What you need to know

• Microsoft Exchange Server issues in early 2021 led to threat actors absconding with valuable U.S.-based private and public sector data, resulting in the U.S. government getting involved in the security situation.
• Though not as dramatic as 2021's saga, Exchange is once again in the spotlight thanks to Hive ransomware.
• Hive has been exploiting unpatched Exchange server vulnerabilities in order to deploy ransomware and hold data hostage.

There are few constants in the world. Criminals utilizing ransomware to attack Microsoft products is one of them.

Though not as dramatic as the national-security-tier Exchange situation that dominated headlines in 2021, wherein state-sponsored hackers pilfered data that experts believe may be fuel for a secretive Chinese government AI project, the 2022 landscape isn't devoid of drama either.

As researched and reported by the Varonis Forensics Team, a threat named Hive is stirring the Exchange pot with ransomware attacks (via ZDNet). Since Varonis first spotted Hive in June 2021, it has seen cybercriminals use the aforementioned ransomware against nonprofits, energy providers, healthcare institutions, and more all across the world.

When it comes to the stakes of being attacked by Hive, it's what you might expect from ransomware: It'll infect your device, get ahold of your files, then demand you either pay up or risk seeing your sensitive data get published.

What makes Hive so insidious is that, as part of its assault on a device, it uses an attack called "Pass-The-Hash," which gives it access to domain admin accounts without the need for password cracking, resulting in an authenticated session within the network — the foundation for cybercrime field days. It achieves all of this through the delivery of a payload labeled "Windows.exe." If you guessed that the .exe isn't, in fact, in any way related to a legitimate instance of Windows, such as Windows 11, you'd be correct. It's nothing but bad news from Hive that will leave files encrypted and cut off from their rightful owners.

Hive attacks are an active threat to unpatched Exchange servers, which Varonis notes when referencing recorded instances of compromise. Servers that don't have the April and May 2021 security updates are susceptible, so anyone who's yet to patch up should get on that.

What you need to know

• Google has exposed the details of ransomware campaigns driven by a group it has named "Exotic Lily."
• Exotic Lily leverages fake user profiles and legitimate services such as OneDrive in order to add a more personal, realistic touch to its campaigns.
• Beyond OneDrive and LinkedIn, Exotic Lily has also utilized the weaknesses of Windows for its various efforts.

Microsoft's security teams routinely report on bad happenings going on in the cybercriminal world, including when such happenings affect the competition. But this time around, it's Google highlighting how Microsoft's services and products are being used by bad guys for bad purposes.

Google released a report exposing the operations of a group nicknamed "Exotic Lily," an Initial Access Broker (IAB). IABs infiltrate networks then auction that access to whichever cybercriminal will pay the most.

Exotic Lily's methods for infiltration are a bit more personal and crafty than those of the usual threat actor, according to Google. Here's the play: The group creates fake social media profiles, including LinkedIn profiles, utilizing easily obtainable data on employees so that the illegitimate duplicates appear authentic. They also utilize spoofed email accounts and then begin engaging with targets, establishing rapport.

Once there's an opening to do so, the group uses a file-sharing service such as OneDrive to deliver and mask the origins of the payload needed to set the scene for ransomware attacks. The group also exploited a now-defunct zero-day vulnerability in Windows-linked MSHTML in conjunction with its efforts to circulate malicious Office documents designed to trick users into welcoming dangerous content onto their devices.

In short, Exotic Lily has used a wide range of Microsoft services and products for maleficent purposes, and threats like fake LinkedIn profiles remain a danger. With that being said, Microsoft addressed the aforementioned MSHTML zero-day and Google has guidance in its report for what to look out for, as well as more details on the technical aspects of Exotic Lily's operations should you want to dig deeper.

What you need to know

• The FBI has issued a warning pertaining to the ransomware RagnarLocker and the custom Windows XP virtual machine it deploys within.
• The FBI's warning is primarily for the purpose of educating individuals on one of the many ransomware threats currently making rounds on the web.

While it's no secret that Windows XP is a favorite of many legitimate, upstanding entities and still dominates operating system market share in one part of the world, not everyone who's a fan of the OS or its virtual machine variations has the best intentions in mind. Enter: RagnarLocker.

