Companies across the globe struck by another major ransomware outbreak
Companies across the globe have been struck by a second major ransomware attack in as many months. The malware responsible closely resembles Petya, but Kaspersky Lab says that it is “a new ransomware that has not been seen before”. As a result, many security researchers have dubbed it NotPetya.
So far, NotPetya has infected firms across the world, including advertising firm WPP, food company Mondelez, legal firm DLP Piper, and Danish shipping and transport firm Maersk. Ukraine appears to be the hardest hit country, with banks, power companies and Kiev’s main airport all being hit.

What is Petya/NotPetya?

Petya is a family of encrypting ransomware that was first discovered in 2016. The malware targets Windows operating systems, infecting the master boot record to execute a payload that encrypts the NTFS file table, and demanding a bitcoin payment in order to regain access to the system.
Variants of Petya were identified in May last year, and propagated via infected email attachments. The NotPetya variant first appeared on 27 June this year, and takes advantage of the same Microsoft Windows vulnerability that was exploited by WannaCry.

How does it differ from WannaCry?

As with WannaCry, NotPetya has a wormable component that allows it to spread laterally around connected networks. However, its method differs from WannaCry in a number of ways. It uses a payload that infects the computer’s master boot record, overwriting the Windows bootloader, which then triggers a restart. When the computer reboots, the payload is executed – it encrypts the master file table (MFT) of the NTFS file system, and then displays the ransomware message. While this is happening, a simulation of the output of CHKDSK, the Windows file system scanner, is displayed on-screen, suggesting that the hard drive is actually being repaired.
According to Nick Bilogorskiy, senior director of threat operations at Cyphort, NotPetya also differs from WannaCry in that:
  • NotPetya is initially distributed over email – specifically, a malicious link sent from an unknown address.
  • NotPetya does not try to encrypt individual files. Instead, it encrypts the master file table.
  • It has a fake Microsoft digital signature appended, copied from Sysinternals.
  • NotPetya also appears to be able to spread laterally using Windows Management Instrumentation (WMI).
  • Some payloads include a variant of Loki Bot, a piece of malware designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from web browsers, and a variety of cryptocurrency wallets.

Who is being targeted?

The short answer is ‘everyone’, from individuals to organisations. However, companies with valuable assets and a public reputation to protect represent high-value targets, often attracting the most sophisticated attacks.

How to protect yourself

There are a number of steps you can take to reduce the chances of falling victim:
  • If you use Windows, install the patch Microsoft released to block the vulnerability that both WannaCry and NotPetya exploit.
  • Update your antivirus software definitions. Most antivirus vendors have now added a detection capability to block WannaCry.
  • Back up regularly, and make sure you have offline backups. That way, if you are infected by ransomware, your backups won’t be encrypted.
  • Organisations should also be monitoring their logs closely for suspicious activity across firewalls and antivirus software.

What should you do if you’re infected?

NotPetya infects computers and then waits about an hour before rebooting the machine. While the machine is rebooting, you can switch the computer off to prevent the files from being encrypted, and then try to rescue the files from the machine.
If the system reboots with a ransom note, don’t pay the ransom. We always give this advice in the event of a ransomware infection, and in this case the criminal’s ‘customer service’ email address has been shut down, so there’s no way to get the decryption key anyway.
Instead, you should disconnect your computer from the Internet, reformat the hard drive, and reinstall your files from a backup.

Protect yourself

IT Governance offers a range of solutions to help prevent you from falling victim to ransomware attacks and to enable you to implement the best possible security solutions for your budget and requirements.
A full list of the services we offer to help you combat the threat of ransomware can be found on our dedicated information page.
Criminal hackers targeting UK private schools
A report from The Telegraph has revealed that criminal hackers are targeting UK private schools with poor online security. Parents are warned to be on high alert as a new term commences and invoices are issued. Cyber criminals are able to exploit vulnerabilities within schools’ IT systems, “which are often unsecure”, and are free to launch phishing campaigns.
Neil Hare-Brown of Cyber|Decider said that, in the last few months, he had investigated incidents at six private schools where insurance claims had been filed.
The phishing attack impersonates the school and advises unbeknown parents that payment information has been updated. Those parents who question the changes by replying to the email are actually replying to the cyber criminals, who of course reassure them that the changes are legitimate. If in doubt, rather than replying to an email, it is advisable to call the organisation – the school in this case – directly to confirm.
Mr Hare-Brown continued by saying that there had been an uptick in the number of schools being targeted as cyber criminals have caught on to the scam.
Private schools in particular are a favoured target because they’re considered to be a lucrative market where parents are likely to have higher disposable incomes.
Ryan Wilk, vice president at NuData Security, said:
This warning should make private schools sit up and take notice of the threat cybercrime and fraud present, and the damage this kind of scam could do to their reputation.
Phishing attacks are increasing in volume and severity, so it’s important to remain vigilant and increase awareness. Cyber criminals are one step ahead and their tactics are constantly changing in order to remain undetected. Phishing scams are common within the education sector in general because of the amount of personal data that they store.

