A new warning from the FBI highlights an aggressive campaign of ransomware attacks targeting higher education, K-12 schools, and seminaries, providing specific attack details.
Within the cybercrime ecosystem, there will be criminal organizations that specialize in targeting certain organizations. Perhaps the bad guys are great at social engineering a certain industry, or maybe the target organization type has a particular security profile that is easier to bypass. Whatever the reason, we’re seeing more cybercriminal orgs begin to specialize.
A new warning from the FBI is directed at educational institutions, cautioning them of targeted attacks using PSYA ransomware. According to the FBI, PSYA typically gains unauthorized access to victim networks via either Remote Desktop Protocol (RDP) access and/or through phishing.
Once inside the victim network, PSYA threat actors use native and freeware tools to exfiltrate files from the victim’s network, and then encrypt all connected Windows and/or Linux devices and data “rendering critical files, databases, virtual machines, backups, and applications inaccessible to users.”
The FBI recommends regular backups, network segmentation, use of multi-factor authentication, disabling Internet-facing RDP, keep systems updated, and to focus on Security Awareness Training.
Here's how it works:
