{"id":5962,"date":"2020-02-05T17:51:17","date_gmt":"2020-02-05T17:51:17","guid":{"rendered":"https:\/\/www.n-able.com\/?p=5962"},"modified":"2021-04-08T17:55:28","modified_gmt":"2021-04-08T16:55:28","slug":"maze-ransomware-threat-businesss-security-and-reputation","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/maze-ransomware-threat-businesss-security-and-reputation","title":{"rendered":"Maze Ransomware: A Threat to a Business\u2019s Security and Reputation"},"content":{"rendered":"

Ransomware began simply\u2014a criminal would send a piece of malware that locked up your system unless you paid them a ransom. If you had a good backup in place, you could revert your system to a known safe state and get back up and running fast. Over time, the industry did a decent job of using strong backup to protect their data and systems, and we saw some decline in this basic level of ransomware.<\/p>\n

As a result, we have seen ransomware trends shift. In some cases, criminals have started to extend their paydays by leaving behind other problematic pieces of software after the ransomware infection is over (such as cryptominers). We have also seen the\u00a0targets<\/em>\u00a0of ransomware shift. This has been one of the biggest shifts over the past two years. While cybercriminals still target individuals and small businesses, they have increasingly attacked small town governments. Unfortunately, these organizations lack the resources and agility of their corporate counterparts and can often get taken down for days by a major ransomware attack.<\/p>\n

Most of these ransomware attacks use the threat of organizational disruption to earn their payment. Recently, we\u2019ve seen a new development\u2014extorting businesses by exposing breached data if they don\u2019t pay. Today, we\u2019ll talk about some of the implications and how to handle them.<\/p>\n

What happened?<\/h2>\n

When attackers land ransomware, it\u2019s not uncommon for them to access and read data as well. For years, attackers threatened to release this information, but didn\u2019t make good on the threat. That changed with Maze ransomware, where they released stolen data from\u00a0some companies that didn\u2019t pay up<\/a>\u00a0and\u00a0threatened to release even more<\/a>. The threat comes to a business\u2019s reputation and their finances if they don\u2019t report and end up facing compliance fines.<\/p>\n

This threat can\u2019t be defeated simply with backup, although, backup is still essential for the encryption variants (which will likely still be the main type of ransomware, so don\u2019t skimp on backup). However, this could represent a new line of attack. Instead of dealing with downtime or data loss, you could face public scrutiny and damage to your reputation on top of the potential data losses.<\/p>\n

What you can do<\/h2>\n

Once someone gets data using this style of ransomware, there isn\u2019t much you can do outside of paying the ransom or preparing to have the data released. Even if you pay the ransom, you have no guarantee the data will not be released, and you may still have some level of responsibility to report. There are preventative steps you can take. A data loss prevention (DLP) solution may alert you to attempts to exfiltrate data, but even if you have one in place you should still employ the following:<\/p>\n