I think we can all agree that it is ethically suspect to lie about the size, location, or even existence of your house. Or steal other people's photos. Or solicit freebies without offering anything in return. And yet, I have to admit that I've done all these things. I have done things that would make even the most social-media-addicted teenager blush. I have bought followers and requested likes. I have hashtagged communities to which I do not belong. (What's up, #cleaneating!?) I have copied snapshots from other people's Instagram accounts and then painstakingly cropped out the attribution tag before posting them to my own feed. I have shared pictures from my vacation to Italy.
I have never been to Italy.
My name is @bougie_means_candle. And I'm an Instagram influencer.
#sortof.
#notreally.
If your company sells anything at all to the public, you’ve heard about Instagram influencers -- the hottest topic in advertising since, well, advertisements. As social media has begun supplanting TV, newspapers and magazines as a primary entertainment source, companies have been forced to seek new ways of getting their products in front of the eyeballs of the coveted youth demographic. Businesses can, of course, just buy ads that Instagram slips into the streams of its users’ photo feeds. But younger consumers are alarmingly adept at ignoring those. The ideal solution would be to infiltrate those streams not with ads but with the familiar, trusted voices of friends -- who are also, as it happens, pushing the exact message you, the entrepreneur, want pushed. 
So, naturally, there has become such a thing as an Instagram influencer. A person, usually young and attractive, who creates a rich social media fantasy life, into which they will happily slip a glowing reference to your product in exchange for free stuff or a small fee. This allows you, as a business owner, to create an ad without hiring models or photographers. It also allows your potential customers to see your product not in the harsh light of some studio but in situ, in the glamorous life of an actual person. 
Everyone wins! 
Except: Unlike advertising agencies or legacy media outlets, influencers often have no bona fides beyond an attractive online persona and a large number of followers. There are few established norms for interacting with influencers, and little scaffolding set up to prevent, say, someone from sending you an invoice for services rendered after you’ve already sent them free candles. 
“I would say we get about five or six requests a week,” says Natalie Markoff, founder of the Markoff Group, a PR agency that represents about a dozen small, luxury retailers. Most of the publicity requests Markoff receives start off easygoing, she says. “They will say, you know, ‘I have an Instagram account. I’m an influencer. I love your product; could you send me some?’ And then about three or four emails in, after I’ve already sent them product, they’ll send me a rate card.”
Shamelessness isn’t the only pitfall. Outright fraud is also fairly common: ads so bogus that the FTC recently threatened to slap folks with lawsuits; fake followers; fake lighting; ludicrous requests for money and products and stuff, stuff, stuff. “Anytime you have that kind of money flowing into a platform this quickly, it’s a gold rush,” says Evan Asano, CEO and founder of Mediakix, a social media marketing agency. And like any gold rush, it tempts both decent folks and derelicts.
That’s not to say you should write off this burgeoning corner of the ad economy as a scam, however. Instagram, for all its faults, is enormously influential. As of September 2017, the site had 800 million users, 80 percent of whom follow a business, and more than 60 percent of whom say they discover new products on Instagram. As for the influencer market, according to a recent estimate by Mediakix, it was worth $1 billion in 2017 and could double over the next several years. That’s billions of dollars companies will likely be spending on entrepreneurial one-man-band social media “stars” in the hopes that it will benefit their bottom line. 
But does paying influencers result in actual sales? And if a photogenic, doe-eyed 22-year-old approaches you and asks to represent your handbags/coats/sweaters/hotel/restaurant on Instagram, will you wind up getting ripped off? To get answers to these questions, I decided to go undercover and infiltrate the Instagram economy. I called some successful influencers, created a fake design-guru persona, bought a bunch of fake followers, solicited some free product and, well, started influencing. Here’s what I learned.
Michelle Williams is one of the good influencers. A former art director, she runs the blog-­Instagram complex Coffee and Champagne, which has 116,000 followers. It’s clear why she has been successful at this. Pleasant and forthcoming, she posts compelling snapshots of oozy, melty sandwiches, ice cream cones as frilly as antebellum dresses and her own tan, dark-haired visage looking pensively out the windows of various cafés. A full-time freelancer, Williams makes about half her money from her blog and the other half from Instagram, much of it by partnering with food companies to create and shoot new recipes. She’s what you’d get if a magician turned Saveur magazine into a person. 
When I told Williams I intended to fake my way into the Instagram economy, she told me it’s much more difficult to break in than it was in the good old days of 2014. Back then, you could just take pretty photos of food and add them to a photo gallery. Today, with so many people trying to quit their day jobs and turn influencer, you have to have a good schtick to stand out. 
“I tell people to come up with their own visual technique,” she says. There are accounts that post only pink photos, for example, or post clothing always shown against a one-color background. One influencer Williams likes got popular by taking photos of food from a bird’s-eye perspective, so followers can see both the plate and the account owner’s shoes. In the parlance of the Instagram economy, your schtick is your “aesthetic,” and as a business owner, the idea is to work with influencers whose aesthetic matches your idea of your brand. 
“If you look at the creatives that are getting a lot of ‘gigs,’ as we call them, some of our highest-performing ones are professional photographers,” says Aana Wherry, director of marketing, communications and creator experience for Popular Pays, a site that acts as a sort of matchmaking service for brands and influencers. “We have tags with which we filter our creators, whether it’s men’s fashion or food or different categories of content or audience.”
You can think of influencers as mini magazines; you want to place your ads only in those whose look fits your brand and appeals to your demo.
