[{"data":1,"prerenderedAt":1248},["ShallowReactive",2],{"threats-nav-data-en":3,"threat-en-ransomware":830,"threat-counterpart-en-ransomware":1002,"threat-surround-en-ransomware":1246},[4,321,563],{"id":5,"title":6,"alias":7,"body":8,"category":302,"description":303,"extension":304,"gameScenarioLink":305,"gameScenarioTitle":306,"icon":307,"meta":308,"navigation":309,"path":310,"seo":311,"severity":312,"sitemap":313,"slug":314,"stem":315,"vector":316,"__hash__":320},"threats_en\u002Fthreats\u002F01.phishing.md","Phishing (Credential Harvesting & Scams)","Email Phishing, Smishing & Deceptive Portals",{"type":9,"value":10,"toc":290},"minimark",[11,34,39,45,52,56,106,110,138,144,148,218,222,252,256],[12,13,14,19,28],"scan-trap",{},[15,16,18],"h3",{"id":17},"security-alert-you-scanned-an-untrusted-qr-code","⚠ Security Alert: You Scanned an Untrusted QR Code!",[20,21,22,23,27],"p",{},"You just triggered a simulated ",[24,25,26],"strong",{},"Quishing (QR Phishing)"," training trap! In a real incident, scanning untrusted physical\nor digital QR codes can covertly exfiltrate credentials, hijack sessions, or execute malicious payloads.",[20,29,30,33],{},[24,31,32],{},"Security Reminder:"," Always inspect destination URLs and never scan unsolicited or publicly posted QR codes without\nverification.",[35,36,38],"h2",{"id":37},"what-is-phishing","What is Phishing?",[20,40,41,44],{},[24,42,43],{},"Phishing"," remains one of the most widespread and damaging cyber attack vectors worldwide. Attackers send fraudulent\ncommunications disguised as trusted organizations—such as Microsoft 365, Google Workspace, postal couriers (DHL, FedEx,\nCzech Post), tax authorities, or popular streaming platforms.",[20,46,47,48,51],{},"The primary objective is almost always to direct the victim to a ",[24,49,50],{},"pixel-perfect fake login page"," where entered\ncredentials (and often active 2FA session tokens via Adversary-in-the-Middle proxies) are harvested by the threat actor.",[35,53,55],{"id":54},"the-phishing-attack-sequence","The Phishing Attack Sequence",[57,58,59],"attack-flow",{},[60,61,62,69,88,94,100],"ol",{},[63,64,65,68],"li",{},[24,66,67],{},"Bait Crafting",": Attackers replicate corporate branding, logos, and email templates (e.g. \"Password expiring in 24\nhours\" or \"Package delivery suspended due to unpaid customs fee\").",[63,70,71,74,75,79,80,83,84,87],{},[24,72,73],{},"Domain Spoofing & Lookalikes",": Scammers register lookalike domains (",[76,77,78],"code",{},"rnicrosoft.com"," ,",[76,81,82],{},"micros0ft-login.com",",",[76,85,86],{},"post-package-tracking.net",") or abuse compromised legitimate domains.",[63,89,90,93],{},[24,91,92],{},"Mass or Targeted Dispatch",": Automated mailers deliver thousands of messages, bypassing basic spam filters with\nhomoglyphs, encoded links, or QR codes (Quishing).",[63,95,96,99],{},[24,97,98],{},"Credential Harvesting",": The victim lands on a fake authentication portal. As soon as user inputs username,\npassword, or SMS OTP, it is relayed directly to the attacker.",[63,101,102,105],{},[24,103,104],{},"Account Takeover (ATO)",": Attackers log into the victim's genuine account, establish mailbox forwarding rules, and\npivot deeper into the corporate network.",[35,107,109],{"id":108},"real-world-simulation","Real-World Simulation",[111,112,116,124,127,130,135],"threat-example",{"channel":113,"icon":114,"sender":115},"Email","i-lucide-mail","IT Helpdesk Notifications \u003Calerts@corplog1n-verify.com>",[20,117,118,119,123],{},"\"Subject: ",[120,121,122],"span",{},"URGENT"," Security Alert: Your Microsoft 365 Session Has Expired",[20,125,126],{},"Dear Employee,",[20,128,129],{},"Our security monitoring detected suspicious sign-in attempts against your account from an unrecognized IP in Warsaw.\nYour access will be locked in 30 minutes unless you verify your identity.",[20,131,132],{},[120,133,134],{},"Click here to confirm your credentials and update password",[20,136,137],{},"Failure to comply will result in an immediate IT security suspension.