The threat of ransomware was at the core of a recent FBI alert, Department of Homeland Security letter to a Senate committee and reported attack on an e-commerce company.
Ransomware infects computers through phishing attacks, malicious links or downloads. Once installed, the malware automatically encrypts documents and other data. To decrypt their data, victims must pay a ransom, generally anywhere between $200 and $10,000, usually via Bitcoin or other cryptocurrency.
This week, the FBI released an alert seeking help from businesses and security experts for emergency assistance in a ransomware investigation. The ransomware virus is a new strain called MSIL/Samas.A.
FBI investigators, who first reported the incident Feb. 18, determined malicious hackers deployed the ransomware. The ransomware strain targeted out-of-date versions of business software called JBOSS. The alert stated the newly discovered ransomware sought to encrypt data on whole networks. Ransomware usually targets individual computers, rather than entire networks.
Last week, the Senate Homeland Security and Governmental Affairs Committee received letters from the DHS and Department of Justice in response to questions about ransomware posed by the committee last December.
DHS told the committee that since June 2015, 321 ransomware incidents were reported by 29 different agencies. Some attempted assaults were unsuccessful, according to the response, with its Einstein program stopping many.
The FBI's Internet Crime Complaint Center reported individuals filed 7,694 ransomware complaints since 2005, with losses totaling about $58 million, according to a response from the Department of Justice addressing the same senate committee.
"Once ransomware is on a victim's computer, the only way to defeat the encryption of a ransomware variant is to obtain the actual decryption keys used by the actors operating the ransomware," the response said. "Ransomware variants like CryptoLocker and CryptoWall target victims all over the world."
In February, DHS Secretary Jeh Johnson defended DHS' Einstein program following a critical Government Accessibility Office report that claimed the program depended on dated technology and was not meeting expectations. Its newest phase, Einstein 3A, successfully blocked many attacks and defended the majority of the government, Johnson said.
"Einstein capabilities are equally effective at detecting and blocking ransomware attacks as with any other type of known malware," Johnson said.
DHS told the Senate Homeland Security Committee that when ransomware did infect a federal agency-owned computer, it removed the malware from the network and replaced it with a new, clean system with minimal impact to the user and agency. No agency ever paid a ransom.
The actors behind the most sophisticated ransomware schemes are reportedly business oriented and want to make it known that if victims pay the ransom, they will provide the private key needed to decrypt the files.
New ransomware called KimcilWare is currently targeting websites running the Magento e-commerce platform used by companies such as Vizio, Olympus and Nike, according to security experts from the MalwareHunterTeam. Hackers exploited vulnerabilities in the Magento e-commerce platform and installed the KimcilWare ransomware on the webserver.
According to the MalwareHunterTeam, once installed, attackers use Rijndael block ciphers to encrypt website files and demand Bitcoin payment ranging from $140 to $415 for decryption.
Magento, used by more than 200,000 companies according its website, offers e-commerce solutions including backend order management, online retail solutions and community tools.
In a statement to Threatpost, Magento said it believed attackers are not singling out Magento and that attacks are targeting "more general webserver vulnerabilities."
"While there are reports circulating about ransomware focused on Magento shops, we do not believe that there is a new attack vector, nor do we believe that this issue is specific to Magento," the statement read.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Roy Urrico
Roy W. Urrico specializes in articles about financial technology and services for Credit Union Times, as well as ghostwriting, copywriting, and case studies. Also: writer/editor of a semi-annual newsletter for Association for Financial Technology since 1997 and history projects funded by the U.S Interior Department, National Park Service and Warren County (N.Y.).
