Two Latest Victims of the Conti Ransomware Gang

The online photography platform, Shutterfly, recently made a public announcement that the company had fallen victim to a cyberattack. Shutterfly believes that their systems were first breached on December 3, 2021. The attackers subsequently scoped out Shutterfly’s network and exfiltrated a considerable amount of data that included the personal information of employees such as names, login credentials and salary information. They also managed to seize customer information that included the last four digits of credit card numbers on file. Unfortunately, the company cannot accurately say how many people were affected by the attack. Just two weeks later, American tool manufacturer Snap-on reported a similar incident, stating that a breach took place during a 48-hour period beginning on March 3, 2022, in which 1GB of files were stolen. The compromised data contained the personal information of their employees including names, birth dates, Social Security Numbers, and employee identification numbers. The Conti gang, a ransomware organization based in Russia, has taken credit for both attacks.

Conti ransomware is normally deployed using a phishing attack that utilizes malicious attachments such as macro-enabled Microsoft Word documents. These can be thwarted through the combination of an advanced email filtering system and security policy that disables macros in Office applications using the Trust Center Settings within Group Policy. Because Conti also uses the SMB protocol to spread itself amongst Windows devices within the local network, you should disable SMBv1 on all your Windows devices. Other security recommendations include the following:

• Prevent the lateral movement of Conti or other malware attacks by segmenting your network using a zero-trust strategy. This can be achieved using next generation firewalls to filter inter-VLAN traffic. Because ransomware is often delivered through a phishing attack, filtered segmentation will help to contain a ransomware infestation and prevent it from spreading to critical areas of your network.

• All computer devices should be protected by some sort of endpoint security solution that is able to detect Ransomware behaviors. While endpoint security by itself is not sufficient, it plays an important role in a multi-layer security strategy.

• The best insurance against a ransomware attack is an effective backup strategy. While backups won’t help deter a data breach, they will allow you to recover your files to their original decrypted state. Ensure that you have an offsite copy of your backups, that your backup system is segmented from your production network, and that it is protected by a network firewall.