<![CDATA[Geeks for your information - Emsisoft Blog Articles]]>

<![CDATA[Geeks for your information - Emsisoft Blog Articles]]> https://www.geeks.fyi/ Mon, 13 Jul 2026 20:57:32 +0000 MyBB <![CDATA[January 2025 VB100 Test gives Emsisoft a A+ Grade]]> https://www.geeks.fyi/showthread.php?tid=20643 Thu, 27 Feb 2025 03:57:02 +0000 jasonX]]> https://www.geeks.fyi/showthread.php?tid=20643 January 2025 VB100 Test gives Emsisoft a A+ Grade

Good news for Emsisoft users! The January 2025 VB100 Test is out and Emsisoft got a 'A+ Grade'. Great news! Emsiosft's Zach Simas reports about the achievement below.

Quote:Emsisoft Anti-Malware recently has once again proven its cybersecurity excellence by achieving an A+ grade in the January 2025 VB100. With an outstanding detection rate and zero false positives, Emsisoft continues to deliver unparalleled protection against evolving malware threats. Independent evaluations such as the VB100 test are crucial in validating the effectiveness of security products under real-world conditions.

VB100 Certification: Why it matters

The VB100 certification is a widely recognized benchmark in the cybersecurity landscape, demonstrating a product’s ability to detect prevalent malware threats while maintaining a minimal false positive rate. Conducted by Virus Bulletin an independent security testing organization, the certification process provides an objective assessment of antivirus solutions in detecting malware efficiently and without disrupting legitimate applications.

To achieve VB100 certification, a product must meet two critical criteria:

Detect at least 75% of malware samples from the Certification set, which includes widespread threats seen in the wild.

Maintain a false positive rate below 0.05%, ensuring that legitimate software remains unaffected.

For businesses and individual users, earning the VB100 certification signals that a product offers dependable, real-world protection without unnecessary system interruptions. Virus Bulletin’s rigorous testing process adheres to the standards set by the Anti-Malware Testing Standards Organization (AMTSO) further solidifying the certification’s credibility.

Achieving this certification consistently underscores Emsisoft’s commitment to delivering high-quality, enterprise-grade security that meets the evolving challenges of today’s threat landscape.

Breaking down the January 2025 test results

The test evaluated Emsisoft Anti-Malware version 2024.12.0.12633, running on Microsoft Windows 11 Pro, 64-bit, using the updated VB100 1.6 testing methodology.

Key performance metrics

Total malware samples tested: 1,640

Detection rate: 99.94% (1,639 samples detected)

Total clean files tested: 100,000 legitimate program files

False positive rate: 0.00% (zero false alarms)

For a comprehensive breakdown of the results and an in-depth understanding of the testing methodology, you can view the full report HERE.

Why these results stand out

Achieving a detection rate of 99.94% with zero false positives is a testament to Emsisoft’s ability to provide thorough and accurate protection. The A+ rating reflects Emsisoft’s capability to identify and neutralize threats without mistakenly flagging legitimate files, which is a crucial factor for maintaining operational efficiency.

More information in the Full article HERE

Data and info derived/lifted from Emsisoft with permission]]> January 2025 VB100 Test gives Emsisoft a A+ Grade

Good news for Emsisoft users! The January 2025 VB100 Test is out and Emsisoft got a 'A+ Grade'. Great news! Emsiosft's Zach Simas reports about the achievement below.

Quote:Emsisoft Anti-Malware recently has once again proven its cybersecurity excellence by achieving an A+ grade in the January 2025 VB100. With an outstanding detection rate and zero false positives, Emsisoft continues to deliver unparalleled protection against evolving malware threats. Independent evaluations such as the VB100 test are crucial in validating the effectiveness of security products under real-world conditions.

VB100 Certification: Why it matters

The VB100 certification is a widely recognized benchmark in the cybersecurity landscape, demonstrating a product’s ability to detect prevalent malware threats while maintaining a minimal false positive rate. Conducted by Virus Bulletin an independent security testing organization, the certification process provides an objective assessment of antivirus solutions in detecting malware efficiently and without disrupting legitimate applications.

To achieve VB100 certification, a product must meet two critical criteria:

Detect at least 75% of malware samples from the Certification set, which includes widespread threats seen in the wild.

Maintain a false positive rate below 0.05%, ensuring that legitimate software remains unaffected.

For businesses and individual users, earning the VB100 certification signals that a product offers dependable, real-world protection without unnecessary system interruptions. Virus Bulletin’s rigorous testing process adheres to the standards set by the Anti-Malware Testing Standards Organization (AMTSO) further solidifying the certification’s credibility.

Achieving this certification consistently underscores Emsisoft’s commitment to delivering high-quality, enterprise-grade security that meets the evolving challenges of today’s threat landscape.

Breaking down the January 2025 test results

The test evaluated Emsisoft Anti-Malware version 2024.12.0.12633, running on Microsoft Windows 11 Pro, 64-bit, using the updated VB100 1.6 testing methodology.

Key performance metrics

Total malware samples tested: 1,640

Detection rate: 99.94% (1,639 samples detected)

Total clean files tested: 100,000 legitimate program files

False positive rate: 0.00% (zero false alarms)

For a comprehensive breakdown of the results and an in-depth understanding of the testing methodology, you can view the full report HERE.

Why these results stand out

Achieving a detection rate of 99.94% with zero false positives is a testament to Emsisoft’s ability to provide thorough and accurate protection. The A+ rating reflects Emsisoft’s capability to identify and neutralize threats without mistakenly flagging legitimate files, which is a crucial factor for maintaining operational efficiency.

More information in the Full article HERE

Data and info derived/lifted from Emsisoft with permission]]> <![CDATA[New in 2021.10: Introducing MITRE ATT&CK malware behavior patterns]]> https://www.geeks.fyi/showthread.php?tid=16231 Tue, 05 Oct 2021 06:15:29 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=16231 Quote:

New support for MITRE ATT&CK behavior patterns

MITRE ATT&CK is a public knowledge base of adversary tactics and techniques. It allows standardized classification of malware behavior patterns. More information here.

