Accenture Ransomware Attack: What You Should Know

News broke late Wednesday night (August 11) that Accenture, a Fortune 500 consulting company, was attacked and had servers compromised by the LockBit ransomware gang.

According to Stacey Jones, a spokeswoman for Accenture, the company was able to restore their compromised systems from backups, and business operations were not impacted.

While things have worked out reasonably well for Accenture so far, it’s by no means the end of the story. LockBit has threatened to release stolen information from the Dublin-based outfit on the Dark Web if they don’t pay the ransom in Bitcoin, reported to be somewhere in the neighborhood of $50 million.

I could make a joke about them needing to find a pot of gold at the end of the rainbow, but I’m above such sophomoric rhetoric…

Anyways, this isn’t all that uncommon. Attacks like this are happening around the clock. I mean, we don’t tell people they need 24/7 cybersecurity protection for nothing, you know? So, rather than beat a dead horse and get into it all again (you can find the content multiple times over here on the blog). I thought it might be a good idea to provide you with a brief profile on the LockBit ransomware, the gang itself, and some things you can do to protect yourself from the likes of them.

What is LockBit?

LockBit is an automated ransomware variant that uses AES encryption to hobble its targets. By automating itself, LockBig is easily propagated and needs little to no human interaction or oversight beyond the initial injection.

LockBit also operates under a ransomware-as-a-service business model. The software’s developer leases their ransomware to ne’er do wells who then attack targets the world over.

The developer and affiliate then share the proceeds from any paid ransom. LockBit, like many other ransomware groups, now uses the threat of double extortion to try to get paid. That means, besides demanding a ransom in the first place, they also threaten to release stolen/encrypted data on the dark web for others to use/buy, in turn trying to force the user to pay up.

Typically an affiliate gets to keep between 70 and 80% of any ransom they collect with the remainder going to the developers.

How does LockBit Spread?

So far, LockBit spreads via compromised remote desktop protocols, phishing campaigns, credential stuffing, and exploiting known security vulnerabilities. Pretty standard stuff.

After being installed, LockBit will disable security services, install key-logging software among other things. Before the data is encrypted the software will exfiltrate high-value data to a remote server.

How do you protect yourself from LockBit and other ransomware attacks?

Here are seven things you can do, or start doing, right this very moment to protect yourself and your business from a ransomware attack:

1. Implement a Security Awareness Training Program – Someone wiser than I once told me ‘you can’t stop or avoid what you’re not prepared to handle.’ That goes for ransomware attacks. Most ransomware attacks are solicited through Social Engineering campaigns and are end-user initiated (i.e. you, a coworker, or employee). A good security awareness training program can help educate people and stop a ransomware attack before it can get a foothold in your IoT ecosystem.
2. Email Inbox Security is Imperative – As stated above, a ransomware attack is usually end-user initiated. How? Typically via a malicious link or file embedded in an email. The attacker will trick their unsuspecting victim into clicking through and, well, it’s all downhill from there. By implementing things like DMARC or DKIM, or sign up for a service like Cyren’s Office 365 Inbox Security platform, you can stop some of these attacks before human error becomes a part of the problem.
3. Next-Generation End-Point Protection – Traditional endpoint protection products rely on outdated means of detection (like looking for specific signatures). Newer products like Blackberry Protect (formerly Cylance) uses machine learning and artificial intelligence to determine whether or not software that’s trying to run on your machine is hazardous or not.
4. Back-up your End-Points and Critical Data – This is a no-brainer. Even with the risk of a ransomware attack, you should be backing up your important data. A ransomware attack is only deadly to an organization if they don’t have backups. Ransomware attacks encrypt your end-points and demand a ransom (duh) from the victim to get the decryption key. If you’ve got air-gapped, regular backups you don’t need to pay. You can simply restore your ecosystem to a period before it was infected. Just make sure backups are in a secure location, not normally connected to your network, and password protected.
5. Whitelisting and Blocking the Known Bad – You’ve got a pretty good idea of what people in your organization should be looking at while they work, or what programs they use, or what devices can talk to over the internet. Take the time to whitelist approved applications and processes. Blocking the known bad goes hand in hand with whitelisting. Now, I don’t necessarily mean you should spend hours and hours blocking everything under the sun, or making sure your firewall’s traffic policy is tighter than a frog’s butthole, but you should take the steps to block traffic to and from countries known to be hazardous to an enterprise like Russia, China, North Korea, Iran, etc. You can check out this article if you want to learn more about that.
6. Discover Leaked Credentials, Look for Exposed Super-Admins, and Start Practicing the Principle of Least Privilege when it comes to Access Control – Pardon me, but we have to go back to human error and the part it plays in a successful ransomware attack, or for that matter, ANY kind of cybersecurity attack. We humans, as a species, are terrible when it comes to credential management and good password hygiene. We stink at it. But the first step in changing that is by acknowledging it. To help with this, you might want to start by running a dark web scan on your email domain. If the scan does discover linked credentials take a good long look at the report and check it against your records to see what privileges those users might have. The Principle of Least Privilege is the belief that people should have access to as little as possible beyond what they need to do their day-to-day tasks. That includes administrators and other high-ranking personnel.
7. Make Sure you Monitor Your Files Around the Clock – Monitors your IT environment for changes to the critical OS, files, and processes such as directories, registry keys, and values. Watch for changes to application files, rogue applications running on the host and unusual process and port activity, as well as system incompatibilities.

Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.