Cybereason Warns Global Organizations Against Destructive Ransomware Attacks From Black Basta Gang

Unique approach to evade anti-ransomware defenses: Royal ransomware expands the concept of partial encryption, which means it has the ability to encrypt a predetermined portion of the file content and base its partial encryption on a flexible percentage encryption, which makes detection more challenging for anti-ransomware solutions.

Multi-threaded ransomware: Royal ransomware employs multiple threads in order to accelerate the encryption process.

Global ransomware operation: Royal ransomware operates around the world, and reportedly on its own. The group doesn't appear to use ransomware-as-a-service or to target a specific sector or country.

High Severity: Cybereason assesses the threat level from Royal Ransomware to be HIGH given the rapid increase in attacks coming from this group over the past 60-90 days.

Practice good security hygiene: For example, implement a security awareness program for employees and ensure operating systems and other software are regularly updated and patched.

Confirm key players can be reached at any time of day: Critical response actions can be delayed when attacks occur over holidays and weekends.

Conduct periodic table-top exercises and drills: Include key stakeholders from other functions beyondsecurity, such as Legal, Human Resources, IT, and top executives, so everyone knows their roles and responsibilities to ensure as smooth a response as possible.

Implement clear isolation practices: This will stop any further ingress on the network and prevent ransomware from spreading to other devices. Security teams should be proficient at things like disconnecting a host, locking down a compromised account, and blocking a malicious domain.

Consider locking down critical accounts when possible: The path attackers often take in propagating ransomware across a network is to escalate privileges to the admin domain-level and then deploy the ransomware. Teams should create highly secured, emergency-only accounts in the active directory that are only used when other operational accounts are temporarily disabled as a precaution or inaccessible during a ransomware attack.

Deploy EDR on all endpoints: Endpoint detection and response (EDR) remains the quickest way for public and private sector businesses to address the ransomware scourge.