Ransomware/exfiltration Campaign Targets Remote Access, Resists Resolution Through Data Restoration

With the increase in personnel working remotely over VPN or remote desktop tools such as Citrix, RDP, or VNC, it's no surprise that malicious actors have focused more of their efforts towards these targets. Not every organization has properly enabled strong authentication and, as we have recently seen, phishing schemes and drive-by web exploits are also being used to access people's systems. Ransomware is a particularly destructive and frustrating attack, but there are ways to mitigate it. User education and good authentication practices can reduce the chance of infection, while frequent backups and a good disaster recovery plan can help mitigate the infection once it happens. An advanced security analytics platform can help identify an infection if it happens, starting with unusual user or device behavior, and can start mitigation and remediation procedures before the ransomware has infected more than a handful of systems.  Read Less