skip to Main Content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail info@tidorg.com with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038 info@tidorg.com

    CISA Publishes Darkside Malware Analysis Report and Updated Best Practice Guidance Against Ransomware

    CISA Publishes Darkside Malware Report

    New details provide valuable insight into exactly how Darkside works to compromise and encrypt systems, with valuable guidance to avoid becoming a victim of ransomware.

    The U.S. government’s Cybersecurity & Infrastructure Security Agency (CISA) has been busy responding to the recent major attacks on critical infrastructure organizations by working diligently to collect, organize, and now disseminate intelligence about the Darkside ransomware-as-a-service variant. In a newly released Malware Analysis Report (MAR) on Darkside, CISA provides a ton of valuable detail including how Darkside is executed, directories and files it includes/excludes, process names used, services it terminates, and domain and IP information. This detail helps security practitioners understand how to detect Darkside before it can have an impact.

    In addition, their May Alert (AA21-131A), entitled DarkSide Ransomware: Best Practices for Preventing Business Disruption from Ransomware Attacks has been updated to include indicators of compromise as a STIX package.

    Some of the best practices to stopping Darkside and other ransomware variants are also worth noting:

    • Require Multi-factor Authentication
    • Enable strong email filtering
    • Filter network traffic to block ingress and egress C2 traffic
    • Keep systems and software updated
    • Stop macros and unwanted applications from running
    • Implement a Security Awareness Training program and regularly perform simulated phishing attacks to test users

    Free Ransomware Simulator Tool

    Threat actors are constantly coming out with new strains to evade detection. Is your network effective in blocking all of them when employees fall for social engineering attacks?

    KnowBe4’s “RanSim” gives you a quick look at the effectiveness of your existing network protection. RanSim will simulate 22 ransomware infection scenarios and 1 cryptomining infection scenario and show you if a workstation is vulnerable.

    RansIm-Monitor3

    Here’s how it works:

    • 100% harmless simulation of real ransomware and cryptomining infections
    • Does not use any of your own files
    • Tests 21 types of infection scenarios
    • Just download the install and run it 
    • Results in a few minutes!

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/ransomware-simulator-tool-partner?partnerid=001a000001lWEoJAAW

    close

    Sign Up to the TIO Intel Alerts!

    Back To Top