Return-Path: <1921889-415-1022@be4.maropost.com> Delivered-To: edward@transocean.com Received: from vps.transocean.com by vps.transocean.com (Dovecot) with LMTP id 2bLKCUq2UlkKCQAAInt2oQ for ; Tue, 27 Jun 2017 12:47:22 -0700 Return-path: <1921889-415-1022@be4.maropost.com> Envelope-to: edward@transocean.com Delivery-date: Tue, 27 Jun 2017 12:47:22 -0700 Received: from mta7165.mp2200.com ([162.247.117.165]:20919) by vps.transocean.com with esmtp (Exim 4.89) (envelope-from <1921889-415-1022@be4.maropost.com>) id 1dPwS6-0000gO-00 for edward@transocean.com; Tue, 27 Jun 2017 12:47:22 -0700 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=default; d=knowbe4.com; t=1498592828; l=1; h=from:subject:date:to; bh=nR4OLZRZ0GUjrRPiikCTwjFrqv567Fsl8w66LhE1mcQ=; b=vZcShbGizAMbx/dPovxKX+fnjgBv6EtXQud4IoSRmwnFpKFAToB0diLaGJoqvOd6rBI2px 1yCvDFVwqhKt6+q6oftMUCQ1FhEqWqPF2pR56RZvAnGpnnZNtQDSnqnmjiRMp3CNiu8wGf Cac3jXyBV1Y4c1BwIedjX3Gqr2VVTck= Received: from [<1921889-415-1022@be4.maropost.com>] ([<1921889-415-1022@be4.maropost.com>] helo=) by 649892-mailer2 (envelope-from 1921889-415-1022@be4.maropost.com) (Jetsend MTA 0.0.1 with ESMTP; Tue Jun 27 15:24:11 EDT 2017 Date: Tue, 27 Jun 2017 15:24:10 -0400 From: CyberheistNews Flash Reply-To: feedback@knowbe4.com To: edward@transocean.com Message-ID: <1e8fcbe0-3d9c-0135-21fc-0cdcd4b634c4@knowbe4.com> Subject: [ALERT] Looks Like a New Worldwide Ransomware Outbreak Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5952b0da41577_5c36c812ec65763542"; charset=UTF-8 Content-Transfer-Encoding: 7bit List-Unsubscribe: X-CampaignID: 415 X-Campaign-ID: 415 X-ContactID: 1921889 X-AccountID: 1022 X-Binding: 162.247.117.165 X-DkimDomain: knowbe4.com X-DkimSelector: default X-Feedback-ID: 415:Maropost X-Spam-Status: No, score=0.7 X-Spam-Score: 7 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "vps.transocean.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: If you are having trouble viewing this email, click here. http://newsletter.knowbe4.com/a/1022/preview/415/1921889/8cf382b0ef565552314b1cc272f5ebae982db169 This email was sent to &lt;b&gt;edward@transocean.com&lt;/b&gt; by &lt;b&gt;feedback@knowbe4.com&lt;/b&gt; Manage Subscriptions http://newsletter.knowbe4.com/a/1022/unsubscribe/415/1921889/8cf382b0ef565552314b1cc272f5ebae982db169 33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA Report Spam http://newsletter.knowbe4.com/a/1022/report_spam/415/1921889/8cf382b0ef565552314b1cc272f5ebae982db169 [...] Content analysis details: (0.7 points, 3.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: transocean.com] 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror) -0.0 SPF_PASS SPF: sender matches SPF record 0.8 BAYES_50 BODY: Bayes spam probability is 40 to 60% [score: 0.4933] 0.0 HTML_FONT_SIZE_LARGE BODY: HTML font size is large 0.0 HTML_MESSAGE BODY: HTML included in message 0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted Colors in HTML 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines X-Spam-Flag: NO ----==_mimepart_5952b0da41577_5c36c812ec65763542 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit If you are having trouble viewing this email, click here. http://newsletter.knowbe4.com/a/1022/preview/415/1921889/8cf382b0ef565552314b1cc272f5ebae982db169 This email was sent to &lt;b&gt;edward@transocean.com&lt;/b&gt; by &lt;b&gt;feedback@knowbe4.com&lt;/b&gt; Manage Subscriptions http://newsletter.knowbe4.com/a/1022/unsubscribe/415/1921889/8cf382b0ef565552314b1cc272f5ebae982db169 33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA Report Spam http://newsletter.knowbe4.com/a/1022/report_spam/415/1921889/8cf382b0ef565552314b1cc272f5ebae982db169 ----==_mimepart_5952b0da41577_5c36c812ec65763542 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable [ALERT] Looks Like a New Worldwide Ransomware Outbreak</titl= e> </head> <body> <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http= ://www.w3.org/TR/REC-html40/loose.dtd"> <html><body><table cellpadding=3D"0" cellspacing=3D"0" width=3D"100%"> <tr><td> <img height=3D"1" width=3D"1" alt=3D"" style=3D"display:block;" src=3D"ht= tp://newsletter.knowbe4.com/a/1022/open/415/1921889/8cf382b0ef565552314b1= cc272f5ebae982db169"> <div align=3D"center" style=3D'font-size:8.0pt; font-family:"Arial","sans= -serif"; color:#666666;margin-bottom:10px;display:block !important'> If you are having trouble viewing this email, <a style=3D"border:0px" class=3D"maro_no_record" href=3D"http://newslette= r.knowbe4.com/a/1022/preview/415/1921889/8cf382b0ef565552314b1cc272f5ebae= 982db169?message_id=3DIjFlOGZjYmUwLTNkOWMtMDEzNS0yMWZjLTBjZGNkNGI2MzRjNEB= rbm93YmU0LmNvbSI=3D">click here.</a> </div> </td></tr> <tr><td> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">= <title>
[ALERT] Looks Like A New Worldwid= e Ransomware Outbreak