The new Incidents panel in MyEmsisoft now provides information on which behavior patterns are used by alerted threats. While not all MITRE ATT&CK patterns apply to endpoints, many do. With this month’s release, we are adding an initial set of 7 supported malware tactics. Over the next few months, we plan to add support for more than 100 of them to cover the entire spectrum of endpoint security-related threats.

When you open an Incident in your workspace you will see which MITRE ATT&CK tactics were found in the alerted process.

Please note that this feature is only available in Emsisoft Business Security and Emsisoft Enterprise Security plans. Compare editions.

All 2021.10 improvements in a nutshell

Device protection (desktop)

As announced earlier, we are ending support for operating systems older than Windows 10 and also end support for non-64-bit systems. From here on, installations on non-supported systems will no longer receive software updates but malware detection updates only.
New UI customization feature to disable workspace management controls on devices.
Several minor tweaks and fixes.

Management console (web app)

New UI customization feature to disable workspace management controls on devices (via protection policies).
Several minor tweaks and fixes.

As announced earlier, we are ending support for operating systems older than Windows 10 and also end support for non-64-bit systems. From here on, installations on non-supported systems will no longer receive software updates but malware detection updates only.
New UI customization feature to disable workspace management controls on devices.
Several minor tweaks and fixes.

Management console (web app)

New UI customization feature to disable workspace management controls on devices (via protection policies).
Several minor tweaks and fixes.

How to obtain the new version

As always, so long as you have auto-updates enabled in the software, you will receive the latest version automatically during your regularly scheduled updates, which are hourly by default.

Note to Enterprise users: If you have chosen to receive “Delayed” updates in the Update settings for your clients, they will receive the new software version no earlier than 30 days after the regular “Stable” availability. This gives you time to perform internal compatibility tests before a new version gets rolled out to your clients automatically.

Have a great and well-protected day!
... Continue Reading]]> <![CDATA[Emsisoft Anti-Malware awarded VB100 in July 2021 tests]]> https://www.geeks.fyi/showthread.php?tid=16160 Wed, 22 Sep 2021 08:28:11 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=16160 Quote:

[Image: Emsisoft-awarded-VB100-in-April-2020-tests.png]

The VB100 is a long-running certification program designed to test the detection capabilities of endpoint security products.

We took part in the July 2021 tests and we’re happy to report that Emsisoft Anti-Malware was once again awarded certification!

The tests

The tests were performed on physical computers or virtual machines with specifications similar to those you would expect to find in an ordinary business environment. Each security product was installed on a clean instance of Windows and configured with default settings.

The products were then exposed to hundreds of malicious samples collected by malware experts and research groups, as well as a set of 100,000 non-malicious, regularly updated samples taken from popular software downloads. No malicious or clean samples were executed during the tests.

To be awarded VB100 certification, a security product must achieve the following:

Detect at least 99.5 percent of malicious samples.
Generate no more than 0.01 false positives.

The results

Emsisoft Anti-Malware performed well in the strict test conditions, capably detecting 100 percent of the 1,364 malicious samples while producing zero false positives. As a result, Emsisoft Anti-Malware was yet again awarded the VB100!

Click here to see the full report, or click here to check out some of the other awards we’ve won in the past.

About Virus Bulletin

Headquartered in the U.K., Virus Bulletin is an independent security information portal and certification body. The organization regularly performs tests designed to evaluate the protection capabilities of security products and help users make a more informed decision about their choice of antivirus software. A product that has earned the VB100 can be considered to have met a certain standard of quality in regards to malware detection.
... Continue Reading]]> Quote:

Detect at least 99.5 percent of malicious samples.
Generate no more than 0.01 false positives.

[Image: emsisoft-avlab-award-july-2021.png.webp]

AVLab is an independent antivirus software testing organization based in Poland. The group frequently conducts tests designed to evaluate the detection capabilities of endpoint security solutions.

The results of the latest round of tests have just been released and we’re pleased to announce that Emsisoft Business Security was awarded the ‘Excellent’ badge!

Testing methodology

To conduct the “Advanced-in-the-Wild Malware Test”, each security solution was installed on a system running Windows 10 Pro x64. The test environment contained a variety of applications found in a typical business environment, such as an office suite, document browser, email client and so on. The security solutions were updated before each test and allowed Internet access throughout the testing process.

The antivirus products were then exposed to 1,311 malware samples captured from the AVLab honeypot network and verified to be malicious. Researchers analyzed the results to determine not only if the security products could stop the malware, but when in the infection chain they would intervene.

Badges were awarded according to the detection capabilities of the product:

Excellent: 100% detection
Superior: at least 95% detection
Valuable: at least 90% detection

Results

Emsisoft Business Security successfully detected 100 percent of the 1,311 malicious samples and was consequently awarded the ‘Excellent’ badge!

Stopped 36 percent of threats at the browser level.
Stopped 64 percent of threats at the analysis level.

Excellent: 100% detection
Superior: at least 95% detection
Valuable: at least 90% detection

Results

Emsisoft Business Security successfully detected 100 percent of the 1,311 malicious samples and was consequently awarded the ‘Excellent’ badge!

Stopped 36 percent of threats at the browser level.
Stopped 64 percent of threats at the analysis level.

Click here to see the full report, or click here to check out some of the other awards we’ve won in the past.

About AVLab

AVLab is an independent Polish organization that specializes in testing antivirus products and reviewing security solutions. The group regularly releases reports that offer valuable insight into the effectiveness of various security products. Software that receives a good recommendation from AVLab can generally be trusted to provide a high level of protection.
... Continue Reading]]> <![CDATA[How to limit your personal data exposure when a company is hit with ransomware]]> https://www.geeks.fyi/showthread.php?tid=16158 Wed, 22 Sep 2021 08:23:31 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=16158 Quote:

Modern ransomware seldom targets individual users. Instead, threat actors focus their efforts on businesses, corporations and government entities – organizations with high-value data assets, and the resources and motivation to pay for their recovery.

However, while the crosshairs might be firmly focused on commercial targets, there’s more than just business data getting caught in the crossfire. With data theft and data publication becoming the standard mode of operation among ransomware groups, many incidents now involve the exposure of customers’ personal data, including medical reports, financial information, social security numbers, academic results and much more.

This raises some serious security and privacy concerns for you as a consumer. But what can you do about it?

Customer data getting caught in the crossfire

Double extortion has quickly become the norm in the ransomware world. No longer content with merely encrypting data on a target system and holding it for ransom, bad actors are also stealing data from their victims and using it as added leverage. Failure to pay the ransom results in the stolen data being published or sold on the dark web.

While these data dumps are primarily made up of company-related assets – financial information, company emails, internal reports and the like – they also tend to contain large amounts of sensitive customer information.

This introduces significant concerns not only for the company affected by ransomware, but also for you, the consumer. When the victim company refuses to pay the ransom, it’s your private data that is exposed to the world. And, with data collection practices becoming increasingly aggressive, the breadth and depth of personal information exposed in a ransomware incident can be startling.

A ransomware incident at a car dealership, for instance, might result in the public exposure of your driver’s license, credit application, social security number, home address and contact information. Similarly, an attack on your healthcare provider could lead to your medical records, insurance information, prescription history and perhaps photographs and body scans being leaked online.

Once compromised, this information can easily be used to commit a wide range of fraudulent activities or sold on the dark web as part of a batch of stolen data.

What can you do about it?

As a consumer, there’s not much you can do to prevent a business from getting hit by ransomware. But there are some things you can do to limit your personal exposure.

Limit the amount of information you share: While you can’t refuse all data requests, you can reduce the amount of information you share and, consequently, limit your personal data exposure in the event of an incident. Don’t give any business or online service more information than is minimally required and always opt out of data sharing schemes where possible.
Ask businesses about their security practices: Businesses are quick to demand your personal information but are often not capable of adequately securing it. Make an informed decision about your privacy by reading license agreements before divulging your personal information and ask the company to clarify their security practices if anything is unclear.
Use ephemeral messaging: Some ransomware data leaks contain .pst files, which are Outlook data files that store local copies of messages, calendar events, and other items associated with a particular email address. With this in mind, consider using ephemeral messaging when you need to communicate important or sensitive information. Ephemeral messaging services allow you to send messages that self-destruct after a period of time, erasing the message from both the sender’s and the recipient’s account.
Don’t use personal information for passwords: Attackers may use your compromised data to attempt to gain access to your online accounts and services, so never create passwords based on personal information. See this blog post for more advice on how to create and manage secure passwords.
Check if you’ve been involved in a data breach: Some organizations are more diligent than others when it comes to notifying you of a data breach. You can use online services such as Have I Been Pwned to help you determine if your data has been compromised and take action accordingly (e.g. by changing your passwords, checking for fraudulent activity and contacting your service providers as necessary).

Limit the amount of information you share: While you can’t refuse all data requests, you can reduce the amount of information you share and, consequently, limit your personal data exposure in the event of an incident. Don’t give any business or online service more information than is minimally required and always opt out of data sharing schemes where possible.
Ask businesses about their security practices: Businesses are quick to demand your personal information but are often not capable of adequately securing it. Make an informed decision about your privacy by reading license agreements before divulging your personal information and ask the company to clarify their security practices if anything is unclear.
Use ephemeral messaging: Some ransomware data leaks contain .pst files, which are Outlook data files that store local copies of messages, calendar events, and other items associated with a particular email address. With this in mind, consider using ephemeral messaging when you need to communicate important or sensitive information. Ephemeral messaging services allow you to send messages that self-destruct after a period of time, erasing the message from both the sender’s and the recipient’s account.
Don’t use personal information for passwords: Attackers may use your compromised data to attempt to gain access to your online accounts and services, so never create passwords based on personal information. See this blog post for more advice on how to create and manage secure passwords.
Check if you’ve been involved in a data breach: Some organizations are more diligent than others when it comes to notifying you of a data breach. You can use online services such as Have I Been Pwned to help you determine if your data has been compromised and take action accordingly (e.g. by changing your passwords, checking for fraudulent activity and contacting your service providers as necessary).

Check out this guide for five steps you can take today to drastically improve your online privacy.

Conclusion

Ransomware incidents often involve the exposure of your personal data. As a consumer, you can’t stop the companies you do business with from falling victim to ransomware, but you can limit the amount of your personal data that is exposed during an attack.
... Continue Reading]]> <![CDATA[Ransomware Profile: BlackMatter]]> https://www.geeks.fyi/showthread.php?tid=16157 Wed, 22 Sep 2021 08:21:40 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=16157 Quote:

BlackMatter is a strain of ransomware that encrypts files and threatens to leak stolen data if the ransom is not paid. The group targets large companies with annual revenues of more than $100 million and is actively recruiting affiliates as it ramps up its operations. BlackMatter may be a rebrand or spinoff of the now-defunct cybercrime outfit DarkSide due to the unique encryption routines employed by both ransomware groups.

What is BlackMatter?

BlackMatter is a ransomware variant that encrypts files using Salsa20 and 1024-bit RSA encryption and demands a large sum of cryptocurrency for their decryption.

As with many other ransomware groups, BlackMatter uses the threat of data exposure to increase the chances of achieving a payout. Before executing the final ransomware payload, BlackMatter operators exfiltrate data from compromised systems and threaten to release it on the group’s leak site unless the victim pays the ransom.

BlackMatter operates as a ransomware-as-a-service (RaaS), a business model in which affiliates earn a portion of ransom payments in exchange for dropping the malware onto compromised systems. BlackMatter also works with initial access brokers, individuals who are willing to sell access to compromised networks.

Initial access brokers are paid $3,000 – $100,000 for network access, depending on the target.

Possible link between BlackMatter and DarkSide

DarkSide is the ransomware gang responsible for the Colonial Pipeline attack in May 2021 that resulted in fuel shortages and price spikes across the U.S.

Following unprecedented pressure from U.S. and Russian authorities, DarkSide was forced to shut down its operations a few weeks later.

There is some evidence to suggest that DarkSide, or at least some members of DarkSide, may have returned under the BlackMatter moniker. After investigating a leaked BlackMatter decryptor, Emsisoft analysts determined that BlackMatter uses the same encryption routines that DarkSide formerly used in their attacks, including a custom Salsa20 matrix that was unique to DarkSide.

