The German cybersecurity authority BSI warns of ransomware attacks over the Christmas holidays, fearing the return of the Emotet botnet return. During this period offices are often closed and employees are at home, for this reason, their organizations are more exposed to ransomware attacks.
The agency also warns of attacks that could exploit vulnerabilities in Microsoft Exchange to compromise mail servers of German organizations.
BSI urges German organizations to patch their systems.
“In times when the affected organizations may not be able to react as quickly as under normal circumstances.
During the same period in which Emotet became active again, the operators of ransomware-as-a-service (RaaS) Conti began actively recruiting new so-called affiliates.” reads the BSI’s alert. “
“Based on experiences prior to the Emotet takedown in early 2021, waves of attacks carried out by the Emotet botnet, and subsequent execution of ransomware will increasingly hit German organizations in the coming weeks (especially
during the “Christmas holidays”).”
The German cybersecurity authority also urges organizations to implement preventive measures and increase the level of security to prevent Emotent and other malware infections.
At the end of November, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI also warned critical infrastructure partners of ransomware attacks during the holiday season.
Both agencies haven’t identified any specific threats, but recent trends let them into believing that threat actors could launch impactful ransomware attacks during holidays and weekends
Below is the list of actions recommended by the agencies to increase the level of security of their infrastructure:
In August, the FBI and CISA issued a similar alert, titled “Ransomware Awareness for Holidays and Weekends,” to warn organizations to keep high their defenses against ransomware attacks during weekends or holidays.
The FBI and CISA recommend organizations conduct threat hunting on their networks aimed at searching for any signs of threat actor activity to prevent attacks before they occur or to minimize the impact of successful attacks.
(SecurityAffairs – hacking, holidays)