Recovery of files affected by OldGremlin Ransomware

Preventing a OldGremlin ransomware attack requires a comprehensive cybersecurity framework, but that’s not all, let’s list some important points that you need to pay attention to.

• Organisation – Having documentation of the IT park helps a lot in the prevention process, in addition to the inventory of networks and computers. Develop rules so that new employees have clear company policy on the installation and use of programmes on computers.
• Strong Passwords – Passwords should be strong, containing more than 8 digits, including special ones. And do not use a single password for multiple credentials.
• Security Solutions – Have a good antivirus installed, keep all programmes up to date, especially the operating system. Besides the antivirus solution, you need a Firewall and endpoints. They will make sure that the system stays protected.
• Beware of suspicious emails – One of the most used means for invasion used by hacker groups are spam email campaigns, so it is vital to create a security and awareness policy for employees not to download attached files sent by unknown emails.
• Efficient backup policies – Backups are essential for any eventual incident, but even with this essential role many companies neglect it or create a backup schedule that is not effective. We have already assisted several clients that not only the data was encrypted, but also the backups. It is not recommended to keep online backups only. The best backup structure is 3x2x1, which is 3 backups, 2 online and 1 offline, in addition to creating a consistent routine of updating the backups.
• Beware of unofficial programmes – There are numerous paid programmes that are made available for free on the Internet, such as Windows, Office and many others. They may appear to be free at first, but in the future can be used as a gateway for future hacker attacks. Even if official programmes demand financial resources, they are a good investment and are also secure.

Hackers use a variety of methods to infiltrate a victim’s system, including downloading infected files, malicious links, RDP attacks, phishing, and spam emails. Their goal is to gain access to the system undetected, and to achieve this, the OldGremlin ransomware is often disguised to evade detection by security systems.

When it comes to tactics that rely on user action, hackers employ phishing techniques to trick unsuspecting victims into downloading OldGremlin ransomware onto their systems without realising it.

High consumption of processing, memory and disk access are suspicious behaviours that need to be investigated thoroughly in order to assess whether an attack is underway.

The OldGremlin ransomware uses the machine’s own resources to perform exfiltration. In order to encrypt the machine this demands the use of its own resources.

It is also possible to detect the attack by the changes made to the file extensions, this type of detection is a bit more complex because the encryption process will have already been started.

If your machine is affected by OldGremlin ransomware, your data will be inaccessible until the encryption is removed. Unfortunately, removing the encryption typically requires formatting the affected machine, which will result in the loss of all stored data.

However, some ransomware attackers also use the double extortion tactic, which involves copying and extracting all files from the affected machine and then encrypting the original data. In such cases, the attackers may post the stolen files on their website or Dark Web forums while keeping the original data encrypted on the affected machine. In such scenarios, formatting the device will not recover the original data, and the only way to retrieve the stolen files may be to pay the ransom or seek professional help.