The history of BlackMatter

BlackMatter was first observed in late July 2021, when the alias “BlackMatter” was registered on the Russian-language cybercrime forums XSS and Exploit. The user deposited 4 bitcoins (worth approximately $150,000 USD at the time) into its Exploit escrow account, signaling their legitimacy and seriousness as a threat actor. Shortly after, the user posted an advertisement offering initial access brokers $3,000 – $100,000 for access to corporate networks that met the group’s criteria.

In early September 2021, the U.S. Department of Health and Human Services’ Health Sector Cybersecurity Coordinating Council issued a threat brief on BlackMatter.

Since BlackMatter was first discovered, there have been 44 submissions to ID Ransomware, an online tool that helps the victims of ransomware identify which ransomware has encrypted their files. We estimate that only 25 percent of victims make a submission to ID Ransomware, which means there may have been a total of 176 BlackMatter incidents since the ransomware’s inception. During this time, the group has also published on its leak site the stolen data of 10 organizations.

BlackMatter ransom note

After the encryption process is complete, BlackMatter drops a ransom note in user-accessible folders and changes the desktop wallpaper to a ransom notice.

Some versions of the ransomware also print a physical copy of the ransom note by sending a print job from each infected endpoint to the default printer.

The ransom note states that the victim’s files have been encrypted and provides instructions on how to communicate with the attackers. The note also specifies the type of data that was stolen during the attack, along with a “guarantee” that the threat actors will uphold their end of the bargain by decrypting the victim’s files and deleting the exfiltrated data after receiving payment.
... Continue Reading]]> Quote:

Windows 11 is coming soon: We’re ready!

The next major version of Microsoft Windows is just around the corner. Our Quality Assurance Team has tested our software on the latest preview version of Windows 11 and can confirm that all current Emsisoft protection products work as expected. We will continue to test upcoming beta versions of Windows 11 until the final release.

Just a reminder: support for old Windows versions has finally ended. As announced earlier, we no longer support legacy versions of Windows 7, 8, 8.1, Servers 2008 R2 and 2012, and no longer provide our software for 32 bit operating systems. This move reflects Microsoft’s main support timeline.

Announcement regarding email notifications

The ability to receive real-time notifications by email is an important feature for security administrators who look after larger numbers of devices.

Before we launched the Emsisoft Management Console, notifications could only be set directly in the endpoint protection software on the desktop. Later on, we added even more powerful notification features in the Management Console, including support for webhooks/APIs.

With this update, we would like to inform you that we’re going to phase out notifications that are set on the desktop. We believe this is the right move for multiple reasons:

It’s getting increasingly confusing for administrators to have multiple locations for features that essentially do the same thing. Moving notifications exclusively to the Management Console simplifies and eases overall usability.
Setting notifications desktop-side requires you to enter your SMTP account details for sending emails. We prefer to NOT have access to this information of yours for security reasons. The Management Console uses the Emsisoft mailing system to deliver notification emails safely.

How to migrate notifications

If you currently use the email notifications feature in Emsisoft, either via the desktop application or via protection policies in the Management Console, please disable them now.

Go to your workspace settings page at the bottom of the Management Console menu on the left, scroll down to ‘Email notifications & webhooks’ and configure them as per your requirements.

Note that the old way of setting up notifications will be removed with the release of version 2021.10 next month.

All 2021.9 improvements in a nutshell

Device protection (desktop)

Changed the default scan priority of new scheduled scans and the existing default scheduled scan (when disabled) to ‘Reduced.’ This addresses a common customer request to preserve system resources for other tasks during scheduled scans.
Improved license expiration handling.
Improved stability.
Several minor tweaks and fixes.

Management console (web app)

Several minor tweaks and fixes.

It’s getting increasingly confusing for administrators to have multiple locations for features that essentially do the same thing. Moving notifications exclusively to the Management Console simplifies and eases overall usability.
Setting notifications desktop-side requires you to enter your SMTP account details for sending emails. We prefer to NOT have access to this information of yours for security reasons. The Management Console uses the Emsisoft mailing system to deliver notification emails safely.

Changed the default scan priority of new scheduled scans and the existing default scheduled scan (when disabled) to ‘Reduced.’ This addresses a common customer request to preserve system resources for other tasks during scheduled scans.
Improved license expiration handling.
Improved stability.
Several minor tweaks and fixes.

Management console (web app)

Several minor tweaks and fixes.

How to obtain the new version

As always, so long as you have auto-updates enabled in the software, you will receive the latest version automatically during your regularly scheduled updates, which are hourly by default.

Note to Enterprise users: If you have chosen to receive “Delayed” updates in the Update settings for your clients, they will receive the new software version no earlier than 30 days after the regular “Stable” availability. This gives you time to perform internal compatibility tests before a new version gets rolled out to your clients automatically.

Have a great and well-protected day!
... Continue Reading]]> <![CDATA[The ransomware recovery process takes longer than you think]]> https://www.geeks.fyi/showthread.php?tid=15763 Tue, 03 Aug 2021 06:33:27 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=15763 Quote:

Ransomware recovery time frames vary wildly. In the very best circumstances, where the infection is contained, disaster recovery plans have been religiously tested and the decryptor runs without a hiccup, some companies can get their systems up and running within a couple of days.

But that’s rare. On average, organizations that have been impacted by ransomware face 21 days of downtime[sup]1[/sup]. In some instances, the recovery process can drag on for months.

Companies routinely underestimate the time involved with resolving a ransomware incident. While it’s easy to fall into the trap of thinking that recovery simply involves restoring the system from backups or, less desirably, paying the attacker for decryption, the truth is that there are a lot of variables that can prolong the recovery process.

In this blog post, we discuss why it almost always takes longer than expected for businesses to recover from a ransomware attack.

1. Lack of documentation

Lack of documentation is often a major cause of time loss during recovery. Many organizations work with antiquated systems or services for which the documentation is outdated, inaccurate or simply non-existent.

Without effective documentation, IT personnel are forced to improvise response procedures during what is sure to be a confusing and uncertain time, which will almost certainly result in errors and inefficiencies. Infections may be improperly contained, data may be compromised unnecessarily and compliance requirements may be overlooked. Depending on the maturity of the company’s IT team, this may be the first time personnel have been exposed to a large-scale cybersecurity incident.

