![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Screenshot-2021-05-18-at-8.30.58-PM-813x1024.png\")
By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped.
\n\n\n\nWe’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first take you through what we’ve been saying about ransomware these last couple of months. I think it’ll help you understand where we’re coming from and why we recommend dealing with ransomware with a different mindset.
\n\n\n\nAs a company, we have been vocal about the threat of ransomware for a long time. We’ve seen it singularly wreak more havoc on organizations compared to any other single threat. So we decided to use our social platform to educate the infosec community about ransomware and how to defend against it.
\n\n\n\nHere’s us predicting the weaponisation of the Exchange vulnerabilities for ransomware ⏱
\n\n\n\n\n\n\n\nWe even launched a course focussed exclusively on ransomware 🎓
\n\n\n\n\n\n\n\nAnd then we said some more stuff about the impact of ransomware 🎯
\n\n\n\n\n\n\n\nWe even had a slide just about the consequences of ransomware 💣
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Smokescreen-Consequences-of-ransomware.png\")
And then we wrote a paper on how to defend against it 📝
\n\n\n\n\n\n\n\nAnd made it publically accessible 📖
\n\n\n\n\n\n\n\nAnd then we said this about DARKSIDE 👇🏼
\n\n\n\n\n\n\n\nLet me clarify something here – This is not a ‘I told you so’ post. We are not oracles predicting the future. We have been on this trajectory of ransomware making front page news for years now, starting with Wannacry.
\n\n\n\nBut it’s not all doom and gloom.
\n\n\n\nThe DARKSIDE ransomware did not do anything radically different that can catch the security community off-guard.
\n\n\n\nWe know how most ransomware operates. Download the paper here.
\n\n\n\nWe know what we must do to defend against it.
\n\n\n\nWe simply need to start doing it.
\n\n\n\nHere are three things:
\n\n\n\nWhen analyzing attacker tactics and techniques, ask “Why?”. When you ask “Why?”, it opens up new avenues for guerilla-warfare-style defenses to combat ransomware.
\n\n\n\nI’ve enumerated over 40 approaches in the paper on messing with ransomware. Use deception to disrupt what the ransomware is trying to achieve, rather than trying to stop the usage of a specific tool. It’s easy to setup, doesn’t generate too much data, and has a much faster time to value. This statement may look like a vendor marketing plug but it’s not. If you check out MITRE Shield, you will see that the adoption of deception is vital to active defense against a use case like Ransomware.
\n\n\n\nReduce reliance on detection in only one part of the network, for example, stacking all the controls on the endpoint. Notice how many EDRs are now talking about XDR? It’s likely because it’s impossible to stop threats meaningfully only in one part of your environment. You need defenses across your environment. Active Defense-based deception does this already.
\n\n\n\nIrrespective of how you choose to tackle ransomware, here’s the one advise I’ll leave you with 🙏🏼
\n\n\n\n\n","excerpt":"By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped. We’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first […]\n","slug":"the-bright-side-of-the-darkside-ransomware","date":"2021-05-18T16:01:29.000Z","status":"publish","modified":"2021-05-18T16:19:33.000Z","wordpress_id":18782,"featured_media":{"id":"6a62504d-2791-5a4b-ad8a-4d13b155ef9f","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Darkside-Ransomware.png","alt_text":"Smokescreen-Darkside-Ransomware","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACqklEQVQoz3WTvU9TURiHz72UQhTKrdzbW4EoUSwBtbQUKC2lYL+gUBFKKSDgB35C1Bi/aowmJhrjYGLUxcTBwcHBODg4uLkYYxyN0cF/wMXEhKgBuY+nxYFBh1/eM/1yznmeV1jW6jIg82v5/YsLy9dnKlev5gWFcdW6OCasQs7GsaFqIl6NBpeG7tRwav+PsCxKfS8fTjIVFCS9gkxAtQZ9ChMhheEOuyxzkug0CLTobK0z2GwauIx/R8g268ub+1Y+KKzjyXLr8pjNOrxHJdupWhGPYvU32wlscxBorqXPb+Bv1ql367h0HWN9ZFlxCmtliQ9PwtycVTg1VMaVMRuLKZWTMvt7VA5E7cwnmwi1NhAL6KTDDWzfYlLnNjFdLjbL6TbN0u2KU/z+/pnbBzdwqF+Q71EY71YYaFOJ7VYY8iuMyCcfTTcS3V1HZ7NGPt3O6HCCZCLOeDZLtLeXvZkM/X19dAQCiB9f33F+tIzFtMKl8XJm+1Rmogr5kHx2l8J0pIJMsIauFoPIrk0cmUowncswmZ9gIpcjI8visRhzc3Mk4nHEz2+feLCwkYdnqnhacHAipbAwaONaVqWQUbk8Uclgl5PQLjf7ovWcPZJiLhejNxKhJxwmHArh9/lKZe1+fxHKEs9ueMl3C+4cc3B3vpzH58q5NVvGtKSc8kkoHo3gTkOSNhnprafdU42zxoHD4aBGpqhLdVXVmjZFaT6+vsdMSHD3RCUXxso4mhRMyv8MNglJ2I53u0bbDr1EuUOq42mUMEwXLgmlCKYIxPx7/uvhCq8eTZVKU22CbLfK8QFF/qdgoN0ub6TR4zXweQwa6w0a3EVF1vmnr2lU8lBuCqVOfvH2+XkKuQoW0oLTGQkpK1gctjETrybYquGu1TBlauW2aP/ZlD8604JDURmM0wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/69585/Smokescreen-Darkside-Ransomware.png 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/497c6/Smokescreen-Darkside-Ransomware.png 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f3583/Smokescreen-Darkside-Ransomware.png 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/5707d/Smokescreen-Darkside-Ransomware.png 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/61e93/Smokescreen-Darkside-Ransomware.webp 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/1f5c5/Smokescreen-Darkside-Ransomware.webp 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/99238/Smokescreen-Darkside-Ransomware.webp 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7c22d/Smokescreen-Darkside-Ransomware.webp 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACXUlEQVQoz32S3UtTcRjHzzlagtNtZ+ecmRoYvpG6mnM7brbNuaa5F9+ma+YLlWkqpYFgodVN1h8QUVR0IV32D3QXSHSfBP4D3UYXQoQSO59+Mywi6eLL7+G5+PD8ns8jWVZhz4I9RLbfru9vTCmFh9MyaznZupeXuT9RxmjUTn2tA83pQHU4cNjt/0b0K2w2JEvQoMC719eYjkiMdMpkg4qV65KZjsn0B8rpMzUiXp1TtTo1bh1DPzpOAZUEzdrZemzlApK10FdqLV4osXIhheRZ2Yo2K4Sby/E2qES9BiFPEWpQZRi4j4jqdArgj10+bpqsjkjcyZayNlzCckphLqGQC8rMxFUGgg2YpzUGI9V4Gg2qxZS69vd0v4H7X7d5NHWc2YTEaEhmVEDibTJpv0zSK3G1V2Osux5/k0oqXM/48HnisW4GBwaI9/SQTqXoEW/A70dzuZB2P2+xnJFZGVJYzR5jMiozFS1OpzAmcilqI+JxEWpRGU/5mJkYJDs8xNTkJJl0mmQyST6fpycWw15ZifT9yyeeLJTxasXOy6UKFvsVbouvP8gprI+UMJ+pxGwx6DWrmL3YyfWJGJEuk1AwhBkI0OHzEQ6H8Xd0HEr5xubdVsa7JJ7ddPB0vpTnS6XcEntMehXOtdjwNetCik4mXEPMp1FtFE/FgUtVD/ZWBB3WRcvsvH/BXExiY7qEy3FZRCIjdhhslGlvsOFp0IRhg2CbTlOdQW21W0hw/7Ht/lUfAAsHdwgf3ixzRUDTHUWgwo2UMJyQSbSXEz6jYbbq1NXonDwhjP7nDn8CrvNYN+AFX20AAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/e7519/Smokescreen-Darkside-Ransomware.png 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7e7e9/Smokescreen-Darkside-Ransomware.png 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/e2e7f/Smokescreen-Darkside-Ransomware.png 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/db955/Smokescreen-Darkside-Ransomware.png 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/3a3bf/Smokescreen-Darkside-Ransomware.webp 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/975bf/Smokescreen-Darkside-Ransomware.webp 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/761da/Smokescreen-Darkside-Ransomware.webp 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/210c1/Smokescreen-Darkside-Ransomware.webp 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"26a6fa99-a7a6-5ae1-835e-ae5c2183236e","title":"Ransomware, the limits of prevention, and active defense","content":"\nWe’re almost halfway through 2021, and there seems to be a ransomware resurgence.
\n\n\n\nOr that’s what the headlines will have you believe.
\n\n\n\nOn the contrary, the opposite might be true.
\n\n\n\nAccording to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a ransomware attack in 2021 compared to 51% in 2020.
\n\n\n\nSo why does it feel like ransomware attacks have gone through the roof? The answer emerges when you look at the victims – high-profile targets.
\n\n\n\nHere are some headlines from the last couple of months:
\n\n\n\nIreland’s Health Services hit with $20 million ransomware demand
\n\n\n\nThe Conti ransomware gang attacked Ireland’s publicly funded healthcare system. The Irish Health Service had to shut down all of its IT systems. The attack disrupted COVID-19 testing, crippled diagnostic services, and forced hospitals to cancel appointments.
