![\"\"](\"https:\/\/new.kinetics.co.nz\/wp-content\/uploads\/2019\/04\/GandCrab.jpg\")
<\/p>\n
Heaven only knows where they get their names from.\u00a0 One group we recently became aware of is called ‘PINCHY SPIDER’, and they are doing something called ‘Big Game Hunting’.<\/p>\n
Back in January 2018, they created a ransomware<\/a>\u00a0toolkit called GandCrab.\u00a0 While most ransomware today spreads through SPAM email, this uses an older technique.\u00a0 It uses an exploit kit to spread, mainly through infecting websites, then taking advantage of vulnerabilities in common software like Internet Explorer, Chrome, Java and Flash.\u00a0 Where it is particularly effective is that it then lies in wait.\u00a0 If it can sense other computers on a local network, then it uses Remote Desktop Protocol\u00a0 (that’s the same RDP that most of us use for remote access to work) to attack them and spread further.<\/p>\n <\/p>\n Now it seems that they have refined their model. \u00a0 <\/strong><\/p>\n They work with ‘affiliates’ for a share of the ransom.\u00a0 It’s reported the PINCHY SPIDER people take 40% of the profits, with the affiliate ‘earning’ the rest for what is described a surgical strike.\u00a0 Yes, they are franchising cyber-crime!<\/strong>\u00a0<\/strong>These affiliates target an organisation, crafting their attacks, refining their knowledge of the target until they succeed.<\/p>\n It seems that once they penetrate the target, they then quietly work laterally to get their evil software onto the machines that will cause the most harm, whether that’s a server or a set of specific PCs.\u00a0 They want to minimise the trail they leave behind, making it hard for the security software people to find ways to identify their footprints, and they may even manually remove their software from less-valuable machines as they move through the organisation. \u00a0 If they encounter roadblocks, it seems they also manually work through these, removing or disabling all, or part, of your security tools until they can continue spreading their infection.<\/p>\n These are carefully crafted attacks.\u00a0 <\/strong>They reconnoitre their victims and plan their attacks.\u00a0 They sneak around your system until they are ready, then they strike.<\/p>\n Unfortunately, none of these steps are fool-proof.\u00a0 They are all layers.\u00a0 For example, even backups are compromised if they are connected to your system and become encrypted themselves.\u00a0 Likewise, if the compromised software doesn’t activate straightaway, then it might hide, dormant, even on your backups.<\/p>\n However you do need to take all reasonable steps, which is the stance we’ve taken with our KARE for Security<\/a> s<\/strong>ervice and you need to look at cyber-insurance<\/a>.<\/strong><\/p>\n If you want to read more:<\/strong><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" Cyber-crime has become big business It’s organised, and the purveyors are shameless in their determination to steal from all of us. Heaven only knows where they get their names from.\u00a0 One group we recently became aware of is called ‘PINCHY SPIDER’, and they are doing something called ‘Big Game Hunting’. Back in January 2018, they […]<\/p>\n","protected":false},"author":5,"featured_media":3512,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"[header2 text=\"Cyber-crime has become big business\" align=\"left\" color=\"#336A40\" margintop=\"\"]\n\nIt's organised, and the purveyors are shameless in their determination to steal from all of us.<\/strong>\n\nBig Game Hunting<\/h2>\n
What can you do?<\/h4>\n
\n
\n
\n
![\"\"](\"http:\/\/kinetics.co.nz\/wp-content\/uploads\/2019\/04\/GandCrab.jpg\")
\n\nHeaven only knows where they get their names from.\u00a0 One group we recently became aware of is called 'PINCHY SPIDER', and they are doing something called 'Big Game Hunting'.\n\nBack in\u00a0\u00a0[wow_colorme]January 2018, they created a ransomware[\/wow_colorme]<\/a> toolkit called GandCrab.\u00a0 While most ransomware today spreads through SPAM email, this uses an older technique.\u00a0 It uses an exploit kit to spread, mainly through infecting websites, then taking advantage of vulnerabilities in common software like Internet Explorer, Chrome, Java and Flash.\u00a0 Where it is particularly effective is that it then lies in wait.\u00a0 If it can sense other computers on a local network, then it uses Remote Desktop Protocol\u00a0 (that's the same RDP that most of us use for remote access to work) to attack them and spread further.\n\n[wow_spacing size=\"-20px\"]\n\n[header2 text=\"Big Game Hunting\" align=\"left\" color=\"#336A40\" margintop=\"\"]\n\n[wow_spacing size=\"-10px\"]\n\nNow it seems that they have refined their model. \u00a0 <\/strong>\n\nThey work with 'affiliates' for a share of the ransom.\u00a0 It's reported the PINCHY SPIDER people take 40% of the profits, with the affiliate 'earning' the rest for what is described a surgical strike.\u00a0 Yes, they are franchising cyber-crime!<\/strong>\u00a0<\/strong>These affiliates target an organisation, crafting their attacks, refining their knowledge of the target until they succeed.\n\nIt seems that once they penetrate the target, they then quietly work laterally to get their evil software onto the machines that will cause the most harm, whether that's a server or a set of specific PCs.\u00a0 They want to minimise the trail they leave behind, making it hard for the security software people to find ways to identify their footprints, and they may even manually remove their software from less-valuable machines as they move through the organisation. \u00a0 If they encounter roadblocks, it seems they also manually work through these, removing or disabling all, or part, of your security tools until they can continue spreading their infection.\n\nThese are carefully crafted attacks.\u00a0 <\/strong>They reconnoitre their victims and plan their attacks.\u00a0 They sneak around your system until they are ready, then they strike.\nWhat can you do?<\/h4>\n
\n \t
\n \t