2. Inadequate testing

Developing a clearly defined incident response plan is an essential part of any ransomware recovery plan. But it’s not enough to simply have a documented plan. Recovery strategies also need to be tested regularly to ensure that staff understand current security procedures and know exactly what to do and who to report to in the event of an incident.

For example, simulating a ransomware event via tabletop exercises can be a valuable way to gauge a company’s ransomware readiness and reveal holes in the recovery plan that can be strengthened accordingly. More than half (57 percent) of companies have not tested their disaster recovery plan within the past two months, according to a Veritas report.

3. Forensic investigation process

Before systems can be restored, the impacted company must undertake a comprehensive investigation in order to understand the extent of the attack and how the system was compromised.

Because the attack chain may have started weeks or even months ago, conducting a thorough analysis can be extremely time-consuming and may require the assistance of external digital forensic specialists, which can further draw out the recovery process.

4. Poor decryptor performance

Recovery can also be hindered by poor decryptor performance. Companies should be mindful that attacker-provided decryptors often do not work as advertised and, consequently, the total recovery time may be substantially longer than expected. In some instances, the decryptor may contain bugs that irrecoverably corrupt data during the decryption process.

Organizations that decide to pay for a decryptor should consider utilizing Emsisoft’s ransomware recovery service. We can reverse engineer attacker-supplied decryptors to ensure they are safe and/or create a custom decryptor that provides faster and safer data recovery.

5. Communication

While recovery is largely a technical undertaking, it also requires a lot of communication with internal staff as well as external service providers that may be brought on to assist with the incident:

Legal: Companies will likely need to consult their legal team for advice regarding reporting obligations, mitigating litigation and the legality of paying the ransom.
Insurance: There will be an ongoing dialogue with the company’s insurance provider throughout the recovery period. Coverage, expected downtime, recovery costs, deductibles and more will be discussed at length.
Customers: The impacted company may wish to disclose the incident to customers. Effective communication is essential for both transparency and minimizing reputational damage. A crisis communications specialist should be used if the company’s internal communications team is not experienced with serious cybersecurity events.
Attackers: Depending on their circumstances, some companies may choose to communicate with attackers in order to obtain a decryptor and/or negotiate the ransomware amount. There are organizations that can conduct negotiations on behalf of the victim.

6. Rebuilding and strengthening the system

Technically speaking, recovery is complete once the impacted systems have been restored and the organization is back up and operational.

However, “operational” isn’t the same as “secure”. To prevent similar events from occurring again in the future, companies will need to invest significant time in strengthening their security processes, resolving vulnerabilities and improving response procedures, based on the findings of the forensic analysis.

Investing in a proven antivirus solution like Emsisoft Business Security can help organizations reliably detect and stop ransomware threats before encryption can take place

[sup]1 [/sup]Ransomware Payments Fall as Fewer Companies Pay Data Exfiltration Extortion Demands
... Continue Reading]]> Quote:

Legal: Companies will likely need to consult their legal team for advice regarding reporting obligations, mitigating litigation and the legality of paying the ransom.
Insurance: There will be an ongoing dialogue with the company’s insurance provider throughout the recovery period. Coverage, expected downtime, recovery costs, deductibles and more will be discussed at length.
Customers: The impacted company may wish to disclose the incident to customers. Effective communication is essential for both transparency and minimizing reputational damage. A crisis communications specialist should be used if the company’s internal communications team is not experienced with serious cybersecurity events.
Attackers: Depending on their circumstances, some companies may choose to communicate with attackers in order to obtain a decryptor and/or negotiate the ransomware amount. There are organizations that can conduct negotiations on behalf of the victim.

This month we can announce a number of detail improvements that are particularly relevant for environments with larger numbers of devices.

When analyzing a threat in the new Incidents panel, you will now see if a file has infected multiple devices in your workspace.

Additionally, the panel now provides more information about how a threat was handled. Allow/block actions performed either by a user or automatically by the protection software.

All 2021.8 improvements in a nutshell

Device protection (desktop)

Improved support for notifications on Windows Terminal Servers.
Several minor tweaks and fixes.

Management console (web app)

New: Locate and search specific threats on multiple devices in a workspace.
New: Detailed remediation status information available on threat details page.
Several minor tweaks and fixes.

Improved support for notifications on Windows Terminal Servers.
Several minor tweaks and fixes.

Management console (web app)

New: Locate and search specific threats on multiple devices in a workspace.
New: Detailed remediation status information available on threat details page.
Several minor tweaks and fixes.

How to obtain the new version

As always, so long as you have auto-updates enabled in the software, you will receive the latest version automatically during your regularly scheduled updates, which are hourly by default.

Note to Enterprise users: If you have chosen to receive “Delayed” updates in the Update settings for your clients, they will receive the new software version no earlier than 30 days after the regular “Stable” availability. This gives you time to perform internal compatibility tests before a new version gets rolled out to your clients automatically.

Have a great and well-protected day!
... Continue Reading]]> <![CDATA[Ransomware Profile: LockBit]]> https://www.geeks.fyi/showthread.php?tid=15698 Sun, 25 Jul 2021 18:50:23 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=15698 Quote:

LockBit is a strain of ransomware that blocks users from accessing infected systems until the requested ransom payment has been made. It has been highly active since it emerged in September 2019 and has impacted thousands of organizations around the world. Many of LockBit’s attack functions are automated, making it one of the most efficient ransomware variants on the market.

What is LockBit?

LockBit is a ransomware variant that encrypts files using AES encryption and demands a large ransom (typically high five-figures) for their decryption. Whereas most modern strains of ransomware are manually operated, LockBit’s processes are largely automated, which allows the ransomware to propagate and infect other hosts with minimal human oversight after the initial point of compromise.

LockBit operates under the ransomware-as-a-service (Raas) business model, whereby ransomware developers lease their ransomware to affiliates who receive a portion of ransom payments in exchange for dropping the malware onto victims’ networks.

Double extortion, in which threat actors use stolen data to pressure victims into paying the ransom, has become standard procedure among most ransomware groups and LockBit is no exception. LockBit claims to offer the fastest data exfiltration on the market through StealBit, a data theft tool that can allegedly download 100 GB of data from compromised systems in under 20 minutes.