RagnarLocker is ransomware being circulated by cybercriminals for the purpose of encrypting files and holding them for ransom. The FBI notes that it doesn't encourage ransomware victims to pay up, since that runs the risk of encouraging cybercriminals. Not to mention, there's no guarantee the criminals will release their hold on your files even after you pay. As for the threat of RagnarLocker specifically, here's how the FBI describes it (via ZDNet):

The FBI notes that as of January 2022, a minimum of 52 entities in sectors such as financial services, information technology, critical manufacturing, energy, and government have had to deal with the consequences of RagnarLocker. The ransomware operates on a mass-encryption basis, actively choosing specific files not to encrypt in order to avoid attracting immediate attention while it locks things up.

Though RagnarLocker may be a particularly pesky foe, it's far from the only instance of ransom-focused malware on the loose. In the modern times we're going through right now, there's a ransomware black hole on the loose.

What you need to know

• Owners of ASUSTOR NAS have reported having their data locked away due to ransomware attacks.
• Like the QNAP DeadBolt attack, ASUSTOR NAS owners are having their data held to ransom for Bitcoin payments.
• ASUSTOR recommended all owners disconnect and shut down NAS enclosures immediately.

Reports are coming in on Reddit and the official ASUSTOR forum that NAS enclosures are being attacked by DeadBolt ransomware, similar to what affected QNAP servers. DeadBolt infects the NAS and encrypts the data stored on installed drives, blocking access for the owner.

The GUI is then altered to show a customized screen with details on the attack and request for payment. This attack seems to have taken place on NAS with different configurations. It doesn't seem to matter if EZConnect is enabled and we're not yet sure what's the cause for allowing such an external attack to take place.

As reported by Tom's Hardware, this also makes it impossible to know which models are vulnerable (if not all). Affected NAS owners are being asked to provide 0.03 Bitcoin for an encryption key to be sent across. I don't recommend you do so unless your data is incredibly important and ASUSTOR is unable to provide a solution.

ASUSTOR is currently recommending affected NAS owners to:

• Disconnect the NAS from the LAN.
• Shut down the NAS (press and hold the power button for three seconds).
• Do NOT turn on the NAS once shut down.
• Fill out this Google Form for an ASUSTOR technician to respond and provide assistance.

If you haven't yet been affected, I'd highly recommend you back up all the data saved on the NAS (even if you own the best NAS). Ensure automated updates are disabled, disable SSH, and block all external access to the NAS (limit the enclosure to the LAN). This is a perfect time to invest in an external drive to store a copy of all the files stored on your NAS.

What you need to know

• Ransomware and Windows go together like bread and butter.
• Though Windows is the primary recipient of ransomware efforts, Linux is getting more and more strains of the threat itself.
• Now LockBit, an irksome danger on the Windows side of computing, has made its Linux debut.

First, they came for Windows. Then, for Tux. As cool as Linux is, it's increasingly becoming a target for ransomware-friendly cyber criminals intent on ruining people's days.

Linux isn't beating out Windows anytime soon in market share, but it's still popular enough to attract bad guys. Case in point: LockBit has hopped ship, no longer content to torment just Redmond. Based on a report from Trend Micro Inc., Linux users who encounter the ransomware can expect the variant tailored to their OS to log the following information:

• Processor information
• Volumes in the system
• Virtual machines (VMs) for skipping
• Total files
• Total VMs
• Encrypted files
• Encrypted VMs
• Total encrypted size
• Time spent for encryption

You can check out Trend Micro's full report for the ins and outs of what LockBit for Linux is made of, but the overall point is that though Windows is a magnet for ransomware, fewer safe havens exist in general these days.

The rise of ransomware means cybercriminals are coming for everyone no matter what operating system they prefer. Though, for now, some are choosing Chrome OS to avoid threats as much as possible.

Malware's always been a problem, but ransomware especially has been a hot commodity in recent memory, so much so that the U.S. government has elected to eyeball sanctions on cryptocurrency to stem the flow of successfully facilitated ransomware schemes. Hide your e-wallets, hide your penguins; they're holding everybody for ransom out here.

What you need to know

• Ransomware has seen a spike in popularity amongst threat actors.
• A new report from Sophos indicates the troubles are only set to expand.
• Sophos attributes the rise in ransomware-related threats to elements such as cryptocurrency popularity and an evolution in ransomware distribution models and pressure tactics.

For those not familiar with the power of ransomware, it's worth looking back at the Colonial Pipeline situation from mid-2021, wherein part of the U.S.'s oil supply infrastructure was temporarily crippled virtually overnight by a group utilizing the malware type.

And don't think ransomware is only going after big targets. Threat actors make a habit of preying on unsuspecting businesses and individuals as well, should the promise of money be obvious enough. So when Sophos says the ransomware circuit is set to evolve, that's bad news for everyone.

