FBI issues new ransomware warning

The US Federal Bureau of Investigation (FBI) has warned that the number of ransomware infections will rise in 2016. Its new warning on ransomware follows the targeting last week of utility, Lansing Board of Water and Light, which saw its internal and external services disrupted after its files became encrypted. The new update from the FBI focuses on education and prevention, and calls on companies to have a strong business continuity plan where these fail and the company suffers an attack. Previously, it had been suggested that the FBI recommended paying the ransom, but the agency has ruled this out. Its Cyber Division assistant director, James Trainor, argued that this did not guarantee that files would be unlocked, and encouraged hackers to target more organisations. The advisory also warned that ransomware is not just spread through the use of phishing emails, but that drive-by attacks (where malicious code is added into legitimate sites) are increasing.

The FBI has been forced to issue a new ransomware alert, warning internet users that the number of infections is only going to rise again in 2016.

Reports had circulated last year that the Feds were advising organizations to pay up if infected with ransomware, in order to get their files back.

However, in the latest official update the focus was on education, prevention and having in place a solid business continuity plan in case of attack.

Cyber Division assistant director, James Trainor, warned that paying the ransom doesn’t guarantee that an organization will get its data back.

“We’ve seen cases where organizations never got a decryption key after having paid the ransom,” he added.

“Paying a ransom not only emboldens current cyber-criminals to target more organizations, it also offers an incentive for other criminals to get involved in this type of illegal activity. And finally, by paying a ransom, an organization might inadvertently be funding other illicit activity associated with criminals.”

The FBI also warned firms that ransomware isn’t just an email-based problem, but is now turning up in drive-by attacks where legitimate websites are seeded with the malicious code.

The news comes as Michigan-based public utility Lansing Board of Water and Light last week admitted its computer systems got infected with ransomware via a phishing email.

Although no personal information was compromised and the delivery of water and electricity was unaffected, administrative functions were crippled by the attack.

An initial statement had the following:

“We immediately instated a self-imposed lockdown to all of our corporate networks to protect the system while developing a solution. We are working with local, state and federal law enforcement authorities.”

The utility provider later claimed to have hired “licensed incident response experts” to get systems back up and running, and that it wouldn’t release any more details while law enforcers were looking into the case.

Ransomware is not just a US problem, of course. It accounted for 42% of security ‘breaches’ in 2015, according to Foursys. Also, Trend Micro stats revealed there were more than twice as many UK enterprise infections in February than in the entire first three months of 2015.