Motherboard reported: "A quickly-spreading= , world-wide ransomware outbreak has reportedly hit targets in Spain, Fra= nce, Ukraine, Russia, and other countries.

On Tuesday, a wide range of private businesses reportedly suffered ransom= ware attacks. Although it is not clear if every case is connected, at lea= st several of them appear to be related to the same strain of malware."
Motherboard continued: "The attacks are similar to the recent WannaCry ou= tbreak, and motherboard has seen several reports of infections shared by = victims on Twitter. We were not able to immediately confirm the veracity = of the reports, but several security researchers and firms also reported = the attacks.

"We are seeing several thousands of infection attempts at the moment, com= parable in size to Wannacry's first hours," Costin Raiu, a security resea= rcher at Kaspersky Lab, told Motherboard in an online chat.

Judging by photos posted to Twitter and images provided by sources, many = of the alleged attacks involved a piece of ransomware that displays red t= ext on a black background, and demands $300 worth of bitcoin.

"If you see this text, then your files are no longer accessible, because = they are encrypted," the text reads, according to one of the photos. "Per= haps you are busy looking for a way to recover your files, but don't wast= e your time. Nobody can recover your files without our decryption service= ."

Raiu believes the ransomware strain is known as Petya or Petrwrap, a high= ly sophisticated Russian strain, withaout all the errors that WannaCry co= ntained, and no kill-switch. According to a tweet from anti-virus company= Avira, the Petya attacks were taking advantage of the EternalBlue exploi= t previously leaked by the group known as The Shadow Brokers (Motherboard= could not independently confirm this at the time of writing).

EternalBlue is the same exploit used in the WannaCry attacks; it takes ad= vantage of a vulnerability in the SMB data-transfer protocol, and Microso= ft has since patched the issue. However, whether customers apply that pat= ch is another matter.

Security researchers from Kaspersky Lab reported that the ransomware hit = Russia, Ukraine, Spain, France, among others. Several people on Twitter r= eported witnessing or hearing reports of the outbreak in their respective= countries, and across a wide range of industries. Companies around the w= orld also reported computer outages.

If You Have Not Done So Yet, Apply This Patch Immediately.

From what we have been able to learn, this new worm spreads through SMB j= ust like WannaCry so when we're talking about machines behind firewalls b= eing impacted, it implies port 445 being open and at-risk hosts listening= to inbound connections. It'd only take one machine behind the firewall t= o become infected to then put all other workstations and servers at risk = due to it being a true worm.

In the meantime, harden yourselves against this Windows Network Share vul= nerability and ensure that all systems are fully patched with the "MS17-0= 10" security update (link below) and remind all staff to Think Before = They Click when they receive any out of the ordinary emails.
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Check the KnowBe4 blog for continuous updates:
https://blog.knowbe4.com/alert-looks-like-a-new-worldwide-ransomware-outb= reak
=C2=A0

=C2=A0

Free Ransomware Simul= ator Tool

How vulnerable is your network against a ransomware atta= ck?

Bad guys are constantly coming out with new strains to evade detection. I= s your network effective in blocking all of them when employees fall for = social engineering attacks?

KnowBe4=E2=80=99s "RanSim" gives you a quick look at the effectiveness of= your existing network protection. RanSim will simulate 10 infection scen= arios and show you if a workstation is vulnerable to infection.

To download RanSim click or copy this link:
https://info.knowbe4.com/ransomware-simulator-tool-1chn


Warm Regards,
Stu Sjouwerman
Founder & CEO
KnowBe4, Inc.

Twitter | LinkedIn | Google | YouTube
Copyright =C2=A9 2014-2017 KnowBe4, Inc. All rights reserved.<= /div>
=C2=A0
=C2=A0
=C2=A0 This email was sent= to edward@transocean.com by feedback@knowbe4.com

33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA
=C2=A0 		=C2=A0
----==_mimepart_5952b0da41577_5c36c812ec65763542--