According to the Sophos 2022 Threat Report, four major, blossoming ransomware trends have been identified.

1. The ransomware-as-a-service (RaaS) model isn't going anywhere anytime soon.
2. Ransomware will remain a key ingredient in existing threat bundles of adware, spam, loaders, and more.
3. Extortion efforts related to ransomware attacks will continue to raise the stakes in intensity and expand in variety.
4. So long as crypto mining and cryptocurrencies remain popular, ransomware strikes will have ample fuel for their fire.

In other words, if you want to learn how to mine crypto or are investigating what the best GPUs for crypto mining are, be aware that you're moving into territory heavily targeted by ransomware aficionados. It's so heavily targeted by these sorts of threat actors, in fact, that the U.S. government has been whipping up sanctions for cryptocurrencies on the basis that they could stymie cybercriminal endeavors.

There's a lot more to the ransomware report than just these findings, so if you want the full scoop, check out Sophos' writeup to learn more about how the malware type threatens IT in particular. And if you're not afraid of ransomware and want to go all-in on Bitcoin or cryptocurrency in general, check out what El Salvador is up to.

What you need to know

• LockBit 2.0 ransomware-as-a-service has upped its game.
• It can now encrypt networks via group policy updates.
• It can be automatically distributed through a Windows domain, with no scripts required.

Cyberthreats such as ransomware grow more devilish by the day. Case in point: LockBit 2.0, a specific breed of ransomware-as-a-service that's escalated the stakes associated with suffering a ransomware attack.

As reported by BleepingComputer, LockBit's been around for a while. As far back as 2019, it was stirring up trouble, offering 70-80% revenue shares to affiliates who used the service-based ransomware while breaching networks and encrypting devices, with the actual developers reaping whatever remained from the software's haul.

LockBit's evolved since those days, keeping up with the latest tech and trends. Now, the world is faced with LockBit 2.0, which can not only encrypt networks via group policy updates but can hijack connected printers to print a non-stop stream of ransom notes (a ransomware feature seemingly designed to get victims' attention).

While the printer spam is self-explanatory, here's a more detailed breakdown of that network encryption item. When bad guys take the reins of a domain controller, LockBit 2.0 then distributes itself to domains. It will create new group policies that cut off Microsoft Defender and its defense mechanisms and create policies that launch the ransomware.

"This is the first ransomware operation to automate this process, and it allows a threat actor to disable Microsoft Defender and execute the ransomware on the entire network with a single command," ethical hacker Vitali Kremez told BleepingComputer.

In short: LockBit 2.0 is no joke, much like other recent security-related concerns to crop up in the Windows-verse, such as how researchers have exposed a TPM-related chink in the armor of corporate Windows laptops (which may or may not present issues for Windows 11).

What you need to know

• Microsoft Security Intelligence has caught wind of a new ransomware attack strategy.
• It involves fake call centers and malicious Excel files.
• The campaign is dubbed "BazaCall."

There's a ransomware campaign going on called BazaCall. It's been circulating for months, but Microsoft Security Intelligence is now publicizing its major points on Twitter with screenshots to help inform the average person of how to stay safe (via ZDNet).

Here's how BazaCall works. First, you'll receive an email saying a subscription service of yours is up for renewal, and you'll be invited to call a phone number to cancel if you wish.

When you call, you'll be told to go to a website and download an Excel file. That file contains the macro that gets the payload onto your machine, crippling you with ransomware.

It sounds like a dumb plot on paper, but in reality, decently written emails and full-on fake call centers can present the appearance of a legitimate operation to the gullible, uninformed, or inattentive. As Microsoft mentions in its tweet thread discussing BazaCall, the threat is made even more complex by the fact that there's nothing overtly malicious in the emails themselves, making danger harder to detect.

The name BazaCall stems from the malware the campaign distributed in the beginning: BazaLoader. Though it's been kicking around for a bit, it seems the efforts to spread ransomware are amping up as people get wise to classic tricks.

Today we're dealing with harmless emails, con-job call centers, and dangerous Excel files. What happens tomorrow? Do fraudsters legally register and operate entirely legitimate businesses solely to have addresses and phone numbers for swindles on the side? Aside from the fact that that already happens, the point is that ransomware may seem like a foreign concern at the moment, but be ready: Cybercriminals are working overtime to drag you into their net, no matter how elaborate of a scheme such a victory requires.

