HiResThose of you who follow cybersecurity news in general and our blog in particular have likely noticed a rise in the number of ransomware-related events.

Over the last few weeks alone we seen a high-profile case of three US hospitals under attack, and software such as remote control tool TeamViewer, which claims one billion downloads, being used as a ransomware attack vector. The Los Angeles Times has deemed 2016 the year of ransomware.

We on the ThreatSTOP security research team work diligently to protect our customers from ransomware attacks. Over the past several weeks we have introduced and updated our ThreatSTOP Shield service and ThreatSTOP DNS Firewall with thousands of indicators related to new ransomware events.

To make it easier for ThreatSTOP customers to consume this information directly, and better protect their networks and users, we had gone a step further and added two new target lists to our system which are available in Expert mode:

  • TSCritical Ransomware
  • TSCritical Ransomware domains (for ThreatSTOP DNS firewall clients only)

These ransomware targets are manually curated by our security research team, and manually validated data about distribution sites and C&Cs servers will be shared with our customers via those lists.

We have also updated several of our synthetic target lists to accommodate this addition and to make it easier for our customers to consume the data:

  • CRYPTO (for all of our customers) and CRYPTO-Domains  (for DNS firewall clients only) have been upgraded with the TSCritical Ransomware data as well as the ransomware tracker data from ch (Thanks for the great work guys!)
  • BOTNETS, BOTNETS-RU (for all of our customers) and BOTNETS-Domains (for DNS firewall clients only) are now consuming the TSCritial Ransomware and the CRYPTO data as well. These targets are available in basic mode, and if you already have them in your policy, you are automatically protected.

Note – we only block C&Cs and distribution sites for ransomware, and do not block payments sites.

We highly recommend current customers update their policies and include these targets in them to immediately increase their protection from the growing number of ransomware attacks.