Imagine your business has been hit by ransomware.
Your files have been stolen, you’re trying to work out what’s happened, and you’re wondering what the criminals are going to do next.
Then someone gets in touch offering to help.
They say they’ve managed to get access to the criminals’ systems. They can delete your stolen information and may even be able to provide the key you need to recover your files.
It sounds like a lifeline.
But there’s a new ransomware scam where the people offering that lifeline may be the same people who caused the problem in the first place.
Researchers investigating several ransomware attacks recently came across a group calling itself “Ransom Busters”.
The group was contacting businesses that had been attacked and offering a recovery service. They claimed they’d broken into the systems used by ransomware gangs, giving them access to stolen information and the keys needed to unlock encrypted files.
There was something strange about the timing, though.
In some cases, Ransom Busters knew which businesses had been attacked before that information had been made public.
Researchers started looking more closely and found similarities between the ransomware attackers and the supposed recovery service, including the software they were using and the way they operated.
The people offering to rescue businesses may have been involved in attacking them in the first place.
Think about how effective that could be as a scam.
You’ve already got a business dealing with a cyberattack. People are under pressure, normal work may have been disrupted, sensitive information could have been stolen and difficult decisions need to be made quickly.
Then somebody arrives claiming they can make a big part of the problem disappear.
For a business owner in the middle of that situation, it’s easy to see why the offer could be tempting.
And that’s exactly what the criminals rely on.
Ransomware has changed enormously over the years. Early attacks generally encrypted files and demanded money for the key to unlock them. Businesses became much better at keeping backups, so criminals started stealing information and threatening to publish it.
Some attackers have added even more pressure by disrupting websites or contacting victims directly.
Now we’re seeing another tactic added to the mix: Pretending to be part of the recovery.
It makes an already difficult situation even harder because you have to be careful about who you trust at the moment you’re most in need of help.
That’s one reason I’d strongly recommend having an incident response plan before you need one.
If your business is attacked, you don’t want to start searching online for someone to help while you’re under that kind of pressure. You should already know who you’re going to call.
Your IT support partner can help investigate what happened, secure your systems and work with appropriate cybersecurity specialists where necessary. They can also help you make sense of any contact you receive from the attackers or anyone claiming they can recover your information.
And ideally, you’ve already done the preparation that gives you more options if ransomware ever hits.
That includes having reliable backups, making sure they’re properly protected, keeping your systems updated and putting sensible security measures around your accounts and data.
You can never guarantee that your business won’t be targeted. But you can make sure that if something does happen, you’re not making important decisions while trying to work out who you can trust.
We can help your business create a plan for dealing with a cyberattack before it happens. Get in touch.