\"",[20,139,140,141,143],{},"Pay attention to the urgency of the email (",[76,142,122],{}," etc.). Hackers use it to put time\npressure on you, so you will not spot the suspicious details and mistakes in the email.",[35,145,147],{"id":146},"defense-checklist","Defense Checklist",[149,150,152],"defense-tips",{"title":151},"Phishing Prevention Rules",[153,154,155,194,200,206,212],"ul",{},[63,156,157,160,161,164,165,168,169,171,172,175,176,179,180,187,188,193],{},[24,158,159],{},"Inspect the actual sender address, not just display name",": Check the domain after the ",[76,162,163],{},"@"," symbol carefully. Look ",[166,167],"br",{}," --- Unknown node: hardBreak --- ",[166,170],{}," for misspellings, substitute characters (",[76,173,174],{},"rn"," vs ",[76,177,178],{},"m"," - @",[181,182,186],"a",{"href":183,"rel":184},"http:\u002F\u002Fmicrosoft.com",[185],"nofollow","microsoft.com"," vs @",[181,189,192],{"href":190,"rel":191},"http:\u002F\u002Frnicrosoft.com",[185],"rnicrosoft.com,"," etc.), or strange top-level domains.",[63,195,196,199],{},[24,197,198],{},"Hover before clicking",": Hover your cursor over hyperlinks to inspect the destination URL before clicking. If on\nmobile, long-press to view preview.",[63,201,202,205],{},[24,203,204],{},"Never authenticate via links sent in unsolicited emails",": Navigate directly to known services by typing their\naddress into your browser or using verified bookmarks.",[63,207,208,211],{},[24,209,210],{},"Use FIDO2 \u002F Passkey Hardware Authentication",": Phishing-resistant multi-factor authentication (like YubiKeys or\nWindows Hello \u002F Passkeys) prevents credential harvesting even if you land on a spoofed portal.",[63,213,214,217],{},[24,215,216],{},"Beware of QR code emails (Quishing)",": Never scan QR codes embedded in security notifications or password reset\nemails.",[35,219,221],{"id":220},"immediate-actions-if-phished","Immediate Actions If Phished",[223,224,226],"emergency-action",{"title":225},"Clicked a Suspicious Link or Entered Credentials?",[153,227,228,234,240,246],{},[63,229,230,233],{},[24,231,232],{},"Immediately change passwords on legitimate portals",": Do not use the link from the email. Open a new browser window,\nlog into the official service, and change your credentials.",[63,235,236,239],{},[24,237,238],{},"Revoke all active sessions and app passwords",": In Microsoft 365 or Google, trigger a \"Sign out of all devices\"\ncommand.",[63,241,242,245],{},[24,243,244],{},"Inspect email inbox forwarding rules",": Attackers routinely create hidden rules to silently forward incoming emails\nor delete notifications from security teams.",[63,247,248,251],{},[24,249,250],{},"Notify IT Security (SOC)",": Prompt reporting allows defenders to blacklist the phishing domain across the entire\nenterprise gateway and reset impacted tokens.",[35,253,255],{"id":254},"resources-references","Resources & References",[153,257,258,266,274,282],{},[63,259,260,265],{},[181,261,264],{"href":262,"rel":263},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku",[185],"Komerční banka – Bezpečnost a typy útoků"," – Guide on email scams,\nfake e-banking portals, and smishing defense.",[63,267,268,273],{},[181,269,272],{"href":270,"rel":271},"https:\u002F\u002Fwww.cisa.gov\u002Fsecure-our-world\u002Fteach-employees-avoid-phishing",[185],"CISA – Recognizing and Reporting Phishing"," –\nCybersecurity and Infrastructure Security Agency best practices.",[63,275,276,281],{},[181,277,280],{"href":278,"rel":279},"https:\u002F\u002Fwww.nukib.gov.cz\u002F",[185],"NÚKIB – Doporučení k ochraně před phishingem"," – National Cyber and Information Security\nAgency advisory.",[63,283,284,289],{},[181,285,288],{"href":286,"rel":287},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F",[185],"MITRE ATT&CK – Technique T1566: Phishing"," – Comprehensive adversary\ntactics and techniques index.",{"title":291,"searchDepth":292,"depth":292,"links":293},"",2,[294,296,297,298,299,300,301],{"id":17,"depth":295,"text":18},3,{"id":37,"depth":292,"text":38},{"id":54,"depth":292,"text":55},{"id":108,"depth":292,"text":109},{"id":146,"depth":292,"text":147},{"id":220,"depth":292,"text":221},{"id":254,"depth":292,"text":255},"social-engineering","Deceptive emails, text messages, or direct communications designed to trick users into revealing confidential credentials, banking details, or downloading malware via lookalike websites.","md","https:\u002F\u002Fplay.cyber-framework.net?scenario=phishing","The Phishing Labyrinth","i-lucide-mail-warning",{},true,"\u002Fthreats\u002Fphishing",{"title":6,"description":303},null,{"loc":310},"phishing","threats\u002F01.phishing",[113,317,318,319],"SMS \u002F Smishing","Lookalike Domains (Typosquatting)","Fake Login