For my aesthetic, I decided on an interior design feed that would consist mostly of candles. Why? Because it’s specific, it’s an underserved niche and I like free candles. To start, I bought a few chichi candles, arranging them around my one-bedroom apartment to create desirable vignettes. My plan was to create a barely believable feed of luxe candles displayed in the various rooms of a fictitious house on the beach. I would ask small businesses to send me free candles to place in future photos. And then I would just see what happened.
This strategy proved unsustainable. I ran out of content very, very quickly. One thing they never tell you about being an Instagram influencer is you need a ton of content. Williams posts one or two photos a day, plus material for Stories, the live A/V feed of an influencer’s daily grind that was added to Instagram in 2016 to mimic Snapchat. 
So, this being the internet, I stole. I started out just reblogging other people’s candle photos, with attribution, but before long, I started cropping out the original posters’ identifying details and uploading their photos as my own. I added layers and layers of hashtags to everything (#zenlife, #beachstyle, #instadecor) to try to get like-minded accounts to repost my photos. None of it had the desired effect. My most popular post got 26 likes.
Growing an audience quickly became a monstrous task. This, it turns out, is most of what you’re paying for when you hire an Instagram influencer: the engaged and receptive audience that has grown to trust them. “It’s not easy to get that many followers and keep them engaged and appeal to their interests,” says Wherry. “These creators are experts at it.” In short, it’s not as easy to go viral on Instagram as it is on, say, Twitter, where one brilliantly timed joke can launch your account into the stratosphere. Building a huge audience on Instagram can take years.
Patrick Janelle, @aguynamedpatrick, built up his 458,000 followers over several years, first while working as a graphic designer at Bon Appétit, which reblogged his photos and then by being consistently engaged -- making friends and liking other people’s posts. “I have a number of people who have been following me for a long time, whom I have conversations with and whom I’ve never met in person but are constantly sending me notes, even leaving me a comment or sending me a direct message about something I’ve posted,” he says. “I don’t know that I can necessarily describe how to do it. It changes constantly.”
Of course, I didn’t have Bon Appétit to reblog my posts, or years to build a devoted following, so in keeping with my utterly underhanded business plan, I contacted a company that would allow me to simply pay people to like me. As it happens, there is a surprisingly large group of such companies, all with varying degrees of legitimacy, which have sprung up around the Instagram community like brothels around a gushing oil derrick. Some of them have names that sound relatively benign, such as Social Envy, Hypez and InstaBoostGram. Others, such as a company called Buy Instagram Followers, don’t bother trying to hide what it is they offer. I chose one called Buzzoid, which sells tiered packages of “quality” followers, topping out at 5,000 followers for $39.99, and emailed for details.
The response came from the “product owner” of Buzzoid, a man named Michael, no last name, who once signed his email both “Michael” and “Paul.” Astonishingly, when I asked, Michael-Paul agreed to help me out for free -- offering 5,000 followers as well as any likes I needed for several weeks on a trial basis in exchange for this coverage you’re reading right now in Entrepreneur (in what I’m calling the Inception of Instagram influencing). He balked, however, at answering any questions about his business model, writing only, “We do in fact provide real likes and followers to our customers. Which is why you will often see a drop in users if your account is not interesting or has poor material.”
Well, then.
Fake or not, hours after Michael-Paul bestowed my followers upon me, I could feel internet stardom suffuse my online life. I went on a friending spree down an acquaintance’s followers list, randomly friending 250 of them. Convinced by my bank of 5,000 prepaid devotees, more than 50 of these real people followed me back. I began to get actual likes on the photos I hashtagged. It was working. 
I had followers, momentum and a schtick. I was almost ready to start reaching out to companies. All I needed was to fill out my backstory. Michael-Paul had agreed to provide me with likes in addition to my followers, but I couldn’t ask him to do it five times a day. Plus, I had only about 25 posts. If anyone scrolled far enough down, my feed would disappear into the ether. So I went on a fake vacation. I searched for beautiful scenes from Positano, Italy (a place I’ve always wanted to visit), and then cribbed them from other users, posting them with captions such as “Finally made it to #positano. Can’t wait to sit on the terrace and have the meal of my life. #amalficoast #wanderlust #travel #dreamtrip #bucketlist #timeflieswhenyourehavingfun.” 
I asked Michael-Paul to scatter around enough likes to make the vacation seem realistic and hoped the brand managers I contacted would quit scrolling before they found anything peculiar. Then I sent out an email blast to four candle companies, requesting product for an upcoming shoot.
There is no way anyone will believe this is real, I thought. It’s absurd, ridiculous, completely transparent.
And then the offers started rolling in. 
In 2017, Evan Asano of Mediakix ran an experiment. Hoping to highlight Instagram’s vulnerability to fraudsters, he and his staff created two influencers who were utterly unreal: @wanderingggirl, a world traveler whose snapshots were free samples from a stock photo site, and @calibeachgirl310, a lifestyle account they’d shot with a model in a single day. Posting as these faux humans, Mediakix solicited business on influencer platforms, which are websites -- such as Popular Pays and TapInfluence -- where businesses can find influencers to work with.
The scam worked. Mediakix got four offers of money and gifts from brands before they halted the experiment. 
What can business owners learn from their experience?
“There isn’t a single, simple way to identify whether somebody has bought paid followers,” Asano says. But a high follower count is a good start. Influencers who get caught up in the fake-follower game fall apart as they get bigger. “If you have a half million or a million followers, and you need to buy some engagement on every single photo, that starts to get expensive after a while, and that’s when it starts to crack,” Asano says. Influencers need to maintain engagement as a percentage of their followers -- if they buy too many, the number of likes and views on each of their posts will be much too low, which will become obvious to companies. Another way to catch those who buy followers is to use internet metric sites such as Socialblade, which charts Instagram users’ growth history. “If there’s some huge crazy spike, it may be because they’ve purchased followers,” says Asano.