\n\n\n\nRansomware attack leads to shutdown of major U.S. pipeline system
\n\n\n\nColonial Pipeline, one of the biggest fuel pipeline operators in the US, had to shut down its entire network following an attack by the DarkSide ransomware group. The attack resulted in gas price increases, panic buying, and supply shortages. The company paid a 75 bitcoin ransom which was worth $5 million when we wrote this.
\n\n\n\nAxa division in Asia hit by ransomware cyber attack
\n\n\n\nOne of Axa’s businesses in Asia got hit by Avaddon ransomware. 3TB of sensitive data was stolen, including customer medical reports (exposing their sexual health diagnosis), copies of ID cards, bank account statements, claim forms, payment records, contracts, and more. The attack impacted IT operations in Thailand, Malaysia, Hong Kong, and the Philippines.
\n\n\n\nToshiba subsidiary confirms ransomware attack
\n\n\n\nA European subsidiary of Toshiba was the victim of a ransomware attack. Sources inside the company believe DarkSide is behind it, but there was no confirmation when this post was published. 740 GB of data, including passports and other PII, was stolen. The company had to sever network connections between Japan and Europe to stop the spread of ransomware.
\n\n\n\nUS cyber insurance major CNA Financial hit with ransomware
\n\n\n\nOne of the biggest players in the cyber insurance space (yeah, we see the irony) suffered a ransomware attack that affected operations for three days. The company was forced to shut down parts of the network to limit the spread and contain the damage. Although the company did not disclose if data was stolen, it’s a pretty big deal. A compromise could potentially help adversaries determine which companies had applied for or acquired cyber insurance, the scope of coverage, and the limits of deductibles.
\n\n\n\nAcer hit with $50 million ransomware demand
\n\n\n\nRansomware operation REvil breached computer giant Acer resulting in the largest known ransomware demand. Images leaked by the ransomware operators revealed that they had access to some of the company’s financial spreadsheets, bank balances, and bank communication.
\n\n\n\nRansomware gangs are now going after meaty targets. After all, why rob a person when you can rob a bank where everyone keeps their money?
\n\n\n\nIt’s no surprise then that the financial impact of ransomware has more than doubled from US$761,106 in 2020 to US$1.85 million in 2021.
\n\n\n\nAccording to Coveware, ransomware demands are up 43% so far in 2021.
\n\n\n\nSo aside from being meaty targets, what else is common between ransomware victims these days? They all make significant investments in cybersecurity.
\n\n\n\nLook at the scale of these companies. They have large security teams, a bevy of infosec consultants at their disposal, and all the cool tools to defend – endpoint detection and response, DLPs, SIEMs, cloud SIEMs, SIEMs that are also UEBA. You get the drift.
\n\n\n\nDifferent folks will give different answers to these questions. Media outlets will not move beyond the sensational headlines, consultants will say there aren’t enough skilled folks in the company, EDRs will say there’s not enough endpoint coverage, SIEMs will say data ingestion from critical segments might be missing, the OT folks will say it’s hard to defend non-IT assets, deception vendors will say there are no decoys/honeypots!
\n\n\n\nEssentially, anyone who has a horse in the race is going to give one-dimensional answers.
\n\n\n\nHere’s the thing though; the companies that suffer these breaches are pretty good at cybersecurity. More often than not, they operate at the cutting edge.
\n\n\n\nThe answer to why they get hit by ransomware is more nuanced. It’s because there are limits to prevention.
\n\n\n\nIf you happen to be one of the most frequently targeted companies, it’s only a matter of time before you’ll get breached despite having the best preventive controls in place.
\n\n\n\nWhy? Because anything preventive assumes the threat to be static. With ransomware, the threat is evolving. The boring bits of ransomware have been automated, there are dedicated ransomware services (REvil allegedly made $100 million in 2020), and there are human adversaries behind the ransomware that are constantly cooking up new and novel ways of compromising their targets.
\n\n\n\nFurther, most solutions to security problems take a siloed approach. Want to defend endpoints? Cover them with an EDR. More visibility? NTA. Malicious behavior? UEBA. Ransomware doesn’t discriminate. It doesn’t just go after your endpoint or server zone. Once it gets in, it just goes after everything.
\n\n\n\nPrevention doesn’t always work because ransomware is a moving target.
\n\n\n\nBusinesses need a different approach for dealing with it – Active defense.
\n\n\n\nRansomware is capable of interacting with all parts of your IT environment. Focussing your efforts on just one part of it will have diminishing returns. Dealing with something like ransomware demands a holistic approach. Your strategy needs to cover critical areas of the environment to be effective.
\n\n\n\n‘Active Defense‘ helps you do that. The approach is use case-driven and balanced in its outcome. You can pick the use case (in this instance, ransomware) and focus on where you want to be most effective (e.g. DMZ, Active Directory, critical server segments, privileged user accounts, privileges workstations, etc.)