Portals","vQ4E3-SjHlVYfPDRgOROyamltaASWpsC0HbXldxZS-A",{"id":322,"title":323,"alias":324,"body":325,"category":302,"description":546,"extension":304,"gameScenarioLink":547,"gameScenarioTitle":548,"icon":549,"meta":550,"navigation":309,"path":551,"seo":552,"severity":312,"sitemap":553,"slug":556,"stem":557,"vector":558,"__hash__":562},"threats_en\u002Fthreats\u002F02.vishing.md","Vishing (Voice Phishing)","Voice Phishing & Phone Spoofing",{"type":9,"value":326,"toc":538},[327,331,346,353,357,360,404,406,409,420,424,431,466,470,473,502,504],[35,328,330],{"id":329},"what-is-vishing","What is Vishing?",[20,332,333,336,337,341,342,345],{},[24,334,335],{},"Vishing"," (short for ",[338,339,340],"em",{},"voice phishing",") is a social engineering attack conducted over telephone networks. Unlike\ntraditional email phishing where you can inspect suspicious links and headers at your own pace, vishing exploits\n",[24,343,344],{},"real-time psychological pressure",", authority impersonation, and panic.",[20,347,348,349,352],{},"Attackers frequently spoof legitimate caller IDs so your phone screen displays the actual name or number of your bank's\nfraud department, local police, or corporate IT helpdesk. Advanced threat actors also deploy ",[24,350,351],{},"AI voice cloning (\ndeepfakes)"," replicating the tone and cadence of executives or loved ones.",[35,354,356],{"id":355},"how-attackers-operate","How Attackers Operate",[20,358,359],{},"Attackers rely on emotional manipulation—typically fear, urgency, or helpfulness—to override rational critical thinking.",[57,361,362],{},[60,363,364,380,386,392,398],{},[63,365,366,379],{},[24,367,368,369,378],{},"Target Intelligence (",[24,370,371],{},[24,372,373],{},[181,374,377],{"href":375,"rel":376},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FOpen-source_intelligence",[185],"OSINT",")",": The caller acquires basic personal details from data leaks, LinkedIn, or social\nmedia (your full name, employer, banking institution, or phone provider).",[63,381,382,385],{},[24,383,384],{},"Caller ID Spoofing",": Attackers configure VoIP software to display a legitimate number—such as your bank's\npublished 24\u002F7 client hotline or police department.",[63,387,388,391],{},[24,389,390],{},"Manufactured Crisis",": The scammer reports that your bank account is \"under active attack\", unauthorized loans are\nbeing approved, or your computer has malware.",[63,393,394,397],{},[24,395,396],{},"The \"Safe Account\" or Remote Access Trap",": The victim is instructed to immediately transfer all funds to a \"secure\nreserve vault\" or install remote support software (AnyDesk, TeamViewer) to \"clean the machine\".",[63,399,400,403],{},[24,401,402],{},"Fund Extraction & Disappearance",": Once transferred or logged in, the funds are instantly laundered through\ncryptocurrency exchanges or offshore mule networks.",[35,405,109],{"id":108},[20,407,408],{},"Here is what a typical high-pressure banking vishing dialogue sounds like:",[111,410,414,417],{"channel":411,"icon":412,"sender":413},"Phone Call","i-lucide-phone-incoming","\"Bank Security Department\" (Spoofed)",[20,415,416],{},"\"Good morning Mr. Anderson. This is Marcus from the Cybersecurity Operations Center at your bank. We are detecting an\nunauthorized wire transfer of $8,400 to an offshore account in Vienna right now.",[20,418,419],{},"To prevent this transaction from settling, I need you to confirm the 6-digit one-time code we just dispatched to your\nmobile phone. Do not hang up—if you disconnect, the funds will irreversibly leave your account.\"",[35,421,423],{"id":422},"how-to-defend-yourself","How to Defend Yourself",[20,425,426,427,430],{},"The golden rule of incoming phone security is simple: ",[24,428,429],{},"never verify a caller using the inbound call itself",".",[149,432,434],{"title":433},"Vishing Defense Checklist",[153,435,436,442,448,454,460],{},[63,437,438,441],{},[24,439,440],{},"Hang up and verify independently",": Never continue a high-stakes call initiated by someone else. Hang up, wait 30\nseconds (or restart the line), and dial the official phone number printed on the back of your payment card or official\ncompany directory.",[63,443,444,447],{},[24,445,446],{},"Banks never ask for full credentials or 2FA codes",": Legitimate bank employees will never ask for your login\npasswords, card PIN, CVC\u002FCVV security code, or push authorization approvals over the phone.",[63,449,450,453],{},[24,451,452],{},"Beware