FBI Posts Warning About Ransomware That Goes After Backups

Earlier this week, the US Federal Bureau of Investigation (FBI) posted an alert about SAMAS crypto-ransomware that poses a very real threat to enterprises/businesses due to its malicious routines—specifically, its ability to encrypt files not only on the system it infects but also those shared on the affected organization’s network. This threat also goes after network-stored backups, clearly in an attempt to undermine the typical recommendations for dealing with ransomware: don’t pay the ransom and implement a regular backup strategy.

In an enterprise setting, it’s a warning that should be heeded. SAMAS (which Trend Micro detects as RANSOM_CRYPSAM.B) has the ability to encrypt files across networks, which means it threatens to affect not only an entire organization’s file database, its network-stored backups may be affected as well.

The warning also notes that the threat actors currently using SAMAS are also taking advantage of the malware’s ability to enact a persistent infiltration to “manually locate and delete” the mentioned backups, thereby forcing the hand of business owners to either pay up or take the likely damage that a business-critical data loss would inflict.

One more noteworthy detail about SAMAS, as noted by Microsoft Technet, is how its routines seemingly mirror those of a typical targeted attack: it uses other malicious components to do penetration tests against its target servers as well as scan them for vulnerabilities in its quest to infiltrate. From there, however, it behaves in typical ransomware fashion, encrypting files and demanding a ransom paid in bitcoin.