По всему миру активизировался Троян шифровальщик WanaCryptor. Он использует уязвимости в SMB для распространения. Говорят накрыло МВД в РФ и задело много других компаний. Если нужна помощь - пишите.
Дальше идут рекомендации от нашей Incident Response Team: Check Point offers the following protections for WanaCryptor
1. Anti-Bot/Anti Virus on endpoint with Sand Blast Agent and Anti-Bot/Anti Virus on Security Gateway
2. Anti-Ransomware on endpoint with Sand Blast Agent
3. Windows machines should be patched for vulnerabilities discussed in Microsoft Security Bulletin MS17-010 - Critical Security Update for Microsoft Windows SMB Server (4013389)
https://technet.microsoft.com/en-us/library/security/ms17-010.aspx .
4. Depending on the network architecture, the following IPS protections may be deployed to mitigate the worming properties of this attack.
Microsoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0143)
https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0177.htmlMicrosoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0144)
https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0198.htmlMicrosoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0145)
https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0200.htmlMicrosoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0146)
https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0203.htmlMicrosoft Windows SMB Information Disclosure (MS17-010: CVE-2017-0147)
https://www.checkpoint.com/defense/advisories/public/2017/cpai-2017-0205.htmlThe Check Point Incident Response Team is monitoring the situation closely and is available to assist customers.
