Educational institutions are concerned about security after the increase in cyberattacks. These institutions became more vulnerable to ransomware operators after the transition to remote education, globally. Recently, the FBI’s Cyber Division issued an alert warning about an uptick in cyberattacks against higher education institutions and K-12 schools, delivering the PYSA ransomware.
Also known as Mespinoza, the PYSA ransomware is malware that exfiltrates users’ data and encrypts critical files on their systems. It was found that the operators behind the PYSA targeted educational institutions in 12 U.S. states and the U.K. The attackers compromised sensitive information before encrypting the victims’ systems to blackmail them for ransom.
How PYSA Attacks
Active since March 2020, the PYSA ransomware operators launched attacks on the U.S. and foreign government entities, educational institutions, private organizations, and the healthcare sector. The attackers leverage Remote Desktop Protocol (RDP) credentials or phishing techniques to gain unauthorized access to victims’ networks.
The FBI found that the PYSA actors use Advanced Port Scanner and Advanced IP Scanner1 to conduct network reconnaissance and install open-source tools like PowerShell Empire2, Koadic3, and Mimikatz4. The attackers then execute commands to deactivate antivirus protection on the victim’s network before deploying the ransomware. “The cyber actors then exfiltrate files from the victim’s network, sometimes using the free opensource tool WinSCP5, and proceed to encrypt all connected Windows and/or Linux devices and data, rendering critical files, databases, virtual machines, backups, and applications inaccessible to users,” the FBI said.
Upon deploying the malware, a message is displayed on the victim’s login page, demanding ransom. The attackers warn the victims that encrypted data will be uploaded and traded on the darknet forums if the ransom is not paid.
The FBI stated that paying the ransom to cybercriminals does not guarantee file recovery. It may encourage adversaries to target other organizations using the same strategy in distributing ransomware.
Mitigations
The FBI also recommended certain security measures to overcome threats against ransomware operators. These include:
- Regularly back up data, air gap, and password-protect backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.
- Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (i.e., hard drive, storage device, the cloud).
- Install updates/patch operating systems, software, and firmware as soon as they are released.
- Regularly, change passwords to network systems and accounts, and avoid reusing passwords for different accounts. Implement the shortest acceptable timeframe for password changes.
- Provide users with training on information security principles and techniques as well as overall emerging cybersecurity risks and vulnerabilities.