What you need to know

• A strain of ransomware called DearCry is being used to target unpatched Exchange servers.
• Microsoft has released patches for Exchange servers, but some organizations have not patched systems yet.
• Check Point Research reports that exploitation attempts doubled every 2-3 hours over a recent 24-hour period.

While Microsoft has rolled out emergency patches to address vulnerabilities on its Exchange server software, many systems remain unpatched. Attackers are now increasingly going after unpatched systems. A strain of ransomware called DearCry is being utilized by attackers to target unpatched on-premises Exchange servers (via ZDNet).

Microsoft has detected and is now blocking the new family of ransomware, but it's still vital for organizations to patch their servers and take other security measures.

The Microsoft Security Intelligence Twitter account discussed the ransomware recently. A subsequent Tweet explains that Microsoft Defender customers utilizing automatic updates don't need to take any additional action.

According to Check Point Research (CPR), threat actors are increasing their attacks on vulnerable servers. Over 24 hours, CPR saw exploitation attempts on organizations double every 2-3 hours.

CPR states in its blog:

CPR explains that if an attacker manages to utilize unpatched vulnerabilities, they can obtain corporate emails and place damaging code within organizations.

What you need to know

• Microsoft is among 19 organizations to found the Ransomware Task Force.
• The Ransomware Task Force is made up of security firms, tech companies, and non-profits.
• The goal is to create a standardized framework to deal with ransomware attacks.

Microsoft, McAfee, and 17 other organizations have come together to form a Ransomware Task Force (RTF) (via ZDNet). The new RTF is made up of security firms, tech companies, and non-profits with a shared goal of combatting ransomware. The group will work to assess current solutions that people and organizations can use to protect against ransomware attacks.

The RTF will look at existing solutions, find security gaps, and work on a roadmap to plan a defense against ransomware. The RTF will commission expert papers from a wide range of industries and work with stakeholders as well.

The RTF should yield a standardized framework for handling ransomware attacks. The framework would be based on the input of several organizations, rather than different groups attacking the problem individually.

The founding members of the RTF are:

• Aspen Digital
• Citrix
• The Cyber Threat Alliance
• Cybereason
• The CyberPeace Institute
• The Cybersecurity Coalition
• The Global Cyber Alliance
• McAfee
• Microsoft
• Rapid7
• Resilience
• SecurityScorecard
• Shadowserver Foundation
• Stratigos Security
• Team Cymru
• Third Way
• UT Austin Stauss Center
• Venable LLP

"Ransomware incidents have been growing unchecked, and this economically destructive cybercrime has increasingly led to dangerous, physical consequences," says the Institute for Security + Technology in a blog post. "This crime transcends sectors and requires bringing all affected stakeholders to the table to synthesize a clear framework of actionable solutions, which is why IST and our coalition of partners are launching this Task Force for a two-to-three month sprint."

The Ransomware Task Force website will launch in January 2021 and will include its full membership and leadership roles.

On Windows 10, "Controlled folder access" is an intrusion-prevention feature available with Microsoft Defender Exploit Guard, which is part of the Microsoft Defender Antivirus. It's been designed primarily to stop ransomware from encrypting and taking your data hostage, but it also protects files from unwanted changes from other malicious applications.

The anti-ransomware feature is optional on Windows 10. When enabled, it uses a mechanism to track the apps (executable files, scripts, and DLLs), trying to make changes to files in the protected folders. If the app is malicious or not recognized, the feature will block the attempt in real time, and you'll receive a notification of the suspicious activity.

If you want to safeguard your data with an extra layer of security, you can enable and customize Controlled folder access using the Windows Security app, Group Policy, and even PowerShell.

In this how-to guide, I will walk you through the steps to enable the Controlled folder access feature on your device to prevent ransomware attacks.

How to enable ransomware protection from Windows Security

To enable Controlled folder access on Windows 10, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Click the "Manage ransomware protection" option under the "Ransomware protection" section. 

5. Turn on the "Controlled folder access" toggle switch.

Once you complete the steps, Microsoft Defender Antivirus will start protecting your files and folders from unauthorized access by malicious programs like ransomware.

View block history

To view a list of blocked items by the anti-ransomware solution, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Click the Manage ransomware protection option under the "Ransomware protection" section.

5. Click the Block history option.

6. Confirm the items that have been blocked.

The page is the same page to view the protection history available through the main page of the Microsoft Defender Antivirus. However, accessing it from this area applies a filter to list only the history of "Controlled folder access."

Add new location for protection

By default, the security feature protects the Documents, Pictures, Videos, Music, Desktop, and Favorites folders. Although it's not possible to modify the default list, if you have files in a different location, you can manually add other paths.

