<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Dear Colleagues,<div class=""><br class=""></div><div class="">The European cybercrime centre at Europol have asked us to circulate the below. I hope you find it useful and please forward it on to anyone who you may think will benefit from it.</div><div class=""><br class=""></div><div class="">Kind regards</div><div class=""><br class=""></div><div class="">Richard Leaning</div><div class=""><div class=""><div class="">External Relations</div><div class="">RIPE NCC</div><div class=""><br class=""></div><div class=""><br class=""></div><br class="Apple-interchange-newline"> </div> <div><br class=""><blockquote type="cite" class=""><div class="">Begin forwarded message:</div><br class="Apple-interchange-newline"><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">From: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">"O3 - European Cybercrime Centre (EC3)" <<a href="mailto:o3@europol.europa.eu" class="">o3@europol.europa.eu</a>><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Subject: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class=""><b class="">@EXT: WannaCry Ransomware</b><br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Date: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">14 May 2017 at 19:06:20 BST<br class=""></span></div><div style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px;" class=""><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif; color:rgba(0, 0, 0, 1.0);" class=""><b class="">Cc: </b></span><span style="font-family: -webkit-system-font, Helvetica Neue, Helvetica, sans-serif;" class="">"Amann, Philipp" <<a href="mailto:Philipp.Amann@europol.europa.eu" class="">Philipp.Amann@europol.europa.eu</a>>, Mounier, Grégory <<a href="mailto:gregory.mounier@europol.europa.eu" class="">gregory.mounier@europol.europa.eu</a>>, "Sanchez, Maria" <<a href="mailto:maria.sanchez@europol.europa.eu" class="">maria.sanchez@europol.europa.eu</a>>, "O372 Advisory Groups Support" <<a href="mailto:O372@europol.europa.eu" class="">O372@europol.europa.eu</a>><br class=""></span></div><br class=""><div class=""><font face="Calibri" size="2" style="font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-size: 11pt;" class=""><div class=""><font color="#1F497D" class=""></font></div><div class="">Dear AG members,</div><div class=""> </div><div align="left" style="text-align: justify;" class="">As you are no doubt aware, we are currently experiencing an unprecedented ransomware attack at a global scale. The malware was detected on 12 May 2017 and has the capability to spread across networks taking advantage of a critical exploit in a popular communication protocol used by Windows systems.</div><div class=""> </div><div class="">Many of you have already reached out and are actively involved in containing this threat. However, since we believe that the infection and propagation rate may go up on Monday when people return to their workplaces, we would like to ask you to please help us distribute information that can help contain this threat. To this end, we have compiled a list of recommendations and also prepared an infographic (see attachment). Please feel free to use this information for reaching out to your network and to complement your advice, if and where useful. <span class="Apple-converted-space"> </span></div><div class=""> </div><div class="">Also, the No More Ransom (NMR) initiative, actively supported by many of you already, remains an essential source of information. Together with you and other partners, we will continue to update the information available via the NMR portal, so it is important to watch this space as well.</div><div class=""> </div><div class="">If you want to share any other prevention, protection or awareness information with us, please do not hesitate to contact us.</div><div class=""> </div><div class="">Thank you again for your continued support.</div><div class=""> </div><div class="">Kind regards,</div><div class="">EC3 Outreach & Support</div><div class=""> </div><div class="">-------------------------------- </div><div class=""> </div><div class=""><b class="">If you are a victim or have reason to believe that you could be a victim</b></div><div class=""> </div><div class="">This is link provides some practical advice on how to contain the propagation of this type of ransomware:<span class="Apple-converted-space"> </span><a href="https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance" class=""><font color="blue" class=""><u class="">https://www.ncsc.gov.uk/guidance/ransomware-latest-ncsc-guidance</u></font></a></div><div class=""> </div><div class="">The most important step involves patching the Microsoft vulnerability (MS17-010):</div><div class=""><a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" class=""><font color="blue" class=""><u class="">https://technet.microsoft.com/en-us/library/security/ms17-010.aspx</u></font></a></div><div class=""> </div><div class="">A patch for legacy platforms is available here:</div><div class=""><a href="https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks" class=""><font color="blue" class=""><u class="">https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks</u></font></a></div><div class=""> </div><div class="">In instances where it is not possible to install the patch, manage the vulnerability becomes key. One way of doing this would be to disable the SMBv1 (Server Message Block) protocol:</div><div class=""><a href="https://support.microsoft.com/en-us/help/2696547" class=""><font color="blue" class=""><u class="">https://support.microsoft.com/en-us/help/2696547</u></font></a></div><div class="">and/or block SMBv1 ports on network devices [UDP 137, 138 and TCP 139, 445].