The best way to protect yourself from scammers may be to become Instagram fluent yourself. Follow people who do what your business does. Follow the people they follow. And approach influencers you’d like to work with, rather than the other way around. That’s what worked for James Tune, co-owner of the New York City bar Boilermaker, who approached @GothamBurgerSocialClub, an account with 154,000 followers, and @Devourpower, an account with 485,000 followers, and asked them to shoot his bar’s burgers. Tune gave the influencers a free burger and got tons more followers for his Instagram page. “Anytime I introduce a new food item, I ask Devourpower to come in,” he says. “My last post through them had about 45,000 likes. I’d say it was super successful.” 
You can also let someone else do the hard work. Some influencer-matching platforms, including the aforementioned Popular Pays, include Yelp-like star and comment-based rating systems so that brands have some idea of whom they’re hiring. Or you can partner with a full-­service marketing agency such as Socialyte, which will help your company develop a complete influencer marketing strategy and can match your business with a roster of fully vetted (read: real) influencers. 
If you do choose to work with one of these agencies, though, you should know how much all this costs. “A lot,” says Beca Alexander, president of Socialyte. “The average post is based on the influencer and what the product is -- how big a following they have, how consistent their content is and how in demand they are. But at the end of the day, we’re talking thousands, hundreds of thousands, millions for some of our influencers.” And in return? Your sales might skyrocket, or they might not. Instagram is tremendous at creating desire, but it’s very poor at leading people directly to sales links. Though the company did start allowing verified users to add hyperlinks to Stories in 2016, posts and comments are still unclickable and the hoi polloi can’t put hyperlinks anywhere but on their bio page. The thinking is, if you make people want your product enough, they’ll find a way to buy.
By avoiding formal influencer channels and contacting companies directly, I reduced the amount of scrutiny on my account enough to fool several people. The most expensive candle company on my list, Byredo, didn’t respond at all, but the other three got back to me within days. In fact, the first company to respond, the L.A.-based, all-natural candle and home-­fragrance brand Lite + Cycle, got back to me within hours. Kristi Head, Lite + Cycle’s owner, thanked me for reaching out but then disappeared. When I followed up, she offered me a 30 percent off discount code instead of free candles. As it turned out, she had scrolled through some of my old photos and saw that my aesthetic and backstory didn’t befit someone with 5,000 faithful admirers. “I noticed that your likes were really off. One image had about 100 likes and one had three likes, and I was, like, that doesn’t make any sense,” she told me later. “I have a pretty good instinct for this kind of thing. It’s really hard to fake a very genuine profile.”
I’d agree with her, but my candles from Linnea’s Lights have just arrived, in a box so large I thought they might be furniture for my neighbor. There are four candles in there -- thick tumblers of wax in scents like ink, forest fir, cashmere and Earl grey, plus an oil-based scent diffuser. The woman who sent them to me, Natalie Markoff, even enclosed a handwritten note saying that she hoped I would enjoy the candles. 
I feel #gross.
After the generous box of $16 to $34 candles appeared in the mail, I called Markoff to apologize for lying about who I was, and to ask if she wanted to talk about her experience “working” with me. Surprisingly, she did. (One other company also sent me free product but asked not to be included in this article, and huffily requested I return their candles, which I did.) 
How did my patched-together interior design feed convince Markoff? Basically, she’s a trusting person. She sometimes takes a chance on people who claim to be interested in the brand, whether they’ve got 150,000 followers or 2,000. She considers a gift to an influencer to be like a first-time discount -- a free week at the gym, say, or three free Blue Apron meals. An influencer is a potential customer, she says, with the possibility of also being more. “You’re just sharing an excellent product,” she says. “And the more people you can give that to, it’s putting good into the world.”
For Markoff, this strategy has led to partnerships that have paid dividends even down the road, including with an influencer who was doing an event in Portland, Maine, and liked the candles so much that she posted about them several times over three months. “I could just see our followers increasing, increasing, increasing, because she was posting about it in a meaningful way,” Markoff says. Because gifting can create feelings of reciprocity, this plan can be effective for many businesses, up to the point where an influencer sends a rate card requesting thousands of dollars. “My clients don’t pay to play,” Markoff says. It’s gifts or nothing, but gifts have created some serious buzz.
So -- based on a dozen interviews and my own experience as an influencer, should you do it? The fact is, you probably have no choice. If you want your brand to remain relevant to young people, you have to go where they are, and for now, that’s on Instagram. But be warned that the world of Instagram influencing really is like a gold rush. It’s boom or bust, and most of it seems to be happening in California. Spoken as a former piece of fool’s gold: Be careful out there.
Why You Need to Stop Worrying About Facebook 'Likes' in 2018
Engagement is the worst way to judge the success of your content.
This may surprise you to hear, because most people base success on the amount of traffic you get, how many "likes" a Facebook posts has and how many shares an article creates.
Look, these metrics matter to an extent. They help you judge the success of your content marketing strategy, but if this is the only way you judge it, you're playing the game wrong. 
I say this from experience because I played the game wrong for a long time. I put a lot of effort into content and advertising, and I based the success of it on likes, shares and love-hearts. For a long time, this worked (really, really well). A thousand shares didbring leads and customers and money. But, over the last two years I've noticed a new trend, and it surprised me a great deal.