of \"Safe Deposit Accounts\"",": Banks never instruct clients to transfer money into an alternative or temporary\n\"reserve vault\" account to protect it.",[63,455,456,459],{},[24,457,458],{},"Never install remote control software on request",": If a caller asks you to install AnyDesk, TeamViewer, RustDesk,\nor QuickSupport, hang up immediately.",[63,461,462,465],{},[24,463,464],{},"Establish internal verification protocols",": For corporate calls asking for financial transactions or credentials,\nrequire dual-channel out-of-band verification.",[35,467,469],{"id":468},"immediate-actions-if-targeted","Immediate Actions If Targeted",[20,471,472],{},"If you suspect you have disclosed financial data or authorized a fraudulent transaction during a phone call:",[223,474,476],{"title":475},"Compromised via Vishing? Take These Steps Now",[153,477,478,484,490,496],{},[63,479,480,483],{},[24,481,482],{},"Immediately contact your bank's official fraud line",": Request immediate card blocking, internet banking session\ntermination, and transaction recalls. Every minute matters for wire recall requests.",[63,485,486,489],{},[24,487,488],{},"Change all passwords from an uninfected device",": If you installed software or entered passwords on suggested links,\nassume your workstation is compromised. Change passwords and revoke active sessions.",[63,491,492,495],{},[24,493,494],{},"File a report with law enforcement (Police)",": Document the attacker's phone number, time of call, claimed identity,\nand transaction identifiers.",[63,497,498,501],{},[24,499,500],{},"Notify your company's IT \u002F Security Operations (CISO)",": If corporate credentials or workstations were involved,\nreport the incident immediately so credentials can be rotated and endpoints isolated.",[35,503,255],{"id":254},[153,505,506,514,522,530],{},[63,507,508,513],{},[181,509,512],{"href":510,"rel":511},"https:\u002F\u002Fwww.kb.cz\u002Fcs\u002Fpodpora\u002Fbezpecnost\u002Ftypy-utoku\u002Fvishing",[185],"Komerční banka – Podvodné telefonáty (Vishing)"," – Guide on\nspoofed bank calls and caller verification.",[63,515,516,521],{},[181,517,520],{"href":518,"rel":519},"https:\u002F\u002Fcbaczech.cz\u002F",[185],"Czech Banking Association – #NePINdej! Campaign"," – Educational nationwide campaign on banking\nfraud and social engineering.",[63,523,524,529],{},[181,525,528],{"href":526,"rel":527},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fnews\u002Favoiding-social-engineering-and-phishing-attacks",[185],"CISA – Avoiding Social Engineering and Phishing Attacks"," –\nVoice phishing and imposter call defense.",[63,531,532,537],{},[181,533,536],{"href":534,"rel":535},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1566\u002F004\u002F",[185],"MITRE ATT&CK – Technique T1566.004: Spearphishing Voice"," – Adversary\nmethodology for vishing operations.",{"title":291,"searchDepth":292,"depth":292,"links":539},[540,541,542,543,544,545],{"id":329,"depth":292,"text":330},{"id":355,"depth":292,"text":356},{"id":108,"depth":292,"text":109},{"id":422,"depth":292,"text":423},{"id":468,"depth":292,"text":469},{"id":254,"depth":292,"text":255},"Fraudulent phone calls where attackers impersonate bank officers, police, or IT support using psychological pressure and caller ID spoofing to steal money or credentials.","https:\u002F\u002Fplay.cyber-framework.net?scenario=day-one","First Day","i-lucide-phone-call",{},"\u002Fthreats\u002Fvishing",{"title":323,"description":546},{"loc":551,"videos":554,"images":555},[],[],"vishing","threats\u002F02.vishing",[559,384,560,561],"Phone (Voice)","Audio Deepfakes","Social Engineering","E3QIMt3RJ-53_ay8LTgTwoCBoOawNRczk2aaKQW7pOc",{"id":564,"title":565,"alias":566,"body":567,"category":812,"description":813,"extension":304,"gameScenarioLink":291,"gameScenarioTitle":291,"icon":814,"meta":815,"navigation":309,"path":816,"seo":817,"severity":312,"sitemap":819,"slug":822,"stem":823,"vector":824,"__hash__":829},"threats_en\u002Fthreats\u002F03.ransomware.md","Ransomware & Malicious Attachments","Extortion Ware, Crypto-Lockers & Malicious Payloads",{"type":9,"value":568,"toc":804},[569,573,579,586,597,601,651,655,664,700,702,737,741,770,772],[35,570,572],{"id":571},"what-is-ransomware","What is Ransomware?",[20,574,575,578],{},[24,576,577],{},"Ransomware"," is a devastating class of malware that covertly infiltrates network infrastructure, maps connected shares\nand cloud