SamSam creators to date have raked in $6 million and the ransomware continues to be a thorn in the sides of organizations in both the public and private sectors.
Once in, attackers spread the “payload laterally across the network; a sleeper cell that lays in wait for instructions to begin encrypting,” Sophos said.
Because SamSam encrypts document files, images, and other personal or work data, as well as “configuration and data files required to run applications (e.g., Microsoft Office),” Sophos said that “victims whose backup strategy only protects the user's documents and files won't be able to recover a machine without reimaging it first.”
Attribution, as with many threats, is difficult. MacKenzie said research indicates that SamSam is likely the work of a small group.
Attacks tend to occur after normal business hours when admin staffs are smaller and abnormal behavior can fly under the radar.
“Ever a predator, the attacker waits until late at night, when the target organization is least well equipped to deal with it, before the final blow is struck,” said Sophos. “A sneak attack while the target literally sleeps, SamSam encrypts a prioritized list of files and directories first, and then everything else.”
Whether or not this means that SamSam attackers are based somewhere on Eastern Europe or Asia is unclear.
What is certain, however is that SamSam attackers are becoming progressively savvier, showing “an increasing awareness... of operational security.” And they have bumped up ransoms dramatically. “The tempo of attacks shows no sign of slowdown,” Sophos said.
