems to be dispense via compromising servers and using them as a foothold to move laterally through the network to compromise additional machines which are then held for ransom. The industries which may be targeted in coming days because of SamSam server attacks are; government departments, aviation companies, schools and universities.
According to the Cisco Talos blog post, "we scanned for machines that were already compromised and potentially waiting for a ransomware payload. We found just over 2,100 backdoors installed across nearly 1600 ip addresses."
How to evade SamSam Malware from encrypting your data
If you diagnose a webshell on your organization's server; you need to act immediately and take proper steps to address the threat.
- Your first step should be to remove the external access of your server. This will give you time to respond and also prevent outside access to your servers.
- Second step should be re-imaging the systems and install the latest version of software. This is the best solution to prevent outside breach or access of your server.
- In case you failed to re-build totally, your only option left is to restore backup before the server was compromised. Then, update the server to the updated version before returning it to production.