The history of LockBit

LockBit was first observed in September 2019. It was originally known as ABCD ransomware due to the .abcd file extension that older versions of the ransomware would append to encrypted files. In later versions, the file extension was changed to .LockBit.

In May 2020, LockBit began working with Maze in what some referred to as a “ransomware cartel”. It is believed that the two groups shared tactics and resources, with LockBit using Maze’s leak site to publish stolen files. LockBit went on to launch its own leak site in September 2020.

In August 2020, INTERPOL warned of a spike in LockBit attacks on medium-sized companies in the Americas as part of its Cybercrime: Covid-19 Impact report (Note: link starts PDF download).

In June 2021, LockBit launched LockBit 2.0 along with an advertising campaign to recruit new affiliates.

Since LockBit was first discovered, there have been 9,955 submissions to ID Ransomware, an online tool that helps the victims of ransomware identify which ransomware has encrypted their files. We estimate that only 25 percent of victims make a submission to ID Ransomware, which means there may have been a total of 39,976 LockBit incidents since the ransomware’s inception.

LockBit ransom note

After the encryption process is complete, LockBit drops a ransom note called “Restore-My-Files.txt” in all infected directories and changes the desktop wallpaper on the target system. The note contains instructions on how to make payment and warns the victim to avoid using third-party decryption software and recovery services. The ransom note also contains a link to a payment portal where victims can “Chat with support” and access a one-time free decryption to verify that the attackers have a legitimate copy of the decryption key.
... Continue Reading]]> Quote:

Mespinoza, sometimes referred to as PYSA, is a ransomware variant that primarily targets large organizations with high-value data assets. It is one of the few strains that target both Windows and Linux systems. Due to severe flaws in the Mespinoza decryptor, there is a significant risk of data corruption occurring when using the attacker-provided decryptor.

What is Mespinoza?

Mespinoza is a strain of ransomware that encrypts files and demands a large ransom for their decryption. Mespinoza is sometimes referred to as PYSA due to the .pysa file extension that new versions of the ransomware append to encrypted files.

Mespinoza is categorized as ransomware-as-a-service (RaaS), a business model used by ransomware developers in which the ransomware is leased to affiliates who can earn a portion of ransom payments in exchange for infecting systems.

Like many other ransomware groups, Mespinoza uses data exfiltration as a conversion tactic to pressure victims into paying the ransom. If the victim refuses to pay the ransom, the stolen data may then be published on Mespinoza’s leak site or sold.

Paying attackers does not guarantee safe data recovery

With any attacker-provided decryptor, there is a risk that data may be damaged during the decryption process. With Mespinoza, the risk is particularly pronounced due to the way the decryptor handles block ciphers (an encryption method that operates on blocks of data of a fixed size – in this case, 16 bytes). As a result, files may not open or may contain missing or incorrect data once they have been decrypted.

It is also important to note that paying the ransom does not guarantee the non-release of exfiltrated data. We have seen confirmed instances of Mespinoza leaking stolen data even after the victim company has paid the ransom. For these reasons, organizations that have been impacted by Mespinoza should be extremely wary of co-operating with attackers.

Emsisoft’s decryption tool can safely decrypt data encrypted by Mespinoza, provided the victim has obtained the decryption keys. The tool can also identify which data has been corrupted and can no longer be trusted. Mespinoza’s decryptor does not have the capability to identify damaged data.

The history of Mespinoza

Mespinoza was first observed in October 2019. It originally appended the .locked extension to encrypted files before shifting to using the .pysa extension in December 2019. The developers of Mespinoza have rewritten the malware several times since its release, including a .NET, C++ and Python version, each with its own quirks that can potentially damage data during decryption.

Since Mespinoza was first discovered, there have been 531 submissions to ID Ransomware, an online tool that helps the victims of ransomware identify which ransomware has encrypted their files. We estimate that only 25 percent of victims make a submission to ID Ransomware, which means there may have been a total of 2,124 Mespinoza incidents since the ransomware’s inception. During this time, the group has also published on its leak site the stolen data of at least 104 organizations.

In March 2020, the French National Agency for the Security of Information Systems issued an alert warning of a spike of Mespinoza attacks on the networks of local French government authorities.

In March 2021, the FBI issued a similar alert following a surge of Mespinoza attacks in the education sector. The alert stated that the group had targeted higher education, K-12 schools and seminaries in 12 U.S. states and the United Kingdom.

Mespinoza ransom note

After encrypting data on the compromised system, Mespinoza drops a note called Readme.README.txt in all infected directories. The note contains instructions on how to contact the attackers and threatens that the victim’s data will be leaked or sold in the event of non-payment. The ransomware also adds a reference to the system registry to display the ransom note every time the device is booted.

Below is a sample Mespinoza ransom note:

Quote:Hi Company,
Every byte on any types of your devices was encrypted.
Don’t try to use backups because it were encrypted too.

To get all your data back contact us:
[REDACTED]
[REDACTED]

Also, be aware that we downloaded files from your servers and in case of non-payment we will be forced to upload them on our website, and if necessary, we will sell them on the darknet.
Check out our website, we just posted there new updates for our partners: [REDACTED]

————–
FAQ:
1.
Q: How can I make sure you don’t fooling me?
A: You can send us 2 files (max 2mb).

2.
Q: What to do to get all data back?
A: Don’t restart the computer, don’t move files and write us.

3.
Q: What to tell my boss?
A: Protect Your System Amigo.

Who does Mespinoza target?

Mespinoza is big-game ransomware that primarily targets large organizations that are especially sensitive to data loss and/or system downtime. This includes organizations in the healthcare, government and education sectors, as well as private businesses across multiple verticals. Mespinoza is one of a handful of ransomware groups that attacks both Windows and Linux systems.
... Continue Reading]]> <![CDATA[Ransomware statistics for 2021: Q2 report]]> https://www.geeks.fyi/showthread.php?tid=15536 Wed, 07 Jul 2021 06:58:23 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=15536 Quote:

[Image: Report_-Ransomware-statistics-for-Q1-2020.png.webp]

The second quarter of 2021 marked the biggest ransomware attack on U.S. infrastructure to date. On May 7, The Colonial Pipeline Company, which operates the largest pipeline system for refined oil products in the United States, was infected with DarkSide ransomware. The attack resulted in a six-day shutdown that was only resolved when Colonial Pipeline paid the $4.4 million ransom – a decision that CEO Joseph Blount described as “the right thing to do for our country.”

