Temporal Landmarks Such as Monday May Prove Fresh Start Effect Works for Cyber Criminals

According to a study by Katherine Milkman, a professor at the Wharton School at the University of Pennsylvania found that we are likely to start new behaviors after a temporal landmark, such as after our birthday, at the start of a year, month, or week. In the case of recent ransomware attacks, that temporal landmark is indeed Monday for when the cyber criminals activate them.

In a couple of Mondays in October and again in November, a blitz of phishing email messages containing various strains of ransomware was sent to unsuspecting potential victims. In early October, it was Cerber, which is one of the largest active strains of ransomware currently making the rounds. In July, 150,000 Microsoft Windows users were infected with Cerber and Locky was found in about 14 million messages in late October requesting .5 bitcoin (approximately $340) for the decryption key.  This one contained a so-called “complaint letter” which contained a malicious file in a .zip attachment.

Cerber, on the other hand is constantly changing. It is distributed by Ransomware-as-a-Service (RaaS). This means the campaigns are run by several people and use a variety of methods to be successful. RaaS is becoming quite a successful business model for cyber criminals.

Following Professor Milkman’s fresh start effect, a large volume of Cerber phishing email messages went out on the first Monday in October and had various subjects to greet unsuspecting potential victims. Inside were various “social engineering” hooks that tried to make the reader believe they were legitimate messages; sometimes referring to a shipped package or shipped order and request the reader open an attachment. Inside is a Word template file that requires a password, which is in the body of the message. Once successfully opened, the users saw a yellow “security warning” bar (a la MS Office) that required enabling a macro. If that was successful, the machine contents were encrypted and a payment message appeared. In this case, the ransom was a bit less than 1 bitcoin, or roughly $600. The longer the user waited, the higher the ransom to get the files back.

Always remember to keep recent backups of your important files. This will prevent ransomware such as these from completely ruining your day. If you or someone in your organization accidently opens an infected attachment or clicks a malicious link, a backup can be restored and everyone is up and running full speed in comparatively speaking, no time. If you oversee a network at your organization, performing regular backups of data should be part of your overall security policy and should not be overlooked.

Phishing and the social engineering tactics surrounding it are likely why the “first start effect” tends to work. If they are sent on Mondays along with a barrage of other messages, workers may get in a rush to get through all of them and open them more hastily than perhaps they would on a different day of the week. With the average user getting more than 40 emails on a given day and middle managers getting up to 200 (per a Proofpoint study in 2015), it’s likely that number is bigger on Mondays.

Training and educating staff should also be a priority. In fact, President Obama issued an executive order (number 13636) encouraging companies to make educating employees on cyber security a priority.

Just to be clear, while we are making a connection to temporal landmarks and cyberattacks, to our knowledge, a study on this has not yet been done. However, if Milkman is correct, these attacks may be more than coincidence.

As always, up-to-date anti-malware and anti-virus software is a must on every single computer, smartphone, and tablet that connects to the Internet. This goes for every operating system, no matter how secure the developer says or thinks their products are. If you’re online, you are vulnerable to attacks on any day of the week, month, or year.