'Dharma': This ransomware is attacking small and medium businesses, average loss is Rs 6.4 lakh
"Dharma" has been known since 2016, and is one of the most profitable ransomware families around, due to its mass-market, service-based business model.
Small and medium businesses (SMBs) are witnessing an increased ransomware attack globally, including in India, this year and the ransom demands have reached nearly $8,620 (nearly Rs 6.4 lakh) on average in the pandemic times.
The "Dharma" ransomware-as-a-service (RaaS) attacks are troubling small and mid-sized businesses during the Covid-19 pandemic and the cybersecurity firm Sophos has witnessed 85 per cent of such attacks focusing on exposed access tools like Remote Desktop Protocol (RDP).
"Dharma is fast-food franchise ransomware: widely and easily available to just about anyone," said Sean Gallagher, senior threat researcher at Sophos.
"That's worrying enough in itself in normal times. But right now, with many businesses adapting to the pandemic and accommodating a need for rapid support for remote workers, and IT staffs stretched thin, the risks from these attacks are magnified," Gallagher said in a statement.
"Dharma" has been known since 2016, and is one of the most profitable ransomware families around, due to its mass-market, service-based business model.
Various iterations of its source code have been dumped online or offered for sale, so many variants of the code now exist.
Once Dharma customers, known as affiliates, have purchased the tools and compromised their target, they rely almost entirely on a menu-driven "PowerShell" script that installs and launches the components required to spread ransomware across the target's network.
When the master script is executed, it identifies itself as "Toolbox" and launches the attack with the message, "Have fun, bro!"
Sophos occasionally observed that affiliates are holding back some of the information as leverage to make additional ransom demands.
The key to avoid such ransomware attacks is to shut down internet-facing remote desktop protocol (RDP) to deny cybercriminals access to networks.
"If you need access to RDP, put it behind a VPN connection".
"Check that you have a full inventory of all devices connected to your network and always install the latest security updates, as soon as they are released, on all the devices and servers on your network," said the researchers.
The need to equip and enable an unexpectedly remote workforce has left small companies with vulnerable infrastructure and devices, and hindered the ability of IT support staff to adequately monitor and manage systems the way they normally would, Sophos observed.
Get Latest Business News, Stock Market Updates and Videos; Check your tax outgo through Income Tax Calculator and save money through our Personal Finance coverage. Check Business Breaking News Live on Zee Business Twitter and Facebook. Subscribe on YouTube.
RECOMMENDED STORIES
Senior Citizen Latest FD Rates: Know what major banks like SBI, PNB, Canara Bank, HDFC Bank, ICICI Bank are providing on fixed deposits
Gratuity Calculator: Rs 38,000 as last-drawn basic salary, 5 years and 5 months of service; what will be gratuity amount?
EPFO Pension Schemes: Early pension, retirement pension, nominee pension and 4 other pension schemes that every private sector employee should know
Top 5 Small Cap Mutual Funds with best SIP returns in 1 year: See how Rs 25,000 monthly investment has grown in each scheme
Top 7 SBI Mutual Funds With Best SIP Returns in 1 Year: Rs 25,000 monthly SIP investment in No.1 fund has jumped to Rs 3,58,404
04:30 PM IST