María Sánchez Prevention & Communication Officer @EC3Europol María Sánchez Prevention & Communication Officer EC3 Outreach & Support 31 May 2017 1

FOUNDING MEMBERS 25 July 2016 https://www.nomoreransom.org Powered by

14 MAIN GUIDING PRINCIPLES OPERATIONS PREVENTION STRATEGY Encourage reporting of ransomware Disrupt the criminal business model Arrest and prosecute suspects OPERATIONS Reporting mechanism Assist victims (free tools) Educate and raise awareness PREVENTION 14 ENGLISH Spanish French Portuguese Dutch Italian German Finnish Slovenian Russian Japanese Ukrainian Korean Hebrew Public-Private Partnership Law enforcement driven Non-commercial goal STRATEGY

1 3 2 4 CRYPTO SHERIFF MAIN FUNTIONALITY UPLOAD Two encrypted files ASSESSMENT Match against the available tools CRYPTO SHERIFF 2 Ransomware note UPLOAD 4 Tool available? SOLUTION

50 20 8 7 5 3 3 2 1 1 DECRYPTION TOOLS Emsisoft Avast Kaspersky Check Point 3 Bitdefender 3 Intel Security 2 CERT Polska 1 TrendMicro 1 Eleven Paths

7 76 TYPES OF PARTNERSHIP ASSOCIATED SUPPORTING DECRYPTION TOOLS COMMUNICATION Legal Agreement Consent Form Only decryption tools allowed Translation Promotion 7 76

PREVENTION ADVICE BACK-UP! TRUST NO ONE It’s best to create two back-up copies: one to be stored in the cloud and one to store physically. TRUST NO ONE Literally. Never open attachments in emails from someone you don’t know. ENABLE THE ‘SHOW FILE EXTENSIONS’ option in the Windows settings on your computer. Stay away from file extensions like ‘.exe’, ‘.vbs’ and ‘.scr’. UPDATES Keep all the software on your computer up to date. ANTIVIRUS DISCONNECT Use robust antivirus software. If you discover a rogue or unknown process on your machine, disconnect it immediately from the internet or other network connections (such as home Wi-Fi) — this will prevent the infection from spreading. 14 MAY WANNACRY

3 2 EVOLUTION 1 4 15 December’16 25 July’16 17 October’16 4 April’17 +6000 decryptions Public-Private sector enlargement Dutch, French, Italian, Portuguese & Russian Bitdefender, Check Point, Emsisoft and Trend Micro +32 decryption tools +32 new PP partners LEA: Austria, Croatia, Denmark, Finland, Malta, Romania, Singapore and Slovenia 25 July’16 Project launched 4 founding members 4 decryption tools English 2 4 17 October’16 4 April’17 LEA enlargement Bosnia and Herzegovina, Bulgaria, Colombia, France, Hungary, Ireland, Italy, Latvia, Lithuania, Portugal, Spain, Switzerland and the United Kingdom + 1 decryption tool Finnish, German, Hebrew, Japanese, Korean, Slovenian, Spanish & Ukrainian AVAST, CERT Polska and Eleven Paths +15 decryption tools +30 new PP partners LEA: Australia, Belgium, INTERPOL, Israel, South Korea, Russia and Ukraine +2500 decryptions +16000 decryptions

STATISTICS 1.2M visitors 14 May – 165K TOP COUNTRIES LAST 30 DAYS

Follow us: @EC3Europol 10