CIP Cyber

SamSam malware puts 2,100 servers at risk of Ransomware attack

Table of Contents

A new study by Cisco Talos revealed that more than about 2,100 servers across 1,600 different networks have been compromised. The research by Cisco security personnel shows that, ‘In past few months a ransomware campaign is going on which has changed the landscape of ransomware delivery.’

Cisco researchers discovered this SamSam malware last month; researchers find SamSam pretty different from the previous malwares – which encrypted data and demand ransoms. SamSam is not launched via user focused attack vectors, such as phishing campaigns and exploit kits.

This particular family seems to be dispense via compromising servers and using them as a foothold to move laterally through the network to compromise additional machines which are then held for ransom. The industries which may be targeted in coming days because of SamSam server attacks are; government departments, aviation companies, schools and universities.

According to the Cisco Talos blog post, “we scanned for machines that were already compromised and potentially waiting for a ransomware payload. We found just over 2,100 backdoors installed across nearly 1600 ip addresses.”

How to evade SamSam Malware from encrypting your data 

If you diagnose a webshell on your organization’s server; you need to act immediately and take proper steps to address the threat. 
  • Your first step should be to remove the external access of your server. This will give you time to respond and also prevent outside access to your servers. 
  • Second step should be re-imaging the systems and install the latest version of software. This is the best solution to prevent outside breach or access of your server. 
  • In case you failed to re-build totally, your only option left is to restore backup before the server was compromised. Then, update the server to the updated version before returning it to production. 
CIP Cyber Staff

CIP Cyber Staff

CIP Cyber Staff comprises CIP cybersecurity experts committed to delivering comprehensive information on critical infrastructure protection. The content covers diverse topics, equipping professionals to defend organizations and communities in an ever-evolving cyber landscape.

Most popular

Industrial Cybersecurity

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings

Related Articles

Want always be up to date?

Don't miss the latest news

By subscribing to our mailing list, you will be enrolled to receive our new trainings, latest blog posts, product news, and more.

CIP Training & Certifications

Transform your cybersecurity skills with CIP Cyber’s comprehensive training & course offerings