backups, and deploys military-grade encryption (e.g. AES-256 and RSA-4096) across entire file repositories.",[20,580,581,582,585],{},"Modern ransomware groups practice ",[24,583,584],{},"Double and Triple Extortion",":",[60,587,588,591,594],{},[63,589,590],{},"Encrypting systems to halt daily operations.",[63,592,593],{},"Exfiltrating sensitive customer and intellectual property records to threaten public leaks.",[63,595,596],{},"Conducting distributed denial-of-service (DDoS) attacks or contacting company customers directly to accelerate\npayment.",[35,598,600],{"id":599},"infection-spread-lifecycle","Infection & Spread Lifecycle",[57,602,603],{},[60,604,605,623,633,639,645],{},[63,606,607,610,611,614,615,618,619,622],{},[24,608,609],{},"Initial Access Vector",": An employee opens a macro-enabled invoice (",[76,612,613],{},"Invoice_9042.docm","), a deceptive ZIP archive\ncontaining a disguised ",[76,616,617],{},".vbs"," or ",[76,620,621],{},".exe",", or attackers exploit exposed VPN\u002FRDP portals.",[63,624,625,628,629,632],{},[24,626,627],{},"Persistence & Defense Evasion",": The malware disables endpoint protection, clears Windows Volume Shadow Copies\n(",[76,630,631],{},"vssadmin delete shadows","), and establishes persistence.",[63,634,635,638],{},[24,636,637],{},"Lateral Movement & Domain Escalation",": Attackers harvest local credentials (using tools like Mimikatz), escalate\nto Active Directory Domain Admin, and locate all network storage (NAS\u002FSAN).",[63,640,641,644],{},[24,642,643],{},"Data Exfiltration",": Confidential databases, financial spreadsheets, and emails are compressed and quietly uploaded\nto anonymous cloud storage.",[63,646,647,650],{},[24,648,649],{},"Mass Encryption & Ransom Note",": Encryption scripts trigger simultaneously across domain servers and workstations,\nreplacing desktop wallpapers with ransom instructions.",[35,652,654],{"id":653},"simulated-ransom-note","Simulated Ransom Note",[20,656,657],{},[658,659],"img",{"alt":660,"className":661,"src":663,"title":660},"Ransomware screen example",[662],"w-full","\u002Fthreats\u002Fransomware-screen.webp",[111,665,669,672,675,678,697],{"channel":666,"icon":667,"sender":668},"Ransom Screen Notice","i-lucide-skull","BlackLock Ransomware Group",[20,670,671],{},"\"=== ATTENTION: ALL YOUR IMPORTANT FILES HAVE BEEN ENCRYPTED ===",[20,673,674],{},"All your corporate databases, documents, customer PII, and backups are locked with military-grade encryption algorithms.",[20,676,677],{},"To restore your systems:",[60,679,680,687,694],{},[63,681,682,683],{},"Download the Tor Browser from ",[181,684,685],{"href":685,"rel":686},"https:\u002F\u002Fwww.torproject.org",[185],[63,688,689,690],{},"Open our private portal: ",[181,691,692],{"href":692,"rel":693},"http:\u002F\u002Fblacklock5x9...onion",[185],[63,695,696],{},"Enter your Unique Client ID: 894F-29BC-EE01",[20,698,699],{},"PRICE: 4.5 BTC (Bitcoin). You have 72 hours before the decryption key is permanently deleted and all private files are\nreleased on the public darknet.\"",[35,701,147],{"id":146},[149,703,705],{"title":704},"Ransomware Resilience Rules",[153,706,707,713,719,725,731],{},[63,708,709,712],{},[24,710,711],{},"Maintain Immutable, Offline Backups (3-2-1-1-0 Rule)",": Ensure at least one full backup is physically disconnected\n(air-gapped) or stored in an immutable, write-once-read-many (WORM) cloud repository.",[63,714,715,718],{},[24,716,717],{},"Never enable macros or execute unexpected script attachments",": Office documents asking you to \"Enable Content\" or\n\"Enable Editing\" to view content are almost always weaponized droppers.",[63,720,721,724],{},[24,722,723],{},"Enforce the Principle of Least Privilege",": Standard employee accounts must not have local administrative rights on\ntheir machines.",[63,726,727,730],{},[24,728,729],{},"Isolate and patch remote access interfaces",": Never expose Remote Desktop Protocol (RDP) directly to the open\ninternet; mandate VPN with strict multi-factor authentication.",[63,732,733,736],{},[24,734,735],{},"Deploy Endpoint Detection & Response (EDR)",": Modern behavioral EDR tools can detect mass file modification and\nisolate the infected host automatically.",[35,738,740],{"id":739},"immediate-incident-containment","Immediate Incident Containment",[223,742,744],{"title":743},"Ransomware Detected? Take Instant Containment Actions",[153,745,746,752,758,764],{},[63,747,748,751],{},[24,749,750],{},"Disconnect immediately from physical networks",": Unplug ethernet cables and turn off Wi-Fi and Bluetooth on all\naffected devices immediately. DO NOT turn off the power (RAM holds crucial decryption keys and malware artifacts).",[63,753,754,757],{},[24,755,756],{},"Do not pay the ransom",": Cybersecurity authorities and law enforcement strongly advise against paying ransoms.