To add a new folder location for protection, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Click the "Manage ransomware protection" option under the "Ransomware protection" section.

5. Click the Protected folders option.

6. Click the "Add a protected folder" button.

7. Select the new location.
8. Click the Select Folder button.

After you complete the steps, the anti-ransomware feature will monitor and protect the new locations.

If the storage configuration changes, and you need to remove a location, you can follow the same instructions, but in step 5, select the location and click the "Remove" button.

Whitelist apps with Controlled folder access

On Windows 10, Controlled folder access can detect the apps that can safely access your files, but in the case one of the apps you trust is blocked, you'll need to allow the app manually.

To whitelist an app with Controlled folder access, use these steps:

1. Open Start.
2. Search for Windows Security and click the top result to open the app.
3. Click on Virus & threat protection.
4. Click the "Manage ransomware protection" option under the "Ransomware protection" section.

5. Click the "Allow an app through Controlled folder access" option.

6. Click the "Add an allowed app" button.
7. Select the "Recently blocked apps" option to whitelist an app you trust has been flagged as malicious. Or click the "Browse all apps" option.

8. Select the app executable (for example, chrome.exe) you want to allow through this feature.
9. Click the Open button.

Once you complete the steps, the app won't be blocked by the feature, and it'll be able to make changes to files.

How to enable ransomware protection from Group Policy

To enable Windows 10's ransomware protection with Group Policy, use these steps:

1. Open Start.
2. Search for gpedit and click the top result to open the Local Group Policy Editor.
3. Browse the following path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access
4. Double-click the "Configure Controlled folder access" policy on the right side.

5. Select the Enabled option.
6. Select the Block option under the "Options" section.

7. Click the Apply button.
8. Click the OK button.

After you complete the steps, Controlled folder access will start monitoring and protecting your files stored in the default system folders.

The only caveat of using this method is that any future configuration will have to be made through Group Policy. If you open Windows Security, you'll notice the "This setting is managed by your administrator" message and the Controlled folder access option will appear grayed out.

You can revert the changes using the same instructions, but in step 5, select the "Not Configured" option.

Add new location for protection

If you must protect data located in a different location, you can use the "Configure protected folders" policy to add the new folder.

To include a new location for protection with Control folder access, use these steps:

1. Open Start.
2. Search for gpedit and click the top result to open the Local Group Policy Editor.
3. Browse the following path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access
4. Double-click the "Configure protected folders" policy on the right side.

5. Select the Enabled option.
6. Click the Show button under the "Options" section.

7. Specify the locations you want to protect by entering the path of the folder in the "Value name" field and adding 0 in the "Value" field. This example adds the "MyData" folder in the "F" drive for protection: F:\MyData

8. Repeat step 7 to add more locations.
9. Click the OK button.
10. Click the Apply button.
11. Click the OK button.

Once you complete the steps, the new folder will be added to the protection list for controlled folder access.

To revert the changes, use the same instructions, but in step 5, select the "Not Configured" option.

Whitelist apps with Controlled folder access

To whitelist an app through the anti-ransomware feature on Windows 10, use these steps:

1. Open Start.
2. Search for gpedit and click the top result to open the Local Group Policy Editor.
3. Browse the following path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access
4. Double-click the "Configure allowed applications" policy on the right side.

5. Select the Enabled option.
6. Click the Show button under the "Options" section.

7. Specify the location of the .exe file for the app (such as C:\path\to\app\app.exe) you want to allow in the "Value name" field and add 0 in the "Value" field. This example allows the Chrome app when Controlled folder access is enabled: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

8. Repeat step 7 to add more locations.
9. Click the OK button.
10. Click the Apply button.
11. Click the OK button.

After you complete the steps, the app won't be blocked, and it'll be able to make changes to protected files and folders.

How to enable ransomware protection using PowerShell

Alternatively, you can also enable and configure Controlled folder access using PowerShell commands.

To enable Controlled folder access with PowerShell, use these steps:

1. Open Start.
2. Search for PowerShell, right-click the top result, and click the Run as administrator option.
3. Type the following command to enable the feature and press Enter: Set-MpPreference -EnableControlledFolderAccess Enabled

4. (Optional) Type the following command to disable the security feature and press Enter: Set-MpPreference -EnableControlledFolderAccess Disabled

Once you complete the steps, Controlled folder access will enable on your computer to protect files and folders from ransomware attacks.

