MCLEAN, Va., May 15, 2017 /PRNewswire/ — Cyren (NASDAQ: CYRN), a leading internet Security as a Service provider, has issued a Customer Update for all of the company’s customers and partners regarding the recent massive ransomware outbreak known as WannaCry (aka WannaCryptor, Wcrypt, and WannaCrypt). Cyren’s cloud security products fully protect customers and partners from all known variants of the WannaCry ransomware delivered over email or the web.
- Cyren customers are protected from all WannaCry variants and were protected from the initial malware outbreak by Cyren’s SaaS email security gateway, web security gateway, and cloud sandboxing services.
- Cyren Threat Intelligence Services partners are protected from all WannaCry variants and were protected from the initial malware outbreak by our OEM threat intelligence services for anti-spam, anti-malware, anti-phishing, IP reputation, and URL filtering.
- Cyren’s cloud-based platform identified and protected customers from the first early stages of the WannaCry attack. This included detection of the initial vulnerability exploit payload and classification of all related evidence of the attack in email and web, including “kill switch” IP addresses and command & control (C&C) server callbacks.
- Cyren’s cloud has identified over 300 variants of the WannaCry attack to date. Cyren’s cloud automatically classifies any related indicators of the attack, and protects customers from compromised URLs that are used as droppers.
- Cyren’s cloud continues to identify infected URLs as well as malicious IP addresses and the C&C server with which the WannaCry attack communicates.
- Cyren has identified that WannaCry is still being delivered through several file sharing services over HTTPS.
- More details can be viewed on the Cyren blog at: https://blog.cyren.com/articles/wannacrypt-ransomware-spreads-via-nsa-exploit.html
How WannaCry Works
On Friday, May 12, a massive ransomware attack called “WannaCry” hit a broad set of organizations in Europe, including the UK National Health Service (NHS) and Spanish telecom firm Telefonica. Cyren’s blog article (https://blog.cyren.com/articles/wannacrypt-ransomware-spreads-via-nsa-exploit.html) provides further detail about the attack and how it works. One of the important things to note is how the attack spreads. Traditionally, ransomware is delivered via email, but this attack appears to have added Worm capabilities to the ransomware, giving it the ability to self-propagate once inside an organisation by spreading from machine to machine using unpatched vulnerabilities in the Windows operating system. Note that, while the initial attack was stopped by a security researcher who was able to shut down a “kill switch” in the malware, new strains of the ransomware are emerging that have removed this functionality. Organizations need to take steps to make sure they protect themselves against both the initial exploit and lateral propation. See Cyren’s guidance on this below.