Ransomware Variants: “WannaCry” – Kidnapping You from Far

Several destructive ransomware variants (including DoublePulsar, WannaCry, Locky, CyptoLocker, CryptoDefense, CyptoWall, CTB-Locker, etc.) appeared to kidnap computers in the world. The number of ransomware infections has been increasing!

Impact

1. Encrypts files on victims’ computers, WannaCry encrypts files on victims’ computers and adds a .WCRY file extension to them.
2. Data will be unrecoverable due to encryption by ransomware.

Until now, there is NO effective method to decrypt all the kidnapped files.

Actions Preventing WannaCry / DoublePulsar Attack

To save your computer from harms, please remember:

1. Ensure PC has up-to-date Windows updates.
2. Disable SMBv1 – https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1,-smbv2,-and-smbv3-in-windows-vista,-windows-server-2008,-windows-7,-windows-server-2008-r2,-windows-8,-and-windows-server-2012
3. [Reminder] ‘System Watcher’ function should be enabled in Kaspersky anti-virus software. ‘System Watcher’ has a feature of rolling back any unwanted changes such as file encryption.
4. Ensure up-to-date anti-virus software.

As a Victim:

If you are unluckily being kidnapped by ransomware, please:

1. Disconnect your computer IMMEDIATELY from both wired and wireless network to avoid further impacts on shared network.
2. Use another clean computer to change all the passwords (such as email, e-banking, etc.) which have been used or saved on the infected computer.
3. DO NOT respond to any kidnapper by attempting payment and instead to report the incident to ITSC and the Police.
4. Prepare a clean computer and restore the files and data from the backup.

Reference:

• [HKCERT] Security Bulletin on “WannaCry Ransomware Encrypts Victim Data:
  https://www.hkcert.org/my_url/en/alert/17051301
• Microsoft Security Bulletin MS17-010 – Critical
  https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
• https://en.m.wikipedia.org/wiki/DoublePulsar
• Other Ransomware Variants

Please visit here for more Information Security tips.