Newish Ransomware Attack out there

All, make sure you have good solid tools for recovery from ransomware:

1. Antivirus and EDR on all servers and endpoints.

2. Immutable storage snapshots with as long of a recovery ability as possible.

3. Tested, verified, off-site backups that are also kept as long as you are required.

4. Someone qualified watching the logs from your AV, EDR, hyoervisors, firewall, etc...if you can't afford a team to do it, outsource it to a managed EDR/XDR.

5. A plan for recovering the most important VMs.

6. If you use vSphere:

A. ExecInstallOnly enforced on Hosts with Secure Boot.

B. Root account not in use and secure, with lockdown mode enabled. Create a different root level account as an exception user.

C. Iptables set up on vCenter to block unnecessary connections.

D. Small group of access to vCenter. No one should have access who doesn't need it to do their job.

E. SSH disabled by default and not left on all the time.

F. Vpxa and dcui accounts disabled on all Hosts.

G. Keep hosts and vCenter and other tools patched.

7. A good cyber insurance policy.

Your company will face ransomware one day. It's not if, it's when. It could be something that is an unpleasant speed bump or it could be something that destroys your company.

There's a group called Termite that's on the move lately spreading a variant of Babuk. Babuk encrypts VMs at the VMDK level and is pretty comprehensive.

Be careful out there SysAdmins.