10-12-2020, 05:02 PM
How Microsoft helped combat ransomware ahead of US elections
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/how-microsoft-helped-combat-ransomware-ahead-of-us-elections.jpg" width="1024" height="715" title="" alt="" /></div><div><div><img src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/how-microsoft-helped-combat-ransomware-ahead-of-us-elections.jpg" class="ff-og-image-inserted"></div>
<p>Today we took action to disrupt a botnet called Trickbot, one of the world’s most infamous botnets and prolific distributors of ransomware.</p>
<p>As the <a href="https://www.reuters.com/article/us-usa-cyber-election-exclusive/exclusive-u-s-officials-fear-ransomware-attack-against-2020-election-idUSKCN1VG222">United States government</a> and independent experts have warned, <a href="https://us-cert.cisa.gov/Ransomware">ransomware</a> is one of the largest <a href="https://www.nytimes.com/2020/09/27/technology/2020-election-security-threats.html">threats</a> to the upcoming elections. Adversaries can use ransomware to infect a computer system used to maintain voter rolls or report on election-night results, seizing those systems at a prescribed hour optimized to sow chaos and distrust.</p>
<p>We disrupted Trickbot through a court order we obtained as well as technical action we executed in partnership with telecommunications providers around the world. We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems.</p>
<p>In addition to protecting election infrastructure from ransomware attacks, today’s action will protect a wide range of organizations including <a href="https://www.fsisac.com/insights/ransomware-today-a-diversified-business-model">financial services institutions</a>, government agencies, healthcare facilities, businesses and universities from the various malware infections Trickbot enabled.</p>
<p><strong>The Trickbot botnet</strong></p>
<p>Trickbot has infected over a million computing devices around the world since late 2016. While the exact identity of the operators is unknown, research suggests they serve both nation-states and criminal networks for a variety of objectives.</p>
<p>In the course of Microsoft’s investigation into Trickbot, we analyzed approximately 61,000 samples of Trickbot malware. What makes it so dangerous is that it has modular capabilities that constantly evolve, infecting victims for the operators’ purposes through a “malware-as-a-service” model. Its operators could provide their customers access to infected machines and offer them a delivery mechanism for many forms of malware, including ransomware. Beyond infecting end user computers, Trickbot has also infected a number of “Internet of Things” devices, such as routers, which has extended Trickbot’s reach into households and organizations.</p>
<p>In addition to maintaining modular capabilities for a variety of end purposes, the operators have proven adept at changing techniques based on developments in society. Trickbot’s spam and spear phishing campaigns used to distribute malware have included topics such as Black Lives Matter and COVID-19, enticing people to click on malicious documents or links. Based on the data we see through Microsoft Office 365 Advanced Threat Detection, Trickbot has been the most prolific malware operation using COVID-19 themed lures.</p>
<p><strong>Disruption components and new legal strategy </strong></p>
<p>We took today’s action after the United States District Court for the Eastern District of Virginia granted our request for a court order to halt Trickbot’s operations.</p>
<p>During the investigation that underpinned our case, we were able to identify operational details including the infrastructure Trickbot used to communicate with and control victim computers, the way infected computers talk with each other, and Trickbot’s mechanisms to evade detection and attempts to disrupt its operation. As we observed the infected computers connect to and receive instructions from command and control servers, we were able to identify the precise IP addresses of those servers. With this evidence, the court granted approval for Microsoft and our partners to disable the IP addresses, render the content stored on the command and control servers inaccessible, suspend all services to the botnet operators, and block any effort by the Trickbot operators to purchase or lease additional servers.</p>
<p>To execute this action, Microsoft formed an international group of industry and telecommunications providers. Our Digital Crimes Unit (DCU) led investigation efforts including detection, analysis, telemetry, and reverse engineering, with additional data and insights to strengthen our legal case from a global network of partners including <a href="https://www.fsisac.com/msftoctober" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.fsisac.com/msftoctober&source=gmail&ust=1602586386085000&usg=AFQjCNGfycffpfp6RDmzYoeApGLYuYb-zw">FS-ISAC</a>, <a href="https://www.eset.com/int/about/newsroom/press-releases/research/eset-takes-part-in-global-operation-to-disrupt-trickbot-a-botnet-that-has-infected-over-a-million-c/" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.eset.com/int/about/newsroom/press-releases/research/eset-takes-part-in-global-operation-to-disrupt-trickbot-a-botnet-that-has-infected-over-a-million-c/&source=gmail&ust=1602586386085000&usg=AFQjCNG1NMtdPJn0KDuXEQ2u3gE5ljKR4g">ESET</a>, <a href="https://blog.lumen.com/a-look-inside-the-trickbot-botnet" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://blog.lumen.com/a-look-inside-the-trickbot-botnet&source=gmail&ust=1602586386085000&usg=AFQjCNFAAifgzehHAR5urt13Jf6Wvu4vhQ">Lumen’s Black Lotus Labs</a>, <a href="https://hello.global.ntt/" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://hello.global.ntt/&source=gmail&ust=1602586386085000&usg=AFQjCNFqzrBPkBFvAD1ubhlXwcElq5-BQA">NTT</a> and <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/trickbot-botnet-ransomware-disruption" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/trickbot-botnet-ransomware-disruption&source=gmail&ust=1602586386085000&usg=AFQjCNHa3df6hu2-VcUl5YS933tYL3sSHA">Symantec, a division of Broadcom</a>, in addition to our <a href="https://aka.ms/trickbot-disrupted" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://aka.ms/trickbot-disrupted&source=gmail&ust=1602586386085000&usg=AFQjCNHfN7_dFMDwdJfr1WJpiVl4Fg2KUQ">Microsoft Defender</a> team. Further action to remediate victims will be supported by internet service providers (ISPs) and computer emergency readiness teams (CERTs) around the world.</p>
<p>This action also represents a new legal approach that our DCU is using for the first time. Our case includes copyright claims against Trickbot’s malicious use of our software code. This approach is an important development in our efforts to stop the spread of malware, allowing us to take civil action to protect customers in the large number of countries around the world that have these laws in place.</p>
<p>We fully anticipate Trickbot’s operators will make efforts to revive their operations, and we will work with our partners to monitor their activities and take additional legal and technical steps to stop them.</p>
<p><strong>Impact to additional sectors</strong></p>
<p>In addition to its threat to elections, Trickbot is known for using malware to reach online banking websites and steal funds from people and financial institutions. Financial institutions ranging from global banks and payments processors to regional credit unions have been targeted by Trickbot. For this reason, the Financial Services Information Sharing and Analysis Center (FS-ISAC) has been a critical partner and a co-plaintiff in our legal action.</p>
<p>When someone using a Trickbot-infected computer attempts to log onto a financial institutions website, Trickbot executes a series of activities to secretly hijack the user’s web browser, capture the person’s online financial login credentials and other personal information, and send that information to the criminal operators. People are unaware of Trickbot’s activity as the operators have designed it to hide itself. After Trickbot captures login credentials and personal information, operators use that information to access people’s bank accounts. People experience a normal login process and are typically unaware of the underlying surveillance and theft.</p>
<p>Trickbot is also known to deliver the Ryuk crypto-ransomware that has been used in attacks against a wide range of public and private institutions. Ransomware can have devastating effects. Most recently, it crippled the IT network of a German hospital resulting in the death of a woman seeking emergency treatment. Ryuk is a sophisticated crypto-ransomware because it identifies and encrypts network files and disables Windows System Restore to prevent people from being able to recover from the attack without external backups. Ryuk has been attacking organizations, including municipal governments, state courts, hospitals, nursing homes, enterprises and large universities. For example, Ryuk has been attributed to attacks targeting a contractor for the Department of Defense, the North Carolina city of Durham, an IT provider for 110 nursing homes, and a number of hospitals during the COVID-19 pandemic.</p>
<p><strong>Election security and guarding against malware</strong></p>
