SamSam
Malware
Also known as MSIL/Samas.A. Specifically, this product shares analysis of vulnerabilities that cyber actors exploited to deploy this ransomware. In addition, this report provides recommendations for prevention and mitigation.
The SamSam actors targeted multiple industries, including some within critical infrastructure. Victims were located predominately in the United States, but also internationally. Network-wide infections against organizations are far more likely to garner large ransom payments than infections of individual systems. Organizations that provide essential functions have a critical need to resume operations quickly and are more likely to pay larger ransoms.
Incidents Caused by this Malware
- July 12, 2018: Bay & Bay, a MN medium-sized Trucking Company, Pays “Five-Figure” Ransom
- March 22, 2018: Ransomware Attack Shuts Down City of Atlanta, GA,
- February 21, 2018: SamSam Ransomware Takes Down Colorado DOT
Threat Actors Known to use this Malware
No threat actors identified