\nPayment fuels criminal syndicates, does not guarantee data recovery, and marks your company as an easy repeat target.",[63,759,760,763],{},[24,761,762],{},"Isolate network segments and storage arrays",": Take offline network-attached storage and shared drives to stop\nencryption traversal.",[63,765,766,769],{},[24,767,768],{},"Contact certified forensic responders & law enforcement",": Engage certified incident response teams to secure\nforensic evidence and guide secure recovery from immutable backups.",[35,771,255],{"id":254},[153,773,774,782,789,796],{},[63,775,776,781],{},[181,777,780],{"href":778,"rel":779},"https:\u002F\u002Fwww.cisa.gov\u002Fstopransomware",[185],"CISA #StopRansomware"," – Official U.S. government guidance, threat alerts, and\nransomware playbooks.",[63,783,784,788],{},[181,785,787],{"href":262,"rel":786},[185],"Komerční banka – Škodlivý software a ochrana dat"," – Banking\nclient advisory on malware infections and prevention.",[63,790,791,795],{},[181,792,794],{"href":278,"rel":793},[185],"NÚKIB – Reakce na ransomware incidenty"," – National Cyber and Information Security Agency\nransomware defense guide.",[63,797,798,803],{},[181,799,802],{"href":800,"rel":801},"https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1486\u002F",[185],"MITRE ATT&CK – Technique T1486: Data Encrypted for Impact"," – Tactical\nbreakdown of ransomware encryption behaviors.",{"title":291,"searchDepth":292,"depth":292,"links":805},[806,807,808,809,810,811],{"id":571,"depth":292,"text":572},{"id":599,"depth":292,"text":600},{"id":653,"depth":292,"text":654},{"id":146,"depth":292,"text":147},{"id":739,"depth":292,"text":740},{"id":254,"depth":292,"text":255},"malware","Malicious software that encrypts vital business files, databases, and backup systems, demanding enourmous cryptocurrency ransoms under threat of permanent data destruction or public leaks.","i-lucide-lock-keyhole",{},"\u002Fthreats\u002Fransomware",{"title":565,"description":818},"Malicious software that encrypts vital business files, databases, and backup systems, demanding exorbitant cryptocurrency ransoms under threat of permanent data destruction or public leaks.",{"loc":816,"videos":820,"images":821},[],[],"ransomware","threats\u002F03.ransomware",[825,826,827,828],"Weaponized Attachments (PDF, Office macros, ZIP\u002FISO)","Drive-by Downloads","Compromised Remote Desktop (RDP)","Unpatched Software Vulnerabilities","7PQfpCikml7DgKVB8SCpY_YutgGtoDUW9hxpn2xPpzE",{"id":564,"title":565,"alias":566,"body":831,"category":812,"description":813,"extension":304,"gameScenarioLink":291,"gameScenarioTitle":291,"icon":814,"meta":996,"navigation":309,"path":816,"seo":997,"severity":312,"sitemap":998,"slug":822,"stem":823,"vector":1001,"__hash__":829},{"type":9,"value":832,"toc":988},[833,835,839,843,851,853,885,887,892,916,918,942,944,964,966],[35,834,572],{"id":571},[20,836,837,578],{},[24,838,577],{},[20,840,581,841,585],{},[24,842,584],{},[60,844,845,847,849],{},[63,846,590],{},[63,848,593],{},[63,850,596],{},[35,852,600],{"id":599},[57,854,855],{},[60,856,857,867,873,877,881],{},[63,858,859,610,861,614,863,618,865,622],{},[24,860,609],{},[76,862,613],{},[76,864,617],{},[76,866,621],{},[63,868,869,628,871,632],{},[24,870,627],{},[76,872,631],{},[63,874,875,638],{},[24,876,637],{},[63,878,879,644],{},[24,880,643],{},[63,882,883,650],{},[24,884,649],{},[35,886,654],{"id":653},[20,888,889],{},[658,890],{"alt":660,"className":891,"src":663,"title":660},[662],[111,893,894,896,898,900,914],{"channel":666,"icon":667,"sender":668},[20,895,671],{},[20,897,674],{},[20,899,677],{},[60,901,902,907,912],{},[63,903,682,904],{},[181,905,685],{"href":685,"rel":906},[185],[63,908,689,909],{},[181,910,692],{"href":692,"rel":911},[185],[63,913,696],{},[20,915,699],{},[35,917,147],{"id":146},[149,919,920],{"title":704},[153,921,922,926,930,934,938],{},[63,923,924,712],{},[24,925,711],{},[63,927,928,718],{},[24,929,717],{},[63,931,932,724],{},[24,933,723],{},[63,935,936,730],{},[24,937,729],{},[63,939