After Ransomware, What Next? 3 Things to do to Prevent Ransomware Reinfection
I once warned that the true cost of a ransomware attack isn’t the money paid to the attackers, but something else, something that comes later.
A lot of businesses that have been victims of ransomware attacks like to think that after they’ve paid the ransom, their data, and by extension, their infrastructure, is safe. As long as they patch up and ensure that the ransomware never comes back, they are okay…
Unfortunately, that’s a lie. Threat actors aren’t dumb, even if they hand over your data back to you. The problem with ransomware attacks is that they exploit the inherent, unintentional flaw in digital data: its ability to be copied.
Honestly, if I were an attacker, the very first thing I’d do is duplicate my target’s data once I lay my hands on it. And if they pay up their ransom, that’s killing two birds with one stone.
So, why do so many businesses quickly resume operations and check every other box except the one that actually got compromised?
What statistics say in this matter
In the course of my research, I found these two pieces of data interesting:
A 2022 study by Cybereason found that 80% of businesses that paid ransoms for a ransomware attack got attacked again
The same study revealed that a significant amount of these reports indicated that the same threat actor from the first was responsible for the second hit
If you check the study more, you’d find more fascinating data about ransomware. Huntress also has another interesting data on ransomware that might get you in a “Whoa” state.
However, the data above is all that I need here.
A focus on ransomware reinfection
A ransomware reinfection (though I like to call them legacy attacks, but let’s stick with the main term here) is an attack caused by older attacks that might have been archived in memory. But these guys don’t rest, nor do they forget. They are patient watchdogs, silently waiting for the right time to strike.
Sometimes they can strike just when you are recovering, and other times, they may strike months or years later, using the first attack as leverage.
The thing about these attacks that makes them fun for attackers, which is ironic, is that it’s easier than the first, at least for ‘a lot’ of businesses. A lot of businesses don’t learn from the first attack. Some learn, or seem to, but the loophole has been planted, far from where their searchlight is on. As a result, hackers come back and find the house easier to get in.
The next three sections will touch on three things I recommend you do after a ransomware attack. Think of this as a template if you are confused. It is particularly useful for small businesses that are still finding their way around structure.
One: run a backdoor check
You know the reason why many organizations get hit again after a ransomware attack? The attackers created a backdoor during the seizure. They understudy the infrastructure, then create the perfect stealth backdoor that grants them further access when they need it.
You may be surprised that when running their incident response and post-attack procedures, a lot of businesses do not explicitly check for backdoors on their systems. Run a codebase check. Access your systems thoroughly. If you are willing to pay a ransom to get your data back, you become a good target in your attacker’s eyes.
Two: scan for data leaks
Open Source Intelligence (OSINT) and cyber threat intelligence can help you do this. There is a chance all or some of your data will be sold for more profits, especially on the dark web. You can choose to go full scale on this, or employ the use of certain open source tools. My friend, Precious Vincent, has some good tools that can help you scan the dark web against certain parameters. It all depends on your financial strength and the scope of your digital infrastructure.
Three: enforce a mandatory, across-the-board credential and policy reset
This may sound like a no-brainer to many, but as is typical with compliance in cybersecurity, many don’t do this. Among the ones that do this, some just reset credentials, and that’s all.
If you must increase your chance of staying safe, many things will have to change, and that includes adjustments to certain types of policies. In other words, tighten things up.
Final notes
If you can do these, you’ll be better off than many who don’t, and stay ahead of a potential recurring threat.
Always remember that cybersecurity is not the total absence of security incidents, but the management of them.