\n\n\n\nWhat we’re recommending isn’t something experimental. Forward-thinking security teams are building dedicated deception-based active defense programs, in some cases around specific risks like ransomware.
\n\n\n\nWe have an insurance customer that has done this. They already had a firewall, network segmentation, anti-virus, EDR, and SIEM when they deployed Smokescreen. They were concerned about ransomware (rightly so).
\n\n\n\nThe idea of planting decoy file shares in key segments was adopted as the primary strategy to detect ransomware in the lateral movement phase. In the event of a detection, the organization’s internal incident response process would kick in.
\n\n\n\nThe goal was to detect ransomware spreading on the network, quickly understand the nature of ransomware, and allow established incident response processes to contain the threat.
\n\n\n\nThe security team planted network decoys in the DMZ and DC. The hypothesis behind this decision was that assets in the DMZ were at a high risk of infection and lateral movement activity would likely be recorded in those segments.
\n\n\n\nThe decoys themselves were projecting a diverse set of network services ranging from decoy SMB file shares to FTP servers to SSH servers and decoy applications.
\n\n\n\nSure enough, the company was hit by a ransomware attack. The incident started a little after midnight and a minute later, Smokescreen had raised a detection. Smokescreen was the first security control to raise an alarm.
\n\n\n\nInvestigation revealed that all decoys masquerading as file shares had been encrypted within the DMZ segment. The decoy files hosted on these file shares had been encrypted and renamed, which allowed for easy identification of the ransomware strain.
\n\n\n\nRoot cause analysis further revealed that the lateral movement phase of the ransomware attack was detected by Smokescreen less than a minute after it began encrypting assets.
\n\n\n\nWhy do you think the security team at this insurance company was able to avert a ransomware breach? Sure they had our active defense solution, but more importantly, they had the foresight to think what an attacker would possibly do and then build defenses that would intercept those attacks.
\n\n\n\nThat’s Active Defense in action.
\n\n\n\nBuilding a dedicated defense strategy around ransomware is a worthy goal to have in 2021.
\n\n\n\nRansomware is industry-agnostic and affects all parts of your network. Today, it is the one singular threat that can completely disrupt operations and bring business to a grinding halt.
\n\n\n\nHaving the ability to detect ransomware early in the attack lifecycle can be instrumental in limiting its spread and impact.
\n\n\n\nActive defense gives you the ability to do this without investing in expensive tooling, adding headcount, or making changes to your network.
\n\n\n\nWe’re going to leave you with a playbook of active defense strategies that can help you detect over 40 ransomware techniques.
\n\n\n\nPlaybook – The Top 40 Ransomware Techniques and How to Mess With Them
\n\n\n\nRemember, you don’t have to implement everything. But implementing even some of it can help you control and reduce the attack surface available to ransomware.
\n\n\n\n\n","excerpt":"We’re almost halfway through 2021, and there seems to be a ransomware resurgence. Or that’s what the headlines will have you believe. On the contrary, the opposite might be true. According to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a […]\n","slug":"ransomware-the-limits-of-prevention-and-active-defense","date":"2021-05-17T12:15:38.000Z","status":"publish","modified":"2021-05-18T16:18:54.000Z","wordpress_id":18779,"featured_media":{"id":"8fcb1a39-fe2c-5560-b945-364105ce2807","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Ransomware-Defense.png","alt_text":"Smokescreen Ransomware Defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.7699115044247788,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/69585/Smokescreen-Ransomware-Defense.png 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/497c6/Smokescreen-Ransomware-Defense.png 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/f3583/Smokescreen-Ransomware-Defense.png 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/5707d/Smokescreen-Ransomware-Defense.png 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/61e93/Smokescreen-Ransomware-Defense.webp 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/1f5c5/Smokescreen-Ransomware-Defense.webp 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/99238/Smokescreen-Ransomware-Defense.webp 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7c22d/Smokescreen-Ransomware-Defense.webp 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.765625,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/e7519/Smokescreen-Ransomware-Defense.png 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7e7e9/Smokescreen-Ransomware-Defense.png 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/e2e7f/Smokescreen-Ransomware-Defense.png 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/db955/Smokescreen-Ransomware-Defense.png 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/3a3bf/Smokescreen-Ransomware-Defense.webp 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/975bf/Smokescreen-Ransomware-Defense.webp 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/761da/Smokescreen-Ransomware-Defense.webp 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/210c1/Smokescreen-Ransomware-Defense.webp 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"34627d50-53e7-5dda-bb36-6ab2c0cf489d","name":"Amir Moin"}}}]}},"pageContext":{"id":"42c58128-6ae0-5f09-a5e3-2aa2be334f8b"}},"staticQueryHashes":["1478079672"]}