CATO Networks

JUNE 29, 2017

Like WannaCry, NotPetya leverages the SMB protocol to move laterally across the network, an EternalBlue exploit attributed to the National Security Agency (NSA) and leaked by the Shadow Brokers hacking group last April. The machine is then forced to reboot, encrypting the files and locking the computer. A total of 3.8

SMB 52

SMB Cloud Encryption Email 52

CATO Networks

FEBRUARY 16, 2023

Double Extortion: Double extortion ransomware both steals and encrypts sensitive and valuable data on an infected system. Lateral Movement: Ransomware rarely immediately lands on a device containing the high-value data that it plans to encrypt. This model increased the number of companies infected with high-quality ransomware.

SASE 52

SASE Encryption SMB Email 52

CATO Networks

DECEMBER 16, 2024

Executive Summary Modern ransomware attacks have evolved beyond simple encryption to deploy sophisticated double extortion tactics. Threat actors now systematically exfiltrate sensitive data before encrypting systems, ensuring leverage even when victims have robust data backups. GreenCollector tool (identified as fs256.exe)

SMB 40

SMB IP Address SASE Protocol 40