,940,736],{},[24,941,735],{},[35,943,740],{"id":739},[223,945,946],{"title":743},[153,947,948,952,956,960],{},[63,949,950,751],{},[24,951,750],{},[63,953,954,757],{},[24,955,756],{},[63,957,958,763],{},[24,959,762],{},[63,961,962,769],{},[24,963,768],{},[35,965,255],{"id":254},[153,967,968,973,978,983],{},[63,969,970,781],{},[181,971,780],{"href":778,"rel":972},[185],[63,974,975,788],{},[181,976,787],{"href":262,"rel":977},[185],[63,979,980,795],{},[181,981,794],{"href":278,"rel":982},[185],[63,984,985,803],{},[181,986,802],{"href":800,"rel":987},[185],{"title":291,"searchDepth":292,"depth":292,"links":989},[990,991,992,993,994,995],{"id":571,"depth":292,"text":572},{"id":599,"depth":292,"text":600},{"id":653,"depth":292,"text":654},{"id":146,"depth":292,"text":147},{"id":739,"depth":292,"text":740},{"id":254,"depth":292,"text":255},{},{"title":565,"description":818},{"loc":816,"videos":999,"images":1000},[],[],[825,826,827,828],{"id":1003,"title":1004,"alias":1005,"body":1006,"category":812,"description":1232,"extension":304,"gameScenarioLink":1233,"gameScenarioTitle":1234,"icon":814,"meta":1235,"navigation":309,"path":1236,"seo":1237,"severity":312,"sitemap":1238,"slug":822,"stem":1239,"vector":1240,"__hash__":1245},"threats_cs\u002Fcs\u002Fhrozby\u002F03.ransomware.md","Vyděračský software (Ransomware)","Škodlivé přílohy, Crypto-lockery & Zašifrování dat",{"type":9,"value":1007,"toc":1224},[1008,1012,1017,1023,1034,1038,1077,1081,1086,1119,1123,1158,1162,1192,1196],[35,1009,1011],{"id":1010},"co-je-to-ransomware","Co je to Ransomware?",[20,1013,1014,1016],{},[24,1015,577],{}," (vyděračský software) představuje jednu z nejničivějších kybernetických zbraní současnosti. Jakmile\npronikne do vnitřní infrastruktury, tiše zmapuje připojená disková pole a zálohy a následně pomocí neprolomitelného\nšifrování (např. AES-256 a RSA-4096) uzamkne veškerá důležitá data.",[20,1018,1019,1020,585],{},"Moderní útočné skupiny dnes praktikují tzv. ",[24,1021,1022],{},"dvojí až trojí vydírání",[60,1024,1025,1028,1031],{},[63,1026,1027],{},"Zašifrování počítačů a serverů, což kompletně paralyzuje provoz podniku či nemocnice.",[63,1029,1030],{},"Odcizení (exfiltrace) důvěrných klientských dat s výhrůžkou jejich zveřejnění na darknetu.",[63,1032,1033],{},"Přímé kontaktování klientů a partnerů oběti za účelem vyvinutí maximálního tlaku na zaplacení.",[35,1035,1037],{"id":1036},"životní-cyklus-nákazy","Životní cyklus nákazy",[57,1039,1042],{"description":1040,"title":1041},"Od otevření škodlivé přílohy po zablokování celé organizace.","Jak ransomware proniká a šíří se v síti",[60,1043,1044,1050,1059,1065,1071],{},[63,1045,1046,1049],{},[24,1047,1048],{},"Prvotní průnik",": Zaměstnanec otevře infikovanou fakturu v e-mailu (např. dokument Word s makry, archiv ZIP se\nskrytým skriptem) nebo útočník prolomí špatně zabezpečenou vzdálenou plochu (RDP).",[63,1051,1052,1055,1056,1058],{},[24,1053,1054],{},"Uchycení v systému (Persistence)",": Škodlivý kód vypne antivirus, smaže stínové kopie systému Windows\n(",[76,1057,631],{},") a zajistí si automatické spouštění.",[63,1060,1061,1064],{},[24,1062,1063],{},"Šíření po síti (Lateral Movement)",": Pomocí odcizených hesel útočník postupuje sítí, získá práva doménového\nadministrátora a lokalizuje síťová úložiště (NAS).",[63,1066,1067,1070],{},[24,1068,1069],{},"Krádež dat před šifrováním",": Citlivé smlouvy, databáze a účetnictví jsou zkomprimovány a tiše odeslány na servery\nútočníka.",[63,1072,1073,1076],{},[24,1074,1075],{},"Hromadné zašifrování",": V noci nebo o víkendu je spuštěno šifrování na všech serverech současně a na obrazovkách se\nobjeví instrukce k výkupnému.",[35,1078,1080],{"id":1079},"ukázka-vyděračského-vzkazu","Ukázka vyděračského vzkazu",[20,1082,1083],{},[658,1084],{"alt":1085,"src":663,"title":1085},"Příklad ransomwaru",[111,1087,1090,1093,1096,1099,1116],{"channel":1088,"icon":667,"sender":1089},"Obrazovka uzamčeného počítače","Útočná skupina BlackLock",[20,1091,1092],{},"„=== POZOR: VŠECHNA VAŠE DŮLEŽITÁ DATA BYLA ZAŠIFROVÁNA ===",[20,1094,1095],{},"Vaše firemní databáze, dokumenty, osobní údaje klientů i zálohy byly uzamčeny vojenským šifrovacím algoritmem.",[20,1097,1098],{},"Pro obnovu dat postupujte takto:",[60,1100,1101,1107,1113],{},[63,1102,1103,1104],{},"Stáhněte si prohlížeč Tor z adresy ",[181,1105,685],{"href":685,"rel":1106},[185],[63,1108,1109,1110],{},"Otevřete naši privátní stránku: ",[181,1111,692],{"href":692,"rel":1112},[185],[63,1114,1115],{},"Zadejte své klientské ID: 894F-29BC-EE01",[20,1117,1118],{},"CENA ZA DEŠIFROVÁNÍ: 4,5 BTC (Bitcoin). Na zaplacení máte 72 hodin, poté bude dešifrovací klíč nenávratně zničen a vaše\ndata prodána na darknetu.