The attack was, perhaps, a little too successful. The incident caused widespread disruption to the fuel supply chain, resulting in gas prices hitting a six-year high and drawing significant attention from the White House. Following pressure from U.S. authorities and the alleged seizure of their public-facing servers, DarkSide had little choice but to shut down operations.

The incident caused ripples elsewhere in the ransomware market. To avoid attracting unwanted attention, some cybercrime forums began removing all references to ransomware, while ransomware groups like Avaddon and Sodinokibi announced that they would begin imposing restrictions on which targets their affiliates would be permitted to attack.

DarkSide wasn’t the only group to retire in Q2. Avaddon followed suit in June, announcing its retirement and releasing free keys for all of its victims, enabling us to release a decryptor which past victims can use to recover their encrypted data.

In Q2, we saw a number of cases of threat actors encrypting data with multiple strains of ransomware in a single attack. Double encryption makes recovery – an already challenging process – even more complex and puts further pressure on victims to comply with attackers’ demands. Whether these cases were isolated incidents or the start of a new trend remains to be seen.

The following statistics are based on data from 137,537 submissions to Emsisoft and ID Ransomware between April 1 and June 30, 2021. Created by Emsisoft Security Researcher Michael Gillespie, ID Ransomware is a website that allows users to identify which ransomware strain has encrypted their files by uploading the ransom note, a sample encrypted file and/or the attacker’s contact information. It also directs the user to a decryption tool, should one be available.

Note: We estimate that only 25% of victims make a submission to Emsisoft or ID Ransomware, so the real number of incidents is probably significantly higher.

Most commonly reported ransomware strains of Q2 2021

The following chart shows the 10 most commonly reported strains of Q2, which collectively made up 88.40% of all submissions this quarter. A ransomware family known as STOP/Djvu was by far the most common strain, accounting for 71.20% of all submissions.

STOP (Djvu): 71.20%
Phobos: 3.50%
REvil / Sodinokibi: 2.40%
QLocker: 2.30%
Makop: 2.20%
Dharma (.cezar): 2.00%
Magniber: 1.60%
eCh0raix / QNAPCrypt: 1.40%
LockBit: 0.90%
GlobeImposter 2.0: 0.90%

Most commonly reported ransomware strains of Q2 2021 (STOP excluded)

The following chart shows the 10 most commonly reported strains of Q2 with STOP submissions excluded.

Phobos: 12.10%
REvil / Sodinokibi: 8.20%
QLocker: 7.80%
Makop: 7.60%
Dharma (.cezar): 6.90%
Magniber: 5.50%
eCh0raix / QNAPCrypt: 4.70%
LockBit: 3.00%
GlobeImposter 2.0: 3.00%
Zeppelin: 2.40%

Most ransomware submissions by country

The following chart shows the 10 countries that accounted for the most ransomware submissions, with STOP submissions included. These 10 countries made up 58.10% of all global submissions this quarter.

India: 21.30%
Indonesia: 10.00%
South Korea: 5.50%
Egypt: 4.10%
Brazil: 3.90%
Pakistan: 3.80%
United States: 3.40%
Germany: 2.50%
Philippines: 1.90%
Italy: 1.70%

Discussion

We saw a significant increase in ID Ransomware submission numbers this quarter, with submissions rising from 96,023 in Q1 to 137,537 in Q2 – an increase of 43.23%.

STOP/Djvu remained the most commonly submitted ransomware family in Q2, accounting for 71.2% of all submissions, up from 51.4% in Q1. STOP is a prolific strain of ransomware that primarily impacts home users and is typically distributed via cracked software, key generators and activators.

This quarter, well-known vulnerabilities in QNAP devices resulted in a sharp rise in QNAP-targeted ransomware. The most active was Qlocker, a new ransomware variant that targets owners of QNAP NAS devices and demands a relatively small ransom of $500. Despite its short lifespan – Qlocker emerged in April and shut down its operation just a few weeks later after generating around $350,000 – Qlocker was the fourth most commonly submitted strain this quarter and accounted for 2.30% of all submissions.

The threat actors behind eCh0raix, a ransomware gang that was first detected in June 2019, also launched a campaign aimed at QNAP storage devices. Dubbed QNAPCrypt, the ransomware was responsible for 1.40% of all submissions this quarter.

India, which has made the most submissions every quarter since we began these quarterly reports, accounted for 21.3% of all global submissions in Q2, up significantly from 12.5% in Q1. Spain and Turkey, which each accounted for 2.2% of all submissions in Q1, fell out of the top 10 list in Q2, replaced by Germany (2.5%) and the Philippines (1.9%).

Further reading

... Continue Reading]]> Quote:

STOP (Djvu): 71.20%
Phobos: 3.50%
REvil / Sodinokibi: 2.40%
QLocker: 2.30%
Makop: 2.20%
Dharma (.cezar): 2.00%
Magniber: 1.60%
eCh0raix / QNAPCrypt: 1.40%
LockBit: 0.90%
GlobeImposter 2.0: 0.90%

Most commonly reported ransomware strains of Q2 2021 (STOP excluded)

The following chart shows the 10 most commonly reported strains of Q2 with STOP submissions excluded.

Phobos: 12.10%
REvil / Sodinokibi: 8.20%
QLocker: 7.80%
Makop: 7.60%
Dharma (.cezar): 6.90%
Magniber: 5.50%
eCh0raix / QNAPCrypt: 4.70%
LockBit: 3.00%
GlobeImposter 2.0: 3.00%
Zeppelin: 2.40%

India: 21.30%
Indonesia: 10.00%
South Korea: 5.50%
Egypt: 4.10%
Brazil: 3.90%
Pakistan: 3.80%
United States: 3.40%
Germany: 2.50%
Philippines: 1.90%
Italy: 1.70%

... Continue Reading]]> <![CDATA[New in 2021.7: Improved incidents management]]> https://www.geeks.fyi/showthread.php?tid=15492 Fri, 02 Jul 2021 06:20:00 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=15492 Quote:

With the new malware Incidents panel, you can now investigate deeper into findings. If an alerted program turns out to be safe, simply click the ‘Allow’ or ‘Allow everywhere’ buttons to add it to the exclusions.

ALLOW adds a protection exclusion for the affected device only.
ALLOW EVERYWHERE adds a protection exclusion to your entire workspace.

All 2021.7 improvements in a nutshell

Device protection (desktop)

Improved startup speed for larger applications and those which start multiple processes (ie. Skype, Office, Slack, etc.).
Slightly improved user interface.
Several minor tweaks and fixes.

Management console (web app)

New filtering functionality in Incidents management panel.
New options in Incidents details panel to exclude alerted programs from protection on individual devices or across an entire workspace.
Workflow optimizations when dealing with workspaces.
Improved user interface.
Several minor tweaks and fixes.

ALLOW adds a protection exclusion for the affected device only.
ALLOW EVERYWHERE adds a protection exclusion to your entire workspace.

All 2021.7 improvements in a nutshell

Device protection (desktop)

Improved startup speed for larger applications and those which start multiple processes (ie. Skype, Office, Slack, etc.).
Slightly improved user interface.
Several minor tweaks and fixes.

Management console (web app)

New filtering functionality in Incidents management panel.
New options in Incidents details panel to exclude alerted programs from protection on individual devices or across an entire workspace.
Workflow optimizations when dealing with workspaces.
Improved user interface.
Several minor tweaks and fixes.

How to obtain the new version

As always, so long as you have auto-updates enabled in the software, you will receive the latest version automatically during your regularly scheduled updates, which are hourly by default.

Note to Enterprise users: If you have chosen to receive “Delayed” updates in the Update settings for your clients, they will receive the new software version no earlier than 30 days after the regular “Stable” availability. This gives you time to perform internal compatibility tests before a new version gets rolled out to your clients automatically.

Have a great and well-protected day!
... Continue Reading]]> <![CDATA[Emsisoft Anti-Malware 2021.7 beta]]> https://www.geeks.fyi/showthread.php?tid=15442 Sun, 27 Jun 2021 09:00:49 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=15442 Quote:Emsisoft Anti-Malware 2021.7 beta:

We’ve just released Emsisoft Anti-Malware 2021.7.0.11059 beta. You will have to enable beta updates to get this version.

Improved startup speed for larger applications and those which start multiple processes (i.e. Skype, Office, Slack, etc.).
Slightly improved user interface.
Several minor tweaks and fixes.

Continue Reading]]> Quote:Emsisoft Anti-Malware 2021.7 beta:

We’ve just released Emsisoft Anti-Malware 2021.7.0.11059 beta. You will have to enable beta updates to get this version.

Improved startup speed for larger applications and those which start multiple processes (i.e. Skype, Office, Slack, etc.).
Slightly improved user interface.
Several minor tweaks and fixes.

Continue Reading]]> <![CDATA[How Louisiana’s MSP regulations could shape the future of the channel]]> https://www.geeks.fyi/showthread.php?tid=15233 Fri, 04 Jun 2021 07:22:09 +0000 harlan4096]]> https://www.geeks.fyi/showthread.php?tid=15233 Quote:

Louisiana is taking steps toward regulating the channel. Effective 1 February 2021, Senate Bill 273 introduces more regulations for MSPs that service the public sector. Many predict that the legislation – the first of its kind in the U.S. – is a sign of things to come, and that similar regulations could be rolled out in other states in the years ahead.

Read on to learn more about Senate Bill 273 and get a glimpse of what future MSP regulation could look like.

What is Senate Bill 273?

In June 2019, following a spate of costly ransomware incidents that ravaged the public sector, Louisiana approved new state law that introduces more regulations for MSPs that provide IT infrastructure to public bodies.

The bill primarily aims to shift the responsibility of incident disclosure from victims to service providers. It is hoped that the added transparency will enable consumers to make a more informed decision about their choice of MSP which, in turn, will encourage MSPs to elevate their security posture or risk losing business to their better-prepared competitors.

The bill can be read in its entirety here.

How will Senate Bill 273 impact you?

If you’re a Louisiana-based MSP, you must abide by the new laws in order to conduct business with a public body. Under Senate Bill 273, MSPs that provide IT infrastructure to public entities are required to:

Register with the Secretary of State
Report cyber incidents within 24 hours and ransomware payments within 10 days
Provide public access to information, including a record of cyber incidents
Be in good standing before they can partner with a public body.

MSPs that are based elsewhere in the country should keep a close eye on the Louisiana regulations. As MSPs play an increasingly important role in the public sector, it seems likely that similar regulations will be rolled out in other states in the future, possibly at the federal level. It’s also possible that similar models could be applied to other high-risk industries that deal with sensitive data, including the medical, financial and education sectors.

How to prepare for the coming changes

The prospect of added regulations will likely be met with skepticism from some MSPs. However, it’s important to note that the legislative intent of Senate Bill 273 is not to make it harder (or more expensive) for MSPs to do business with the state, nor is it to make it more difficult for new MSPs to enter the market. There are no licensing or certification requirements; in fact, the bill doesn’t actually do anything to directly address or resolve cybersecurity issues. Instead, the bill simply aims to improve accountability and transparency, which ultimately enables state entities to make better purchasing decisions.

While it’s still too early to judge the effectiveness of Senate Bill 273, it seems probable that other states will follow in Louisiana’s footsteps. The best way to prepare for future regulation is to bolster your cybersecurity posture. Service providers must be in good standing to do business with public entities, so it’s critical that MSPs utilize best practices now to avoid cyber incidents that could preclude them from doing business with the state further down the track.

For MSPs that are secure and transparent, regulation should be viewed not as an obstruction, but as an opportunity to demonstrate cyber resilience and perhaps gain a competitive advantage along the way.

Conclusion

Louisiana has taken steps towards regulating MSPs with the introduction of Senate Bill 273, which went into effect on 1 February 2021. The bill builds on existing breach notification laws and requires MPS to register with the Secretary of State and be in good standing before entering into business with a public entity.
... Continue Reading]]> Quote:

Register with the Secretary of State
Report cyber incidents within 24 hours and ransomware payments within 10 days
Provide public access to information, including a record of cyber incidents
Be in good standing before they can partner with a public body.