SamSam Ransomware Strikes Twice In Colorado

It isn’t the first time we’ve heard of damage to an organization caused by the ransomware SamSam. In fact, the recent trouble it’s been giving the Colorado Department of Transportation (CDOT) is the third time we’ve heard of this within the span of a couple of weeks. And unfortunately, the CDOT is dealing with its second incident involving the malware while it’s still trying to eradicate the first one! How’s that for ransomware getting around in a hurry?

The important tidbit to know about SamSam is that is doesn’t use the old faithful spam email with links or attachments to spread. While that is definitely a popular way for malware to get around, SamSam takes advantage of unpatched software. Hackers are continually looking for security flaws in almost any application. Once they find one, they can infect your computer at work or at home without detection from antivirus programs. Keeping all systems and software updated is extremely important these days. More and more types of malware are lurking out there looking around for openings, and your unpatched systems may be its next target.

Just take some time on a very regular basis to keep up with a patch routine and don’t get so attached to the routine that you’re unable to step out of it every now and again to apply critical ones. These are considered “critical” for a reason and often it’s because some vulnerability is being actively exploited.

The CDOT had to shut down 2,000 computers to try to get rid of SamSam. Employees are going back to that stick with lead and the flimsy white, what do you call it?  Paper? It’s not likely the most efficient way to run a business.

Roughly 20% of the machines that were infected the first time, held for ransom, and subsequently restored were re-infected the second time. It appears they didn’t patch them before bringing them back online. Anti-virus was installed, but many times, that isn’t enough since malware evolves; sometimes very quickly.

In addition, make sure all systems are backed up regularly. How often that means to your organization may differ from others. For example, if you’re a hospital, you may want to do it more often that say a restaurant. While it’s unlikely to be life or death if someone gets a wrong order because the point of sale system was down, it could be life or death for computers to be down in an emergency room.

Take patching and updating seriously. SamSam and others like it are out there.  And they aren’t going to give you any grace period to take care of it.