Are you blocking websites today? If you are, they are most likely sites such as file sharing, public email, social media, and other non-business related websites.If you do not have a web filtering solution or have avoided blocking websites for the sake of keeping your employees happy, you should reconsider.<\/p>\n
Many of these sites, especially file sharing and social media have been used for malicious file or content hosting. Either you have been the victim or know of someone who was infected by one of these means. Recently we’ve seen an uptick in the use of paste sites to deliver multi-staged ransomware attacks.<\/p>\n
What is a paste site? Paste sites, also known as text-storage sites, are a type of online content hosting service where users can store plain text. Although the use of paste sites are not new, the reasons for which they are used, has evolved. Paste sites date back to the early 90’s when users wanted to share large chunks of text-based data. Fast forward to over five years ago, they served as a dumping ground for breached data such as email addresses and passwords. More recently these paste sites have been used to host content in multi-staged ransomware attacks.<\/p>\n
Why is this an issue? In many ransomware related events it was common to be breached by a macro infected document that was delivered by email, clicking on malicious link that dropped a file on your computer, or a threat actor gaining access to an internet facing machine with remote desktop enabled. Due to many of the old methods being detected and prevented, threat actors had to evolve their delivery methods. What they developed were multi-staged attacks. It should be known that the concept of multi-staged attacks is not new at all, and that it has been around for a while.<\/p>\n
The way multi-stage attacks work (in layman’s terms) is malware\/ransomware is broken up into several pieces and then reassembled at a later time. The way paste sites are being used is, threat actors are hosting “instructions”(a.k.a. code) that are being called by the the initial infection software that gets downloaded to a computer (loader). These instructions typically include other actual code, or point to other websites where malicious content is hosted and then automatically downloaded. Once the initial infection software has collected all of the pieces of the ransomware, it is reassembled and then the ransomware infection begins. The reason multi-staged attacks are used is simply to prevent detection by anti-virus solutions, and make it more difficult for malware reverse engineers to determine how an attack happened.<\/p>\n
So what should you be doing to further reduce your exposure to ransomware infections? Block paste sites! In the office there usually isn’t a need for it. If you have developers or IT folks, ensure some controls are put around what they do to ensure potential access to paste sites doesn’t present a big risk to the business. Here are a list of the most common paste sites to consider blocking:<\/p>\n