Changzhou Municipal Government: Notice on Preventing Bitcoin Ransomware

Bitcoin ransomware is a new type of malware that encrypts important files of target users in an illegal way and forces them to redeem them with Bitcoin. This has also attracted the attention of relevant government departments. Recently, Changzhou Economic and Information Commission issued a notice on preventing Bitcoin ransomware on its official website. The original content is as follows:

To the People's Governments of all cities and districts, all municipal commissions, offices and bureaus, and all municipal companies and directly affiliated units:
Recently, there have been information security incidents in our city where government departments, enterprises, institutions and personal computers have been infected with Bitcoin ransomware. Bitcoin ransomware will perform malicious operations on the computer, browse all documents, pictures, and even audio and video files, and encrypt these files so that users cannot open them. If the user clicks on the document again, the program will pop up a dialog box to blackmail the user, requiring the user to complete the Bitcoin transfer operation to the virus author within a specified time in order to obtain the decryption password and retrieve the original file.
The Bitcoin ransomware virus is mainly spread through email attachments, phishing emails that send mass download URL links, users downloading virus files from malicious sites, and web pages that are installed with Trojan horses. The virus is of a bad nature and extremely harmful. Once infected, it will cause immeasurable losses to users. All regions, departments, and units are requested to pay great attention to the ransomware virus and take the following defensive measures:
1. Regulate online behavior. Understand how ransomware is spread, such as social media, social engineering, spam, phishing emails, malicious sites, etc. Pay special attention to downloading resources from trusted sites and perform virus scans before opening and using them.
2. Adopt a multi-level network security strategy. Effective network isolation measures should be taken to isolate key business programs, data and equipment into independent networks. Units with conditions should adopt a combination of multiple protection measures to build a network security protection system, such as: advanced threat protection, gateway antivirus, intrusion prevention, email protection and other network-based security protection measures.
3. Provide good terminal protection. All hosts, including mobile terminals, should be protected. In addition to installing traditional antivirus software, measures should also include patch management, Web content filtering, and active virus protection products.
4. Pay attention to data backup and recovery. Pay great attention to data backup. Reliable data backup can minimize the losses caused by ransomware. At the same time, data backup security protection should be done to avoid infection and damage.

Information name: Notice on preventing Bitcoin ransomware virus Index number: 014109453/2016-00103
Subject classification: Others Genre classification: Notice Group classification: Others Municipal Economic and Information Commission: Business work document number: Changxinan Office [2016] No. 26 Issuing agency: Municipal Economic and Information Commission Date of issue: 2016-11-04 Date of issue: 2016-11-09
Content overview: Bitcoin ransomware is spread through email attachments, phishing email group download URL links, users downloading virus files from malicious sites, and web pages with Trojans. Be careful