<p>As we shared last month in the <a href="https://blogs.microsoft.com/on-the-issues/2020/09/29/microsoft-digital-defense-report-cyber-threats/">Microsoft Digital Defense Report</a>, ransomware is on the rise. For organizations involved in the elections wanting protection from ransomware and other threats, we offer the threat notification service <a href="https://www.microsoftaccountguard.com/en-us/">AccountGuard</a> at no cost which now protects more than two million email accounts around the world. We’ve completed more than 1,500 AccountGuard nation-state attack notifications to AccountGuard enrollees to date. We also offer <a href="https://m365forcampaigns.microsoft.com/en-us/">Microsoft 365 for Campaigns</a>, an easy-to-set-up version of Microsoft 365 that comes with intelligent and secure default settings at an affordable price. Finally, <a href="https://blogs.microsoft.com/on-the-issues/2020/04/02/defending-democracy-program-extended/">Election Security Advisors</a> provide proactive resiliency services and reactive incident response for campaigns and election officials, also at an affordable price.</p>
<p>Our Digital Crimes Unit will also continue to engage in operations to protect organizations involved in the democratic process and our entire customer base. Since 2010, Microsoft, through the Digital Crimes Unit, has collaborated with law enforcement and other partners on 23 malware and nation-state domain disruptions, resulting in over 500 million devices rescued from cybercriminals. With this civil action, we have leveraged a new legal strategy that allows us to enforce copyright law to prevent Microsoft infrastructure, in this case our software code, from being used to commit crime. As copyright law is more common than computer crime law, this new approach helps us pursue bad actors in more jurisdictions around the world.</p>
<p>To make sure your computer is free of malware, visit <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download">support.microsoft.com/botnets</a>.</p>
<p class="tag-list">Tags: <a aria-label="See more stories about cybersecurity" href="https://blogs.microsoft.com/on-the-issues/tag/cybersecurity-2/" rel="tag">cybersecurity</a>, <a aria-label="See more stories about Defending Democracy Program" href="https://blogs.microsoft.com/on-the-issues/tag/defending-democracy-program/" rel="tag">Defending Democracy Program</a>, <a aria-label="See more stories about ElectionGuard" href="https://blogs.microsoft.com/on-the-issues/tag/electionguard/" rel="tag">ElectionGuard</a>, <a aria-label="See more stories about ransomware" href="https://blogs.microsoft.com/on-the-issues/tag/ransomware/" rel="tag">ransomware</a>, <a aria-label="See more stories about trickbot" href="https://blogs.microsoft.com/on-the-issues/tag/trickbot/" rel="tag">trickbot</a></p>
</div>
https://www.sickgaming.net/blog/2020/10/...elections/
<div style="margin: 5px 5% 10px 5%;"><img src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/how-microsoft-helped-combat-ransomware-ahead-of-us-elections.jpg" width="1024" height="715" title="" alt="" /></div><div><div><img src="https://www.sickgaming.net/blog/wp-content/uploads/2020/10/how-microsoft-helped-combat-ransomware-ahead-of-us-elections.jpg" class="ff-og-image-inserted"></div>
<p>Today we took action to disrupt a botnet called Trickbot, one of the world’s most infamous botnets and prolific distributors of ransomware.</p>
<p>As the <a href="https://www.reuters.com/article/us-usa-cyber-election-exclusive/exclusive-u-s-officials-fear-ransomware-attack-against-2020-election-idUSKCN1VG222">United States government</a> and independent experts have warned, <a href="https://us-cert.cisa.gov/Ransomware">ransomware</a> is one of the largest <a href="https://www.nytimes.com/2020/09/27/technology/2020-election-security-threats.html">threats</a> to the upcoming elections. Adversaries can use ransomware to infect a computer system used to maintain voter rolls or report on election-night results, seizing those systems at a prescribed hour optimized to sow chaos and distrust.</p>
<p>We disrupted Trickbot through a court order we obtained as well as technical action we executed in partnership with telecommunications providers around the world. We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems.</p>
<p>In addition to protecting election infrastructure from ransomware attacks, today’s action will protect a wide range of organizations including <a href="https://www.fsisac.com/insights/ransomware-today-a-diversified-business-model">financial services institutions</a>, government agencies, healthcare facilities, businesses and universities from the various malware infections Trickbot enabled.</p>
<p><strong>The Trickbot botnet</strong></p>
<p>Trickbot has infected over a million computing devices around the world since late 2016. While the exact identity of the operators is unknown, research suggests they serve both nation-states and criminal networks for a variety of objectives.</p>
<p>In the course of Microsoft’s investigation into Trickbot, we analyzed approximately 61,000 samples of Trickbot malware. What makes it so dangerous is that it has modular capabilities that constantly evolve, infecting victims for the operators’ purposes through a “malware-as-a-service” model. Its operators could provide their customers access to infected machines and offer them a delivery mechanism for many forms of malware, including ransomware. Beyond infecting end user computers, Trickbot has also infected a number of “Internet of Things” devices, such as routers, which has extended Trickbot’s reach into households and organizations.</p>
