Travelex Ransomware Attack: What You Need to Know

How Can You Protect Your Organisation?

It is commonly acknowledged that many of these attacks follow a similar pattern. The attacker gains initial access via some means, be it a vulnerability in the external infrastructure or via email campaigns aimed at harvesting credentials. They will then spend time searching the network for high value target hosts; if you think about it from the attacker’s point of view, the greater the value of the data, the greater the chance of someone paying up.

So how do you prevent your organisation from suffering a similar fate to Travelex? Here are some key takeaways we should all be aware of:

• Carry out regular checks of your external infrastructure. By this we mean all of it. There is a real temptation within many organisations not to include all of their external assets within the scope of penetration tests and general vulnerability scanning activities. This happens for countless reasons ranging from cost and fear of what might be found all the way to assets simply not being tracked. This is not good enough. Making sure all endpoints are known and checked multiple times a year as part of a full manual penetration test is recommended, and this should be backed up with monthly or quarterly vulnerability assessments where possible. It is always better to know about and address vulnerabilities affecting external infrastructures quickly, as they are often the starting point for cyber-attacks. Once that foothold is gained, the rest (be it ransomware or any other internal compromise) can snowball easily from there.
• Make sure you are aware of your external exposure. This is similar to the penetration guidance above and really, one feeds the other. If you know for example that you run Pulse Secure VPNs that act as your only external touchpoint between external and internal networks then these need to be priority hosts. Monitor patch releases and include them in monthly update cycles. Leaving them exposed and vulnerable to avoid disruption and downtime may be tempting, but is absolutely not an option; the consequences if something goes wrong will always outweigh the short-term inconvenience.
• Running Pulse Secure? Check it’s not vulnerable. We would be happy to carry out an assessment and advise you of your exposure to the vulnerability should it be a concern. The full advisory can be found here.
• Combine proactive and reactive cyber security measures. The combination of proactive and real-time reactive services as part of annual IT security spend is also vital. Identifying external exposure and potential vulnerabilities is one thing, but monitoring and detecting internal movement prior to a ransomware deployment is another. Attackers can spend weeks, months or even longer inside networks cherry picking hosts of value. The deployment of ransomware should not be the first you hear of it; dedicated Cyber Security Operations Centre (CSOC) services such as those offered by Six Degrees can help combat this and provide an early warning to such activity.
• Reduce external attack surfaces. This is something we see a lot in penetration tests even today. It’s not uncommon to see protocols like SMB, RDP, SSH, SNMP etc. all exposed to the Internet with no filtering on them, whilst most offer a second line of authentication (keys, certificates etc.). You shouldn’t rely on these as in Travelex’s case, all it takes is one vulnerability to upset the apple cart. Bake security into the design – don’t overlay it afterwards.
• Review your mail filtering options. Whilst the Travelex attack seems to be far more sophisticated, one can’t ignore the volume of malware spread via simple mail campaigns – it remains one of the key entry points to the corporate perimeter, and as such needs some advanced mail filtering attention.
• Implement robust multi-factor authentication. At Six Degrees we attended a large number of incident responses last year where the initial infection began with the compromise of an Office 365 or similar account. If you are not using multi-factor authentication already this is simple to turn on technically. Operational acceptance is another matter, but given the potential cost and consequences of a large scale breach it should not really be optional.
• Be prepared if the worst happens. So far our guidance has focused on preventative protections. But what about if you’re past that stage? The advice remains the same as ever when it comes to ransomware outbreaks: ensure regular backups are taken for all key data should you need to restore, reset passwords for known comprised accounts post-breach, and invest in malware protection that offers anti-ransomware measures. Some vendors now offer copy-on-write solutions among other technologies that can help ring fence important data and combat many common ransomware traits.

Protect Yourself and Your Organisation

The ongoing Travelex ransomware saga is testament to the massive financial, operational and reputational damage a successful cyber-attack can inflict on an organisation. This isn’t a time for burying your head in the sand and hoping the same fate doesn’t befall you. Take proactive steps to protect yourself and your organisation from the very real threat posed by cyber criminals in 2020 and beyond.