選單
A A A
A A A
職員
學生
所有服務

更多服務 >

校內服務台
(+852) 39438845
網上服務台
Knowledge Base
用戶培訓
guide 用戶指南
網頁登入指南

Check Today Service Status More >

Ransomware Variants: “SamSam”

An growth of ransomware “SamSam”, aka MSIL/Samas.A (or variants: SamSam1, SamSam2, SamSam3 andSamSam4), was discovered and it targeted industries and critical infrastructures worldwide.

Accordingly to US-CERT report, cyber actors use either brute forace attacks or stolen login credentials, some even were purchased from known darknet marketplaces, to get the RDP credentials.  Then, they will make use of the Remote Desktop Protocol (RDP) to gain persistent access to a particular network, drop the malware onto the systems inside the network and run executable file to encrypt the systems, finally, a ransom note will be left for directing the victims to pay the ransom.

 

Impact
  • The intrusion is performed without victims’ notice, action or authorization, so the systems can be infected with minimal detection.
  • Once a system is infected, it may spread to all reachable hosts in the same network as well.
  • Encrypts the infected system and demands Bitcoin from victims for exchanging the cryptographic keys / tools to decrypt the systems.
Actions Preventing SamSam Attack
  1. Disable RDP and any other unnecessary services if they are not in-used or required.
  2. If RDP is required, they system should be protected by firewall and require users to use VPN before accessing the system.
  3. Use customized user name and ensure a “strong” password.
  4. Adopt 2-factor authentication to enhance the account protection.
  5. Ensure the system has up-to-date OS/software patches.
  6. Apply the latest anti-virus signatures and scan the files regularly.
  7. Restrict user’s ability to install/execute unwanted software.
  8. Enable various loggings including anti-virus log, system event logs, authentication logs and audit logs and review regularly.
  9. Backup the system regularly and keep them in a separate and safe place.
As a Victim:

Please DO NOT respond to any kidnapper by attempting payment and instead to report the incident to ITSC and the Police.

Reference:

Please visit here for more Information Security tips.

 

Created on: 04 Dec 2018

icon-1 icon-2 icon-3 icon-4
© 2022 香港中文大學 版權所有
⌃