<p>In addition to maintaining modular capabilities for a variety of end purposes, the operators have proven adept at changing techniques based on developments in society. Trickbot’s spam and spear phishing campaigns used to distribute malware have included topics such as Black Lives Matter and COVID-19, enticing people to click on malicious documents or links. Based on the data we see through Microsoft Office 365 Advanced Threat Detection, Trickbot has been the most prolific malware operation using COVID-19 themed lures.</p>
<p><strong>Disruption components and new legal strategy </strong></p>
<p>We took today’s action after the United States District Court for the Eastern District of Virginia granted our request for a court order to halt Trickbot’s operations.</p>
<p>During the investigation that underpinned our case, we were able to identify operational details including the infrastructure Trickbot used to communicate with and control victim computers, the way infected computers talk with each other, and Trickbot’s mechanisms to evade detection and attempts to disrupt its operation. As we observed the infected computers connect to and receive instructions from command and control servers, we were able to identify the precise IP addresses of those servers. With this evidence, the court granted approval for Microsoft and our partners to disable the IP addresses, render the content stored on the command and control servers inaccessible, suspend all services to the botnet operators, and block any effort by the Trickbot operators to purchase or lease additional servers.</p>
<p>To execute this action, Microsoft formed an international group of industry and telecommunications providers. Our Digital Crimes Unit (DCU) led investigation efforts including detection, analysis, telemetry, and reverse engineering, with additional data and insights to strengthen our legal case from a global network of partners including <a href="https://www.fsisac.com/msftoctober" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.fsisac.com/msftoctober&source=gmail&ust=1602586386085000&usg=AFQjCNGfycffpfp6RDmzYoeApGLYuYb-zw">FS-ISAC</a>, <a href="https://www.eset.com/int/about/newsroom/press-releases/research/eset-takes-part-in-global-operation-to-disrupt-trickbot-a-botnet-that-has-infected-over-a-million-c/" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.eset.com/int/about/newsroom/press-releases/research/eset-takes-part-in-global-operation-to-disrupt-trickbot-a-botnet-that-has-infected-over-a-million-c/&source=gmail&ust=1602586386085000&usg=AFQjCNG1NMtdPJn0KDuXEQ2u3gE5ljKR4g">ESET</a>, <a href="https://blog.lumen.com/a-look-inside-the-trickbot-botnet" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://blog.lumen.com/a-look-inside-the-trickbot-botnet&source=gmail&ust=1602586386085000&usg=AFQjCNFAAifgzehHAR5urt13Jf6Wvu4vhQ">Lumen’s Black Lotus Labs</a>, <a href="https://hello.global.ntt/" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://hello.global.ntt/&source=gmail&ust=1602586386085000&usg=AFQjCNFqzrBPkBFvAD1ubhlXwcElq5-BQA">NTT</a> and <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/trickbot-botnet-ransomware-disruption" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/trickbot-botnet-ransomware-disruption&source=gmail&ust=1602586386085000&usg=AFQjCNHa3df6hu2-VcUl5YS933tYL3sSHA">Symantec, a division of Broadcom</a>, in addition to our <a href="https://aka.ms/trickbot-disrupted" target="_blank" rel="noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://aka.ms/trickbot-disrupted&source=gmail&ust=1602586386085000&usg=AFQjCNHfN7_dFMDwdJfr1WJpiVl4Fg2KUQ">Microsoft Defender</a> team. Further action to remediate victims will be supported by internet service providers (ISPs) and computer emergency readiness teams (CERTs) around the world.</p>
<p>This action also represents a new legal approach that our DCU is using for the first time. Our case includes copyright claims against Trickbot’s malicious use of our software code. This approach is an important development in our efforts to stop the spread of malware, allowing us to take civil action to protect customers in the large number of countries around the world that have these laws in place.</p>
<p>We fully anticipate Trickbot’s operators will make efforts to revive their operations, and we will work with our partners to monitor their activities and take additional legal and technical steps to stop them.</p>
<p><strong>Impact to additional sectors</strong></p>
