UK Law Enforcement authorities released an alert on Wednesday about a new tactic to install ransomware.  There are generally two approaches to ransomware attacks, "napalm the earth" and what I call "high-interaction" ransomware attacks that involve some layer of victim communication.  Napalm the earth favors quantity over quality, where high-interaction employs some targeting, lures and direct communication with the victim. In short, the attackers have some preparation before the attack.

In this case, the attackers would cold call schools under the guise of being from the "Department of Education" and request the direct email address of the head teacher or head financial officer.  Sometimes it was to send testing guidance, others it was to send mental health assessment forms.  They would then send a zip file with a document file and, if opened, start the chain of infection to install ransomware.  So there are several interesting things going on.

The cold call is an attempt to claim legitimacy so the recipient is not only expecting an email but that the email is relevant to them and requires their attention.

The attack is targeted to those in the administrative level in a school, so odds are if there are access controls, those individuals probably have complete rights to everything. Even if they don't, they do have access to the most sensitive and valuable information.

Once infected, the victims would have to pay up to £8,000 to recover their files.

Their are some mistakes the attacker has made that might help the attentive listener (they say Department of Education when its the Department for Education in the UK) that indicate the attacker was likely not from the UK.  In high-interaction attacks, it is these subtle mistakes that provide the essential clues that something is not right. One of the most successful phishes I have seen by success rate was the infamous "fake subpoena" phish.  Even there, you can recognize the use of British English which would never be in US legal process.

Other key ransomware defenses would help here too: strong backups, updated endpoint protection and up-to-date patches.

In the end, the best defense is an attentive and security-conscious user.

--
John Bambenek
bambenek \at\ gmail /dot/ com
Fidelis Cybersecurity