x-post from LInkedIn:
It seems likely that the Cryptolocker and other ransomware type malware are only going to grow.
If you're not familiar here's how the operation works.
a. Criminal enterprise hijacks multiple sites (often Wordpress blogs) to seed them as the distributor for the malware.
b. Emails are sent out with not much more than a link to said malware. These are typically forged return addresses and are sent through yet more compromised computers which act as relays for the mail.
c. Unsuspecting users click the links in the email and load Cryptolocker type malware. What this does is encrypt some of your data with industrial strength encryption. There is no undo. There is no unlocking this unless you have a special key (only provided once you pay the ransom). You are given the option (extorted) to pay some amount -- usually $300 - $500 via prepaid debit card.
Sadly most business have terrible backups. They in turn weigh the options of a computer network being unusable for two weeks or paying a criminal enterprise to (hopefully) generate a code which un-encrypts their data.
What happens? Businesses without backups pay up. This fuels copycats and the original criminal enterprises.
Start all over again at (A) above....
Here's what you can do:
1. Have a backup that works and that has been tested recently. This is no longer a ""nice to have"". It's a requirement. Mark Chinsky's Eversafe backup and disaster recovery is a good place to start. Yup - expensive. So is being down for two weeks and having thirty people idle (happened to a customer last month). Yup, nobody buys this until they've been hit by disaster but that doesn't mean you can't suggest it -- you'll feel less guilty when you charge $25,000 to recover their ERP from total disk failure.
2. Never click a link or open a file attachment which you were not expecting no matter who the sender appears to be.
3. If you are running a Wordpress blog you should create an administrator account (FIRST) ---- > OTHER THAN admin. Then delete the default admin account (make sure you created a new Admin account and don't call it anything resembling ""administrator"", ""supervisor"" , etc).
Install a plug-in such as Wordfence which will alert you to every bogus login attempt and automatically lock out any attempts to login as the ""admin"" account. This should significantly reduce the threat of your site being compromised.
Companies are regularly paying this Cryptolocker ransomware which means that this threat will grow until such a time as effective anti-virus and anti-malware measures can reliably capture the threats (as of now there seems to be few effective anti-virus tools which can stop this).