Media Coverage

Dallas-based cybersecurity software developer Trend Micro is taking aim at the ransomware market, saying yesterday that it has launched a new, free hotline to help victims of ransomware, and also rolled out a number of free tools to help remove ransomware from computers.

“But if there’s one lesson from the survey that everyone should take and act on right away, it’s that the ransomware threat should be met with a full reevaluation of your organizations countermeasures to see if they really are matching the latest threats out there,” Trend Micro explained in a blog post.

First, Trend Micro reported last week that the so-called “Godless” mobile malware can target any Android running Android 5.1 (Lollipop) or earlier.

Mergers and acquisitions (M&A) are constantly occurring and are complex transactions, often involving entities from around the globe: from bankers, lawyers and investors facilitating the deal, to the actual business owners and stakeholders who benefit.

A similar revision of the balance between victim and kidnapper took place following the terrorist attacks of September 11, 2001, points out Christopher Budd, global threat communications manager at Trend Micro. The terrorists who hijacked multiple planes broke with the traditional hostage-for-ransom model, to say the least. Their actions inspired a no-tolerance attitude toward hijackings that took negotiation or ransom out of the picture.

The information age and impact of globalization have thrust new demands upon the United States’ national security and public safety leadership. The need for technological superiority combined with strategic planning in a rapidly changing global environment is paramount to protecting US citizens. However, it is apparent that technological advantage is no guarantee for future success on this “new battlefield.”

Security firm Trend Micro said the malware, dubbed Godless (ANDROIDOS_GODLESS.HRX), targets a set of rooting exploits in its pockets and uses multiple exploits that can target virtually any Android device running Android 5.1 (Lollipop) or earlier.

“Even without counting the ransom itself, organizations affected by ransomware are going to have to deal with the costs of containment, downtime, and recovery,” explains Mark Nunnikhoven, vice president of cloud research at Trend Micro Inc., a global IT security provider with U.S. headquarters in Irving, Texas. “Prevention is best in order to avoid getting to that point where the tough discussion around paying needs to occur.”

As ransomware grows in popularity, TrendMicro researchers said aside from the social engineeringtactics and commercial grade encryption deployed on victims, cyber crooks also use less sophisticated malware routines including deleting shadow copies, using startup modification, using propagation tactics anti-detection mechanisms and other methods that wreak greater havoc when combined, according to a June 16 blog post.

Ransomware is type of malware that criminals use to lock users out of their own files. Once the user is locked out, a ransom note is displayed providing instructions on how to pay the criminal in order to – potentially – regain access to your data.

"There are no major differences between a FLocker variant that can infect a mobile device and one that affects smart TVs," Trend Micro researcher Echo Duan wrote in a blog post.

"If the Twitter password is reused elsewhere, Twitter two-factor authentication isn't going to help you on those other accounts," Trend Micro Global Threat Communications Manager Christopher Budd told TechNewsWorld.

"If the Twitter password is reused elsewhere, Twitter two-factor authentication isn't going to help you on those other accounts," Trend Micro Global Threat Communications Manager Christopher Budd told TechNewsWorld.

Somewhat interestingly, the individual conducting the chat conversation did not appear to know the ransom amount that the victim was being asked to pay and appeared reliant on the honesty of the victim to provide that information. “That’s because they haven’t built a channel to upload data from the victim to the ‘call center,’” says Christopher Budd, global threat communications manager at Trend Micro.

“The benefit is the user doesn't get infected, so the likelihood that they won't report the issue to the website owner is higher than if malware was used to infect them,” Trend Micro Senior Global Marketing Manager Jon Clay told SCMagazine.com. “This allows their scam to run longer than normal.”

FastPOS doesn't care about this aspect, and Trend Micro says the malware sends any stolen data to the C&C server as soon as it can get its hands on it.

While analyzing the threat, researchers with security firm Trend Micro observed that it was designed to target Windows XP 64-bit computers and that it can also run on more recent versions of Windows such as Windows 7 and 8.

“Most targeted attacks take minutes or seconds for the initial compromise,” explains Ed Cabrera, VP of Cyber Security Strategy at Trend Micro. “But it takes months or years to detect them.”

Software security vendor Trend Micro is promoting a layered approach to defending against the increasing threat of ransomware and malware.

After TeslaCrypt's authors publicly released the ransomware's master decryption key last week, Trend Micro researchers spotted cyber crooks jumping to CryptXXX.

Trend Micro recommends a layered protection approach involving a combination of web/email gateway, endpoint, server and network security. The firm said it stopped a massive 99 million ransomware threats for its customers between October 2015 and April 2016 – although admitted the actual figure for real infections globally is likely to be many times this number.

"Mac OS X and iOS are platforms that Trend Micro's security researchers look at," Christopher Budd, global threat communications manager at Trend Micro, told eWEEK. "As far as our Zero Day Initiative soliciting vulnerabilities from researchers for Mac OS X and iOS for possible vulnerabilities, Mac OS is one of the platforms of focus for Pwn2Own 2016."

Although cybercriminals have been turning out specialized hacking and attack tools at a rapid pace, terrorists are often using legitimate, consumer-focused technologies, according to a new Trend Micro report.

Trend Micro also supports the new policy, saying: "These changes were made in response to Trend Micro and other VirusTotal contributors seeing more and more companies that do not materially contribute to VirusTotal benefit from the data and analysis of those of us who do contribute on an ongoing basis."

Ed Cabrera, VP of Cyber Security Strategy at Trend Micro, advises a “3, 2, 1” rule for backups: three copies, in two different formats, with one held offsite. He describes it as a more resilient way to store backup files, while having offsite copies protects both the backups and infrastructure.