Ransomware attack

ISSUE

One client approached us to mitigate and find a solution for the Ransomware attack affecting their files in one of their critical department. 
They were using Kaspersky Antivirus as their endpoint protection which could not detect the Ransomware.

INVESTIGATION

The malware managed to get into one of the user’s Laptop who was getting remote support from a vendor using Anydesk. This tool allows transfer of files between two computers and it was not licensed version hence with no protection at all posing major security breaches. Local IT was not involved in this shadow IT support from a known application vendor.

SOLUTION

• immediate isolation of the affected department and file server hosting their files.
• removed the Kaspersky Antivirus as it was adding a double protection layer on top of existing Windows defender which had a Ransomware Protection with Controlled folder access turned OFF
• cleaned all affected machines with Malwarebytes software
• deleted all affected folder shares on users’ machines and file server
• restored all files successfully from SharePoint drive from the clean version of unencrypted files by Ransomware

WAY FORWARD

·       Kaspersky Antivirus was discarded in all machines and half of its cost was used to subscribe for online Malwarebytes protection

·       we suggested to the local IT team to adopt the Malwarebytes + Windows defender as the new multi-layered security strategy with

a.     ransomware protection tunned ON for each client running Windows Defender

b.     folders controller access also was turned ON

·       Detailed root course report was prepared, IT security policy was updated to include these changes and Teamviewer (lisensed) as a standard remote support tool. Their management was advised to run an Online Safety Awareness program to all of its user community so as to prevent similar attack in the future.