Add new location for protection

To allow Controlled folder access to protect an additional folder, use these steps:

1. Open Start.
2. Search for PowerShell, right-click the top result, and click the Run as administrator option.
3. Type the following command to add a new location and press Enter: Add-MpPreference -ControlledFolderAccessProtectedFolders "F:\folder\path\to\add"

In the command, make sure to change the path for the location and executable of the app you want to allow. For example, this command adds the "MyData" folder in the "F" drive to the list of protected folders: Add-MpPreference -ControlledFolderAccessProtectedFolders "F:\MyData"

4. (Optional) Type the following command to remove a folder and press Enter: Disable-MpPreference -ControlledFolderAccessProtectedFolders "F:\folder\path\to\remove"

After you complete the steps, the anti-ransomware feature will protect the contents inside the new location.

Whitelist apps with Controlled folder access

To allow an app in Controlled folder access with PowerShell, use these steps:

1. Open Start.
2. Search for PowerShell, right-click the top result, and click the Run as administrator option.
3. Type the following command to allow an app and press Enter: Add-MpPreference -ControlledFolderAccessAllowedApplications "F:\path\to\app\app.exe"

In the command, make sure to change the path for the location and executable of the app you want to allow. For example, this command adds Chrome to the list of allowed apps: Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"

4. (Optional) Type the following command to remove an app and press Enter: Remove-MpPreference -ControlledFolderAccessAllowedApplications "F:\path\to\app\app.exe"

Once you complete the steps, the app will be allowed to run, and changes to your files will be made when the feature is available.

Controlled folder access is one of the intrusion-prevention features of the Microsoft Defender Exploit Guard, which is part of the Microsoft Defender Antivirus. This means that the security feature won't be available if you use a third-party antivirus.

More resources

For more helpful articles, coverage, and answers to common questions about Windows 10 and Windows 11, visit the following resources: 

• Windows 11 on Windows Central — All you need to know
• Windows 10 on Windows Central — All you need to know

The CryptoLocker malware is both a Trojan and ransomware. It first enters your system disguised as a legitimate file, then opens the door for the ransomware that locks down important documents and programs until you pay a fee. Installing Kaspersky Total Security is a good way to protect your PC from this and many other threats. Here are some of the tools specifically designed to protect against ransomware, including CryptoLocker, and how to enable them within Kaspersky Total Security.

Products used in this guide

• The best ransomware protection: Kaspersky Total Security ($50 at Kaspersky)

How to enable Kaspersky browser extensions

Most malware is either sent as an attachment to email messages or disguised as a legitimate file, like a video player, on a website that looks legitimate. Kaspersky's browser extension recognizes the majority of infected files and stops the download process before the threat has a chance to escape. It also blocks websites that are known to harbor malware files or are phishing schemes and marks safe websites in listed search results.

Here's how to enable Kaspersky safe browsing extensions.

1. In the web browser of your choice, open the menu by clicking the three dots located at the top right-hand side of the view window.
2. In the Chrome web browser, selecting More tools opens a second menu.
3. Next select Extensions. (In Firefox, select Add-Ons. Or Select Extensions from the main Edge menu.)

4. Your browser will list all extensions installed whether they are active or not. Find the Kaspersky Protection extension and click to enable it.

Once activated, Kaspersky's browser extension will block phishing schemes and websites known to harbor malicious downloads, stop malware files from downloading to your computer and mark search results as safe to click on or not.

How to use Kaspersky's vulnerability scanner

Vulnerability scanners helps identify and stop weak points in your computer, including corrupted drivers and outdated software. These are the easiest places for malware, including ransomware, to break into your network and attack your files. Here's how to find and use Kaspersky's vulnerability scanner.

1. Click More Tools, located at the bottom of the Kaspersky dashboard.
2. On the left side of the view screen, select Manage applications. (It is the third file listed.)
3. Then click Vulnerability Scan in the main view

4. On the next screen, click the Start scan button.

5. When the scan is complete, Kaspersky will break down where all the vulnerabilities are and details on how to fix them. (You can opt to fix them yourself, or ask Kaspersky to do it for you.)

How to use Kaspersky to create and save backup files

Kaspersky Total Security helps create backup files. If your computer is ever infected with malware, including ransomware, you can scrub and reset your system, but restore your computer by tapping into the backup files. Kaspersky doesn't have an online storage facility itself, but it will automatically create and store backup files to any online storage site, such as Dropbox. You do need to create an online storage account first.

Here's how to create backup files.

