Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
The Threat
It has come to our attention that multiple ransomware infections have surfaced and spread in Spain at the company Telefonica as reported by Reuters and at the National Health Service (NHS) of the United Kingdom, as reported by the Guardian.
This strain goes by the names WanaCrypt0r 2.0, WCry, WannaCrypt and Wana Decryptor. The ransomware spread appears to leverage an SMB exploit from the April 2017 Shadow Brokers dump. The purpose of the TOR client appears to send the infected machine's encryption key to the threat actor controlling the ransomware.
eSentire Response
Recommended Action
Additional Information
News outlets and online security sources are reporting that there have been more than 60,000 WannaCryptor infections across 50+ countries today.
Deployment of the MS17-010 patches is extremely important. The Microsoft SMB vulnerability is the primary means of the ransomware spreading while inside the network. eSentire does not recommend ransom payment, as there is no guarantee that the affected data will be recovered.