What Are You Saving For This Christmas? I Bet It’s Not For Ransomware!

December 1, 2016 3:09 pm Emma Torrans

The Christmas holidays are near and for most of us, they are a time of joy and happiness to spend with our loved ones and closest friends. But unfortunately – ‘tis the season for ransomware attacks.

In short, ransomware will prevent you from using your PC or laptop normally, unless you pay the ransom demand to unlock your computer’s screen. And during the Christmas holidays, at home you will access your computer to order online purchases, track expected deliveries and even check your bank account (to see how much money you have spent!).

But the difficulty with this in an organisation is that cybercriminals will not only hope to lock your screen, but they hope to encrypt your files thus rendering them useless. For critical day-to-day business operation, this is fatal. Not only will you have a large amount of files that you cannot access or use, but you face paying a substantial demand to have them restored.

Below we have included a few examples of ransomware attacks that could affect you this Christmas season.

Gift cards from clients

Christmas is a time for giving and most of us would be incredibly grateful to receive a gift from our clients and suppliers. However, this is an ideal opportunity for cybercriminals to launch a ransomware attack.

In order to target a ransomware attack specifically to one individual, a cybercriminal will have done their research and most likely monitored your social media presence. This allows them to see who you interact with and offers them a chance to masquerade as a customer or supplier.

A cybercriminal may target an individual with a ransomware attack by creating an email from a “supplier”, thanking the organisation for their service over the last year. In this email, they have provided you with a handy link to download the restaurant vouchers they ordered for you.

You will be distracted by the thoughtful gift and not stop to look at the email domain, spelling and grammar in the email or even look at who has signed off on the email. You will only be interested in the link they have provided you with so you may receive your vouchers. But by clicking that link, a hacker has access to your computer and potentially, your company’s network.

The office Christmas party is cancelled

One event that all staff look forward to is the annual Christmas party. A chance to dress up, forget your troubles and enjoy a night together with your colleagues. But unfortunately, a lockdown on a Finance PC or laptop means that no-one can access the banking portal to complete the last payment.

Enabling an attack on the Finance department of a business is detrimental to how it functions on a daily basis. If a desktop machine or laptop is compromised, nobody can access their records, send an invoice to a customer or even arrange the last Christmas party payment.

At Christmas time everyone wants to sign off on those last minute invoices or purchase orders to ensure a smooth sailing into the holidays and 2017. But this eagerness can put a business in danger. If you receive an email from a colleague or client, urgently asking you to make payment for an outstanding invoice, be wary of suspicious attachments and links. And better yet – pick up the phone and verify the invoice with them first!

Avoid using public Wi-Fi for remote working

For those employees who travel a lot, nothing makes them happier than sending off that report right before they board the plane home for the Christmas break. However, public Wi-Fi networks are becoming more and more susceptible to hacks due to a lack of encryption.

If you are working on your laptop in the airport lounge whilst waiting for your boarding call, the easiest way to send an email is to connect to the nearest Wi-Fi network and then travel home worry-free. But have you ever considered just how many other people are in the airport (especially at Christmas time), and just how many of them are probably using a Wi-Fi network too? All it takes is for a cybercriminal to set up a fake Wi-Fi network and you to connect to it: then they have access to all of the information that you do.

Consider asking your IT department to set you up with a VPN (Virtual Private Network) so you may work securely when travelling. Or – just ask yourself if it can wait until you’re back in the office. (Tip: Read our blog on remote working for more information!) 

That long-awaited delivery is finally arriving!

The IT order you placed last week is finally on its way to you! Odd that your confirmation email said Royal Mail would deliver it, but this email you received gives you a DPD tracking link. Unfortunately, on the run-up to Christmas, there will be hundreds of email scams concerning a package that is arriving for you.

The important things to remember when expecting a delivery (either work-related or personal) is to know what site you purchased the item from, who their delivery partner is and the estimated date provided to you at time of purchase. At this time of year, plenty of us are waiting on packages arriving but be wary of these links: one click and that’s the ransomware installed – and wondering when your parcel will be delivered will be the least of your worries.

Generous charity donations … beware!

At this time of year, organisations may select a local charity to donate money or gifts to. If your organisation is ever approached by a charity asking for a donation, ensure to ask for their charity registration number and verify this by checking the Charity Commission’s website.

At this time of year, cybercriminals will create fake charity sites and identities in order to obtain money from various organisations so remain vigilant if making a donation.

What can we learn from Christmas ransomware scams?

Ransomware scams are everywhere but cybercriminals will strike harder during the Christmas holidays as individuals are distracted with the thought of finishing up that last piece of work, getting ready for the Christmas party and locking up the office until January. But distractions open up a gateway for cyber destruction so it’s crucial to remain vigilant. Ransomware can cost a company’s brand and reputation and land you with a huge ransom bill at the end of it all.

Take the time to educate yourself and your organisation on the threat of ransomware and what to look out for. Request a demo of our simulation tool MetaPhish to directly target your staff with mock ransomware emails to test their awareness. You can also contact us about our eLearning module on Essential Phishing Awareness to help your staff understand what to look out for.