1. Click Backup and Restore from the dashboard.
2. Then Select files for backup.

3. Choose which files to backup. Kaspersky makes it easy to select all files or specific types of files to backup. You do have the option to select files individually.
4. Once you've determined which files to backup, click next.

5. Choose where to save your files. You can choose to upload them to an online storage account, a thumb drive or locally to your desktop.
6. Click Next.

7. Set how often Kaspersky should backup and save your files. You can choose to have this done daily, weekly, monthly, or manually.

8. The final step is to name your files before saving them.

If you don't have an online storage account, you can back up your files and store them locally on your desktop. You then can encrypt the files and store them in a secured vault that is only accessible with a passcode.

How to encrypt and secure files using Kaspersky

For important files, you can encrypt them and save them in a Kaspersky vault that can only be accessed with a password you set up. If your computer is infected with ransomware, including CrytoLocker, you can remove the threat and still access those files within the vault. It is secure enough that ransomware cannot penetrate it, and if it were to gain access, it wouldn't recognize your files because of the encryption.

Here's how to set up your Kaspersky vault.

1. Click More Tools, located at the bottom of the Kaspersky dashboard.
2. On the left side of the view screen, select Data Protection. (It is the fourth file listed.)
3. Then choose Data Encryption.

4. After choosing Create a new data vault, Kaspersky will walk you through the steps of adding files to encrypt and setting up a password.

5. You can add files to be encrypted and added to your vault by either clicking the Add button at the bottom, or simply dragging and dropping files into the vault.

6. Once you've added your files, click Done.
7. You will be prompted to create a password. Kaspersky requires passwords to have a minimum of eight characters, have both an upper- and lower-case letter, a number and a special character. Make sure you remember your password because there is no way to reset or recover it if lost or forgotten.

My recommendation for ransomware protection

There are proactive steps you can take to help reduce the risk of becoming infected with malware, including being cautious of email attachments and downloadable files. The best protection is installing a reputable antivirus program that scores high for threat blocking and includes additional security tools. I recommend Kaspersky Total Protection because it has everything you need, plus excellent overall protection from other malware threats. Though Kaspersky Internet Security has a good level of protection, too, some of the tools, such as encryption and backup abilities, aren't included.

Recent years has seen a substantial increase in the number of ransomware attacks taking place. What's more is a large number of malware attacks continue to go unreported, according to a survey of IT professionals. How can one protect themselves from becoming the next victim? A Synology NAS is a solid start.

When targeted by a ransomware attack, criminals will attempt to lock away your data and attempt to sell you access. You'll likely receive some kind of prompt telling about how your files have been encrypted and the only way to get them back is to pay for a decryption tool. For those who don't back up their data, this is one of their worst nightmares.

Often recommended is the resetting your PC to an earlier date before the attack. Some may even view the reinstallation of Windows as the only way to get systems back to normal. The issue is when you don't back up everything on a regular basis, which involves the loss of files.

Luckily, if you haven't been targeted yet, there are a few ways to better protect your PC, including the purchase of a Synology NAS.

See at Amazon

Protect your PC against ransomware

To better equip your PC with the means to repel an attack, you should always ensure you're running the latest release of Windows 10. The installed security suite should also be up-to-date and have the latest definitions to protect you against malicious files.

Windows 10 comes rocking security software built right into the OS that should be enough if you're conservative while online. It's also important to avoid any suspicious files downloaded, and disable remote access when you don't require the feature.

Disable remote access

1. Hit Windows Key + Q to bring up Cortana.
2. Enter "remote access".
3. Choose "Allow remote access to your computer".

4. Uncheck "Allow Remote Assistance connections to this computer".
5. Hit OK.

You should now be blocking all outside attempts to gain access to your Windows PC.

Use a Synology NAS

One of your best weapons against ransomware is backing up on a regular basis and using redundant processes. It's a good idea to keep your important files safe on a physical drive (simply copy and paste them in File Explorer), as well as full backups of Windows and PC data on a Synology NAS.

Using cloud services can be handy, especially if you have the bandwidth available, storage space on said service, and don't mind trusting a company to host your data, but you should also look at keeping copies locally too. A NAS does just this, allowing you to store backups from your PC on a network device.

• How to backup Windows 10 on Synology NAS

Should you be hit with ransomware, you can simply disable all external access to the PC, restore or reinstall Windows, apply a backup, and access all your files without paying out for the "decryption" of your own files, no matter how helpful these fine people appear.

See at Amazon

A new ransomware attack is now spreading across Europe in an outbreak that carries echoes of the WannaCry and Petya attacks that hit scores of PCs earlier in 2017. Called Bad Rabbit, the malware appears to have most strongly impacted Russian and Ukrainian organizations thus far, though similar attacks have been spotted in Turkey and Germany as well.