<p>In addition to its threat to elections, Trickbot is known for using malware to reach online banking websites and steal funds from people and financial institutions. Financial institutions ranging from global banks and payments processors to regional credit unions have been targeted by Trickbot. For this reason, the Financial Services Information Sharing and Analysis Center (FS-ISAC) has been a critical partner and a co-plaintiff in our legal action.</p>
<p>When someone using a Trickbot-infected computer attempts to log onto a financial institutions website, Trickbot executes a series of activities to secretly hijack the user’s web browser, capture the person’s online financial login credentials and other personal information, and send that information to the criminal operators. People are unaware of Trickbot’s activity as the operators have designed it to hide itself. After Trickbot captures login credentials and personal information, operators use that information to access people’s bank accounts. People experience a normal login process and are typically unaware of the underlying surveillance and theft.</p>
<p>Trickbot is also known to deliver the Ryuk crypto-ransomware that has been used in attacks against a wide range of public and private institutions. Ransomware can have devastating effects. Most recently, it crippled the IT network of a German hospital resulting in the death of a woman seeking emergency treatment. Ryuk is a sophisticated crypto-ransomware because it identifies and encrypts network files and disables Windows System Restore to prevent people from being able to recover from the attack without external backups. Ryuk has been attacking organizations, including municipal governments, state courts, hospitals, nursing homes, enterprises and large universities. For example, Ryuk has been attributed to attacks targeting a contractor for the Department of Defense, the North Carolina city of Durham, an IT provider for 110 nursing homes, and a number of hospitals during the COVID-19 pandemic.</p>
<p><strong>Election security and guarding against malware</strong></p>
<p>As we shared last month in the <a href="https://blogs.microsoft.com/on-the-issues/2020/09/29/microsoft-digital-defense-report-cyber-threats/">Microsoft Digital Defense Report</a>, ransomware is on the rise. For organizations involved in the elections wanting protection from ransomware and other threats, we offer the threat notification service <a href="https://www.microsoftaccountguard.com/en-us/">AccountGuard</a> at no cost which now protects more than two million email accounts around the world. We’ve completed more than 1,500 AccountGuard nation-state attack notifications to AccountGuard enrollees to date. We also offer <a href="https://m365forcampaigns.microsoft.com/en-us/">Microsoft 365 for Campaigns</a>, an easy-to-set-up version of Microsoft 365 that comes with intelligent and secure default settings at an affordable price. Finally, <a href="https://blogs.microsoft.com/on-the-issues/2020/04/02/defending-democracy-program-extended/">Election Security Advisors</a> provide proactive resiliency services and reactive incident response for campaigns and election officials, also at an affordable price.</p>
<p>Our Digital Crimes Unit will also continue to engage in operations to protect organizations involved in the democratic process and our entire customer base. Since 2010, Microsoft, through the Digital Crimes Unit, has collaborated with law enforcement and other partners on 23 malware and nation-state domain disruptions, resulting in over 500 million devices rescued from cybercriminals. With this civil action, we have leveraged a new legal strategy that allows us to enforce copyright law to prevent Microsoft infrastructure, in this case our software code, from being used to commit crime. As copyright law is more common than computer crime law, this new approach helps us pursue bad actors in more jurisdictions around the world.</p>
<p>To make sure your computer is free of malware, visit <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download">support.microsoft.com/botnets</a>.</p>
<p class="tag-list">Tags: <a aria-label="See more stories about cybersecurity" href="https://blogs.microsoft.com/on-the-issues/tag/cybersecurity-2/" rel="tag">cybersecurity</a>, <a aria-label="See more stories about Defending Democracy Program" href="https://blogs.microsoft.com/on-the-issues/tag/defending-democracy-program/" rel="tag">Defending Democracy Program</a>, <a aria-label="See more stories about ElectionGuard" href="https://blogs.microsoft.com/on-the-issues/tag/electionguard/" rel="tag">ElectionGuard</a>, <a aria-label="See more stories about ransomware" href="https://blogs.microsoft.com/on-the-issues/tag/ransomware/" rel="tag">ransomware</a>, <a aria-label="See more stories about trickbot" href="https://blogs.microsoft.com/on-the-issues/tag/trickbot/" rel="tag">trickbot</a></p>
</div>
https://www.sickgaming.net/blog/2020/10/...elections/