The lasting impact of remote working has led to dramatic changes in how business is done and is triggering an unprecedented expansion of the attack surface. Ransomware attacks have exploded since the onset of the pandemic in 2020, further complicating the myriad operational challenges facing cybersecurity professionals. Ransomware damages from cybercrime are expected to hit $6 trillion in 2021, up from $20 billion in 2020 and $11.5 billion in 2019. The number of ransomware attacks will not only increase but we will see new forms of it with more sophistication and disruption than ever.

Ransomware has certainly driven many organisations to assess, develop and update their incident response and particularly anti-ransomware tactics to accelerate their response. An effective managed detection and response (MDR) capability is mitigating the risk of threats like ransomware that dangerous APT groups are strategically deploying.

Introducing MDR

Every 14 seconds a business falls prey to ransomware. While an overwhelming number of alerts come from security monitoring systems, nearly half of the alerts organisations receive go uninvestigated. With more device usage and greater connectivity than ever before, the attack surface expands and evolves rapidly, meaning the frequency of threats will only increase, but businesses don’t have to fight the ransomware battle alone. Implementing Managed Detection and Response can help prevent, detect and respond quickly to today’s digital attacks.

Attackers can stay hidden within your environment for several months, waiting for the right time to strike. With an MDR service, organisations get the support they require to enhance visibility and rapidly detect, investigate and respond to advanced threats. Managed Detection and Response combines multiple layers of defence to keep systems and critical data safe from cyber threats.

MDR monitors and detects threats in the network, cloud, and at endpoints with the world’s best cybersecurity experts, including a stronger security posture, faster threat detection and greater visibility. MDR helps you improve your organisation’s security posture and advance security operations efficiency with an expert team and industry-leading threat research.

Smarttech247 supplies the people, technology and intelligence required to hunt for threats across your organisation’s networks and help shut them down before they cause damage and disruption.

Should an attacker get in, you need to have a way to stop them before they can do anything truly malicious. Because it can infect and encrypt so quickly, quick and effective response to strategic ransomware is crucial. Managed Defence offers around-the-clock monitoring and alert prioritisation, and in the event of a ransomware attacks, a prioritised alert can be swiftly scoped and investigated by a security expert. A rapid response action can be triggered and this can prevent the damage from propagating.

Ransomware is a very real threat

Researchers estimate that the number of ransomware attacks grew by more than 150% in 2020 and the Ryuk ransomware group were behind one third of all ransomware attacks in 2020. Organisations targeted by ransomware are very frequently targeted for who they are but because they were targets of opportunity, not targets of choice.

Ryuk’s operators have invented new ways to deploy their malware, which targets weaknesses common to even the most sophisticated firms. Ryuk’s operators used highly tailored phishing emails to gain footholds within their targets. Its operators “live off the land,” using standard tools such as net view and Ping to surveil and map networks. Next, standard Windows administrative applications such as PowerShell and Windows Management Instrumentation (WMI) are used to move laterally within victim environments. Purpose-built attack tools such as Cobalt Strike, PowerShell Empire, and Mimikatz harvest credentials and hashes from high-value Windows domain controllers. After that, Ryuk operators use offline techniques, such as Kerberoasting, to crack passwords and elevate permissions.

Last year, in the midst of a global pandemic, Ryuk ransomware has been used to target dozens of hospitals and already caused significant interruption to operations. Notably, we saw the Ryuk group target the US healthcare system. Universal Healthcare Services (UHS), a Fortune 500 company, resorted to a manual system after the crippling Ryuk ransomware attack shut down its computer systems in October 2020. The attack affected several branches of the healthcare provider. Ryuk ransomware was implicating in the attack after a typical ransom note “Shadow of the Universe” popped up on the affected computers.

Reducing the time to detection and response

As enterprise mobility, cloud services and ‘bring-your-own-everything’ have taken off, the perimeter separating an organisation’s systems from the wider world has all but disappeared. While increased mobility may make an organisation and its employees more productive, it also creates layers of complexity for securing the enterprise. The truth is that most organisations take too long to detect and mitigate attacks.

MDR detects ransomware that can bypass traditional anti-virus defences, spread laterally, and cripple an organisations network. Investigators research the suspicious file access activity and lateral movement attempts throughout your network.

MDR responds by isolating the host, cleaning the infection, and blocking external command and control servers to prevent any other hosts from infecting.

MDR services are not limited to greater detection and response capabilities. They also provide proactive defence intelligence and insight of advanced threats to potentially overwhelmed security teams. Detection levels are improved while dwell time of breaches are reduced. Compliance challenges also can be met using MDR services providing full stakeholder reporting and log retention on a wide range of regulations and standards.

To understand how much you can save by outsourcing your security operations centre, you can request a free financial analysis with us today.