According to Kaspersky researchers, Bad Rabbit has already infected a number of Russian media outlets, including the Interfax news agency and Fontanka.ru. Odessa International Airport has also reported a cyberattack, but it's not immediately clear whether the two are related. According to ZDNet, the Kyiv Metro's payment systems also appear to be impacted.

Kaspersky explains that the ransomware appears to be targeting corporate networks in a manner similar to the Petya ransomware, but it isn't clear at this point whether Bad Rabbit is related to Petya. Meanwhile, ESET researchers claim to have identified the malware as Diskcoder.D, which is a variant of Petya.

Once infected, victims of the Bad Rabbit attack are directed to a darknet website with a note that demands 0.05 bitcoin (currently around $280) as ransom. The website also features a timer counting down to when the price will increase. It's not yet clear, Kaspersky says, whether it's possible to recover the files encrypted by Bad Rabbit. However, Kaspersky says you can protect yourself by blocking execution of files "c: \ windows \ infpub.dat" and "C: \ Windows \ cscc.dat." If you are infected, experts advise against paying the ransom.

Little more than a month has passed since the notorious WannaCry ransomware attack hit headlines across the world. Now, sadly, we're in a period of another such attack, and this time it's dubbed "Petya" or "GoldenEye."

The basic problem is the same as the WannaCry outbreak: PCs are infected, locked up and files encrypted with a ransom demanded for access to the blocked files. It's not exactly the same as WannaCry, nor is it currently as widespread, but it's still important to know what you're dealing with.

7 tips to keep your Windows PC protected against malware

What you need to know about the Petya Ransomware

What is Petya?

Petya is a piece of ransomware that infects computers with the intent of monetary extortion in return for access to the contents of the PCs. It encrypts files, claiming only to let you back in upon receipt of a ransom.

Which platforms does it affect?

It's a Windows-only affair, and Microsoft already released a patch in March that should protect users, assuming it's installed.

Microsoft's March 2017 MS17-010 security update is where the necessary patches have been compiled.

How does Petya spread?

Petya tries to infect PCs using two methods, moving on to the second if the first fails. Once again, as with WannaCry, Petya utilizes the leaked EternalBlue exploit first developed by American security services.

If that fails because the system has been properly patched, for example, it moves on to the second method, which is to use two Windows administrative tools. Unlike WannaCry, Petya looks to spread within local networks without seeding itself externally, perhaps limiting its early global impact somewhat.

As reported by The Guardian, there is a secondary "vaccine" that may prevent infection on a specific PC, but it leaves Petya free to try and spread to others:

What regions are affected by Petya?

The outbreak is reported to have surfaced in Eastern Europe, with the Ukraine in particular being hit hard. Organizations in France, the UK, Russia, Denmark and the U.S. are also confirmed as being affected.

How much is Petya's ransom?

Right now, $300 in Bitcoin.

If I get hit, should I pay the ransom?

No way! Remember that these are criminals, and chances are you'll be both out of pocket and without your files if you pay. These people don't want to be found, so they're unlikely to do anything that would give authorities any kind of edge in tracking them down.

In this case, there's also the issue of how the ransom is being collected. Instead of a unique wallet per user as with WannaCry, Petya is stuffing it all into one. And that has presented its own problems. Users have to send an email to get their decryption codes, and as reported by The Verge, that email address has been shut down:

Chances are you won't get the key you need even if the miscreants behind the attack ever planned on sending it out.

Am I at risk of Petya infection?

Sadly, we're always at some kind of risk on the internet. As detailed above, Microsoft already released a patch to mitigate at least the EternalBlue exploit, so the first port of call is to make sure that patch is installed.

If you don't have your updates turned on, that's a good place to start. Some people may not like "forced updates" but in most cases you shouldn't ignore them.

How do you get the files back?

Right now there's not a lot suggesting compromised files will ever be accessible again. If you don't have a backup, you might have lost your stuff. It's good practice to always back up your important files.

Is there anything I can do if I am affected?

It appears that there is. This tweet by Hacker Fantastic details what is actually the encryption process and how you can throw a spanner in the works.

You still can't use your PC but the data you have stored on it will apparently be OK.

Your thoughts

That's a quick overview of where things stand right now, but it's an ever-changing situation. We'll do our best to keep on top of the latest details. And if you have anything helpful to share, be sure to leave it in the comments below.