“",[35,1120,1122],{"id":1121},"zásady-obrany-proti-ransomwaru","Zásady obrany proti ransomwaru",[149,1124,1126],{"title":1125},"Jak firmu ochránit před zašifrováním",[153,1127,1128,1134,1140,1146,1152],{},[63,1129,1130,1133],{},[24,1131,1132],{},"Neměnné zálohování offline (Pravidlo 3-2-1-1-0)",": Mějte minimálně jednu plnohodnotnou zálohu fyzicky odpojenou od\nsítě (air-gapped) nebo uloženou v neměnném (WORM) cloudovém úložišti.",[63,1135,1136,1139],{},[24,1137,1138],{},"Nikdy nepovolujte makra v nečekaných dokumentech",": Pokud vás dokument Word nebo Excel žádá o „Povolení úprav“ nebo\n„Povolení maker“, jde prakticky s jistotou o škodlivý kód.",[63,1141,1142,1145],{},[24,1143,1144],{},"Zásada minimálních oprávnění",": Běžný uživatelský účet zaměstnance nesmí mít práva lokálního administrátora.",[63,1147,1148,1151],{},[24,1149,1150],{},"Uzamkněte vzdálenou plochu (RDP)",": Nikdy nevystavujte RDP porty volně do internetu. Používejte striktně\nzabezpečenou VPN s vícefaktorovým ověřením.",[63,1153,1154,1157],{},[24,1155,1156],{},"Nasaďte moderní EDR řešení",": Pokročilá ochrana koncových bodů rozpozná masivní šifrování souborů a automaticky\nodřízne napadený počítač od sítě.",[35,1159,1161],{"id":1160},"krizový-postup-při-detekci-ransomwaru","Krizový postup při detekci ransomwaru",[223,1163,1166],{"description":1164,"title":1165},"Pokud detekujete podezřelou aktivitu šifrování dat na disku nebo serverech:","Zaznamenali jste ransomware? Okamžitě izolujte!",[153,1167,1168,1174,1180,1186],{},[63,1169,1170,1173],{},[24,1171,1172],{},"Okamžitě fyzicky odpojte zařízení od sítě",": Vytáhněte síťový LAN kabel a vypněte Wi-Fi. Počítač NEVYPÍNEJTE ze\nzásuvky (v operační paměti RAM se mohou nacházet cenné klíče a důkazy).",[63,1175,1176,1179],{},[24,1177,1178],{},"Nikdy neplaťte výkupné",": Bezpečnostní složky i NÚKIB důrazně varují před placením. Platba nezaručuje obnovení dat,\nfinancuje organizovaný zločin a dělá z vás snadný cíl pro další útoky.",[63,1181,1182,1185],{},[24,1183,1184],{},"Odpojte síťová úložiště a záložní servery",": Okamžitě izolujte zbývající servery, aby se šifrování nerozšířilo do\ndalších síťových segmentů.",[63,1187,1188,1191],{},[24,1189,1190],{},"Kontaktujte forenzní experty a Policii ČR",": Povoláním specializovaného CSIRT týmu zajistíte záchranu dat z čistých\nzáloh a legální zadokumentování incidentu.",[35,1193,1195],{"id":1194},"zdroje-a-doporučená-literatura","Zdroje a doporučená literatura",[153,1197,1198,1204,1210,1218],{},[63,1199,1200,1203],{},[181,1201,794],{"href":278,"rel":1202},[185]," – Metodické pokyny Národního úřadu pro\nkybernetickou a informační bezpečnost pro zvládání ransomwaru.",[63,1205,1206,1209],{},[181,1207,787],{"href":262,"rel":1208},[185]," – Přehled rizik\nškodlivých příloh, maker a podvodných programů.",[63,1211,1212,1217],{},[181,1213,1216],{"href":1214,"rel":1215},"https:\u002F\u002Fwww.csirt.cz\u002F",[185],"CSIRT.CZ – Národní bezpečnostní tým ČR"," – Doporučené postupy a analýzy incidentů se škodlivým\nkódem.",[63,1219,1220,1223],{},[181,1221,780],{"href":778,"rel":1222},[185]," – Oficiální mezinárodní příručky a dešifrovací iniciativy.",{"title":291,"searchDepth":292,"depth":292,"links":1225},[1226,1227,1228,1229,1230,1231],{"id":1010,"depth":292,"text":1011},{"id":1036,"depth":292,"text":1037},{"id":1079,"depth":292,"text":1080},{"id":1121,"depth":292,"text":1122},{"id":1160,"depth":292,"text":1161},{"id":1194,"depth":292,"text":1195},"Škodlivý kód, který zašifruje firemní dokumenty, databáze a zálohy, zablokuje provoz organizace a požaduje vysoké výkupné v kryptoměnách pod hrozbou trvalé ztráty či zveřejnění citlivých dat.","https:\u002F\u002Fplay.cyber-framework.net?scenario=ransomware","Karanténní protokol",{},"\u002Fcs\u002Fhrozby\u002Fransomware",{"title":1004,"description":1232},{"loc":1236},"cs\u002Fhrozby\u002F03.ransomware",[1241,1242,1243,1244],"Škodlivé e-mailové přílohy (Office makra, ZIP, ISO)","Zranitelnosti vzdálené plochy (RDP)","Neaktualizovaný software","Cílená infekce sítě","b9Ean1z-A5z_wU7Jsd5yaHVYYXYFkEsDJ_GWpwDb41w",[1247,312],{"title":323,"path":551,"stem":557,"description":546,"children":-1},1792020367437]