Tech
Singapore Businesses Targeted by Ransomware Hackers Demanding Cryptocurrencies
Akira— a group of ransomware hackers — which extorted $42 million from more than 250 organizations in North America, Europe and Australia in one year, is now actively targeting Singapore companies, according to a joint advisory issued by the Singapore authorities.
The Cyber Security Agency of Singapore (CSA), the Singapore Police Force and the Data Protection Commission have recently received several complaints from victims of the cyber attack. THE CSA announced in a Twitter post that the joint consultation:
It highlights the observed tactics, techniques and procedures (TTPs) employed by the Akira threat group to compromise victims’ networks and provides some recommended measures for organizations to mitigate the threat posed.
Investigations conducted by the US Federal Bureau of Investigation (FBI) found that Akira ransomware primarily targets businesses and critical infrastructure entities. Singapore authorities have provided guidance on how to detect, deter and neutralize Akira attacks and have advised compromised companies to refrain from paying ransoms to attackers.
Akira members demand payments in cryptocurrencies such as Bitcoin (BTC) to regain control of their victims’ computer systems and internal data. However, Singapore authorities have advised companies not to make these payments, saying:
“If your organization’s systems have been compromised by ransomware, we advise against paying the ransom and advise you to report the incident to the authorities immediately. Paying the ransom does not guarantee that your data will be decrypted or that threat actors will not publish your data.”
Authorities warn that paying the ransom could lead to further attacks, as malicious entities could try to extort more money. The FBI also discovered that Akira never contacts his victims and expects them to contact him first.
Recommended threat mitigation techniques
To protect yourself from ransomware attacks like Akira, authorities recommend implementing a recovery plan and multi-factor authentication. Furthermore, they also suggest filtering network traffic, disabling unused ports and hyperlinks, and using system-level encryption.