</div><div class=""> </div><div class="">Another step would be to update endpoint security and AV solutions with the relevant hashes of the ransomware (e.g. via VirusTotal).</div><div class=""> </div><div class="">If these steps are not possible, not starting up and/or shutting down vulnerable systems can also prevent the propagation of this threat.</div><div class=""> </div><div class=""><b class="">How to prevent a ransomware attack?</b></div><div class=""> </div><ol style="margin: 0px; padding-left: 36pt;" class=""><li style="margin-bottom: 10pt;" class=""><b class="">Back-up! Back-up! Back-up!</b><span class="Apple-converted-space"> </span>Have a backup and recovery system in place so a ransomware infection can’t destroy your personal data forever. It’s best to create at least two back-up copies on a regular basis: one to be stored in the cloud (remember to use a service that makes an automatic backup of your files) and one stored locally (portable hard drive, thumb drive, etc.). Disconnect these when you are done and store them separately from your computer. Your back-up copies will also come in handy should you accidentally delete a critical file or experience a hard drive failure.</li><li style="margin-bottom: 10pt;" class=""><b class="">Use robust antivirus software</b><span class="Apple-converted-space"> </span>to protect your system from ransomware. Always use the latest virus definition/database and do not switch off the ‘heuristic’ functions as these help the solution to catch samples of ransomware (and other type of malware) that have not yet been formally detected.</li><li style="margin-bottom: 10pt;" class=""><b class="">Keep all the software on your computer up to date.</b><span class="Apple-converted-space"> </span>When your operating system (OS) or applications release a new version, install it. If the software you use offers the option of automatic updating, enable it.</li><li style="margin-bottom: 10pt;" class=""><b class="">Trust no one. Literally.</b><span class="Apple-converted-space"> </span>Any account can be compromised and malicious links can be sent from the accounts of friends on social media, colleagues or an<span class="Apple-converted-space"> </span><a href="https://blog.kaspersky.com/teslacrypt-20-ransomware/9314/" class=""><font color="blue" class=""><u class="">online gaming</u></font></a><span class="Apple-converted-space"> </span>partner. Never open attachments in emails from someone you don’t know. Similarly, don’t open attachments in emails from somebody you know but from whom you would not expect to receive such as message. Cybercriminals often distribute fake email messages that look very much like email notifications from an online store, a bank, the police, a court or a tax collection agency, luring recipients into clicking on a malicious link and releasing the malware into their system. If in doubt, call the sender at a trusted phone number to confirm the legitimacy of the message received.</li><li style="margin-bottom: 10pt;" class=""><b class="">Enable the ‘Show file extensions’ option in the Windows settings on your computer.</b><span class="Apple-converted-space"> </span>This will make it much easier to spot potentially malicious files. Stay away from file extensions like ‘.exe’, ‘.com’, ‘.vbs’ or ‘.scr’. Cybercriminals can use several extensions to disguise a malicious file as a video, photo, or document (like hot-chics.avi.exe or report.doc.scr).</li><li style="margin-bottom: 10pt;" class="">If you discover a rogue or unknown process on your machine,<span class="Apple-converted-space"> </span><b class="">disconnect it immediately from the internet or other network connections (such as home Wi-Fi)</b><span class="Apple-converted-space"> </span>— this will prevent the infection from spreading.</li></ol><div class=""> </div><div class=""> </div><div class=""> </div><div class=""> </div></span></font><span style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">*******************</span><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">DISCLAIMER : This message is sent in confidence and is only intended for the named recipient. If you receive this message by mistake, you may not use, copy, distribute or forward this message, or any part of its contents or rely upon the information contained in it.</span><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Please notify the sender immediately by e-mail and delete the relevant e-mails from any computer. This message does not constitute a commitment by Europol unless otherwise indicated.</span><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">*******************<span class="Apple-converted-space"> </span></span></div></blockquote></div></div></body></html>