LockBit Ransomware Recruiting Insiders to Breach Corporate Networks - Binary Defense

Threat Watch

Threat Watch LockBit Ransomware Recruiting Insiders to Breach Corporate Networks

LockBit Ransomware Recruiting Insiders to Breach Corporate Networks

The LockBit 2.0 Ransomware gang is actively recruiting members of corporate businesses to help them encrypt networks. Many ransomware gangs use third-party threat actors to breach corporate networks, but, LockBit is attempting to cut out the middleman and simply recruit individuals that already have access to the network. The group states they are looking for individuals to “provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company.” The group also claims they will never ask for the identity of any individual and will guarantee their privacy. This is not the first time this tactic has been used. In August of 2020, the FBI arrested a Russian national attempting to recruit a Tesla employee to install malware on the company’s network.

ANALYST NOTES

To protect against ransomware attacks, organizations should regularly back up data, air gap, and password protect backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides. Implement network segmentation. Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, the cloud). Install updates/patch operating systems, software, and firmware as soon as practical after they are released. Implement monitoring of security events on employee workstations and servers, with a 24/7 Security Operations Center to detect threats and respond quickly such as Binary Defense’s Managed Detection and Response in conjunction with the Security Operations Task Force. Use Multi-Factor Authentication (MFA) where possible and avoid setting up MFA through SMS messaging as threat actors can easily gain access to mobile devices to steal the codes. Use strong passwords and regularly change passwords to network systems and accounts, implementing the shortest acceptable timeframe for password changes. Avoid reusing passwords for multiple accounts. Focus on cyber security awareness and training. Regularly provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.

Sources:

https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/?&web_view=true