You cannot take Facebook likes to the bank.

I've built more than eight businesses over the last fifteen years. Some have succeeded whereas others did not, but they all involved building an online platform in some form. As such, content marketing and online advertising have played a large role throughout my entrepreneurial career.
Over the years, I've spent hundreds and thousands of dollars on this, and since 2015 I've helped other entrepreneurs do the same through effective marketing funnels.
A few years ago, you could take likes to the bank. But, those days are over, and they are never coming back. In fact, when I looked into who bought my programs and became one-on-one clients in 2017, I realized most of them didn't engage with my content. They didn't "like" my posts. I didn't notice them inside my Facebook Groups. They didn't reply to my emails or other social media messages.
They lurked. They clearly saw what I was putting out, but they hardly ever engaged.
This stopped me in my tracks, because I realized the way I judged my content was all wrong. To this point, I made decisions based on how many likes a post would get, but I now realized likes didn't mean money.
I didn't feel bad though, as I noticed most of my entrepreneurial friends did the same. It comes down to simple chemistry, in fact, because likes, shares and love-hearts create a dopamine spike. You feel happy and confident, and you want more of the same. Whereas no likes or shares leaves you feeling empty and insecure.
  • Highly engaged content = good content marketing
  • Poorly engaged content = bad content marketing
This is how judged success, but here I was with the revelation that engagement didn't lead to success, and that those who did buy from me hardly engaged at all.
I learned something important during this period:

The more sophisticated your audience, the less engagement you will get from your content marketing.

If you're targeting insecure, vulnerable and naive people, this may not apply. Because insecure, vulnerable and naive people tend to not know what they want. These people engage with content because it creates a dopamine spike of its own. They feel productive because they have done something, even though that "something" may or may not help them.
So, if this is your audience, likes, shares and love-hearts may lead to profit.
Whereas if you target educated, secure and sophisticated people, it won't. These people are too busy to spend their time commenting on every tweet and post. In fact, the more sophisticated your audience is, the less engagement you will see -- be it email, social media or online advertising.
Again, this realization blew me away.
I created content, products and services for a sophisticated market who already had a successful business. My audience didn't have time to always engage with what I put out, but that isn't to say they didn't see it or experience it.
This forced me to step back and reevaluate how I judged my content, and I realized looking at how many likes a post gets wouldn't do the trick.

Focus on revenue, not likes, shares or love-hearts.

The only true way to judge the success of your content marketing is to measure the amount of revenue it makes.
The next time you push out content -- be it email, social media, PR or video -- consider how it actually makes you revenue. Forget about the likes, shares and love-hearts. Forget about the dopamine spikes and how happy a popular post makes you feel. Let go of the emotional attachment toward your content, and instead hone in on what it does to your bottom line.
How you do this depends on what you produce and sell, but the simple answer is to turn attention away from vanity metrics (likes, shares, love-hearts, hits, views, etc.), and toward more intimate measurables like messages, replies and people who contact you directly after you share a piece of content. It's not as easy to measure, but the insight this offers you is far more profound.
Of course, even measuring this isn't enough if it doesn't drive people to actually take action, such as purchasing your product, arranging the sales call or filling in your application. This is the bottom line and all that matters: literally, how your content affects your bottom line.
It's the only way to judge your content's success in 2018. It isn't to say likes, shares and love-hearts don't matter. They do to an extent, and they can help you gauge success. But, they do not define your success.
Once you get on board with this, it empowers you to go out and create your best content yet, unaffected by how many dopamine spikes it does or does not give you. Instead, you create relevant content for the right people at the right time, and measure the effect it has on your bottom line, so you can scale-up and take your business to seven figures and beyond.