{"id":16980,"date":"2023-10-03T16:45:02","date_gmt":"2023-10-03T14:45:02","guid":{"rendered":"http:\/\/nfirjun2026.local\/press-release-melissa-a-collaborative-ransomware-fight\/"},"modified":"2024-02-12T14:10:43","modified_gmt":"2024-02-12T13:10:43","slug":"press-release-melissa-a-collaborative-ransomware-fight","status":"publish","type":"post","link":"https:\/\/www.cyber-security-online.nl\/en\/press-release-melissa-a-collaborative-ransomware-fight\/","title":{"rendered":"Melissa: a collaborative ransomware fight"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t<\/p>\n
<\/div>\n

\n The Public Prosecutor’s Office (OM), the police, the National Cyber Security Center (NCSC), Cyberveilig Nederland and several private parties* from the cybersecurity sector signed the ‘Melissa’ covenant today. Melissa is a partnership between these public and private parties to combat ransomware attacks. The common goal is to make the Netherlands an unattractive target for ransomware criminals.<\/b>\n <\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Melissa:\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ransomware is hostage software that cybercriminals use to encrypt individuals’ or organizations’ data so that it is no longer accessible. Sensitive information is also often stolen. Only after paying a ransom (“ransom”) does one regain access to the data.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

First results of partnership<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The partnership involves the parties exchanging information with each other on a structural basis and sharing and discussing current developments more frequently. The Melissa covenant sets out the legal, organizational and technical arrangements of this partnership. The collaboration began back in 2021 and previously led to successful operations such as Deadbolt<\/a>, Genesis Market<\/a> and most recently Operation Qakbot<\/a>. There were also achievements in the tactical area such as the creation and sharing of statistics <\/a>on ransomware attacks, published white papers Exfiltration v3.<\/a> 0 and Ransomware <\/a>and best practices, for example.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Disruption of society<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ransomware attacks can disrupt our society: businesses are shut down, hospitals can no longer provide care, important personal data is stolen from municipalities or other organizations. This stolen data can be sold or used for other forms of (cyber) crime, such as identity theft. Moreover, our national security may be compromised if vital systems are threatened with failure. Consider access to drinking water, electricity, the Internet and payments that are essential to the daily lives of most people in the Netherlands. Thus, many people and organizations can become victims, and the social impact of ransomware attacks is enormous.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Disruption of society<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Ransomware attacks can disrupt our society: businesses are shut down, hospitals can no longer provide care, important personal data is stolen from municipalities or other organizations. This stolen data can be sold or used for other forms of (cyber) crime, such as identity theft. Moreover, our national security may be compromised if vital systems are threatened with failure. Consider access to drinking water, electricity, the Internet and payments that are essential to the daily lives of most people in the Netherlands. Thus, many people and organizations can become victims, and the social impact of ransomware attacks is enormous.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Vulnerability organizations<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Many organizations think they are not targets for ransomware attacks, for example, because their data would not be of interest to criminals. The opposite is true: without proper digital security, everyone is vulnerable. It is therefore of great importance to our society that we join hands to fight this serious form of crime in a more targeted way, increase the chances of catching cyber criminals and reduce the chance of impact for victims.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Prevention is better than cure<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

To prevent ransomware criminals from successfully striking, it is necessary to properly secure systems. For example, in addition to detection such as network monitoring, it helps to install a good anti-virus program. Also, a good disaster recovery plan and keeping software up-to-date can often prevent or reduce a lot of suffering. The NCSC <\/a>website includes information on how to take preventive action and what to do to mitigate the effects of an attack. When individuals or organizations do fall victim to ransomware, it always makes sense to report it to the police as soon as possible. Reporting helps minimize the damage suffered, prevent new victims and track down criminals. How to report and proceed can be found on the police.com<\/a> website.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Expanding partnership<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The covenant is the starting point to develop operational The cooperation between the public-private parties on a structural basis. This is done from one shared vision to work towards a digitally secure Netherlands where parties are mindful of each other’s interests. All parties are working hard on new products, knowledge sharing, more joint operations and ransomware\/cybercrime publications for the benefit of the Netherlands’ resilience.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Would you like more information about NFIR & project Melissa? Then contact us<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\n\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tContact with NFIR<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Q&As signing covenant 'Melissa'<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat is ransomware?<\/a>\n\t\t\t\t\t<\/h3>\n\t\t\t\t\t

Ransomware is hostage software that cybercriminals use to encrypt individuals’ or organizations’ data so that it is no longer accessible. Only after paying a ransom (“ransom”) will you regain access to the data. Ransomware attacks can disrupt our society: businesses are shut down, hospitals can no longer provide care, important personal data is stolen from municipalities or other organizations. This stolen data is sold or used for other forms of (cyber) crime. Moreover, our national security may be compromised if vital systems are threatened with failure. Thus, many people and organizations can become victims, and the social impact of ransomware attacks is enormous.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhy is structural cooperation necessary? <\/a>\n\t\t\t\t\t<\/h3>\n\t\t\t\t\t

There is currently too little insight into the extent of the threat of ransomware and other forms of cybercrime for the Netherlands. This is partly due to the lack of information (sharing) and joint analysis by the parties with a role in combating this type of cybercrime. Parties all have “pieces of the puzzle,” but they are not adequately put together. This stands in the way of effective control.<\/p>\n

A chain-wide approach is needed, from prevention to investigation and prosecution. Through the partnership “Melissa,” we aim to make this a reality. We want to combat ransomware and other related forms of cyber-attacks more effectively and efficiently by bringing together the expertise of public and private organizations. How we do that? By sharing better information about threats and incidents, by cooperating better in the event of incidents and, in addition, providing effective action perspectives to society, which we have obtained from shared experience.<\/p>\n

By sharing relevant information with each other, we as collaborating parties will have a more complete overview of the chain of attack, and the operational and tactical information associated with it. This allows us as a chain to optimally perform our public duty, serve the public interest and prevent and limit damage.<\/p>\n

The Police, the Public Prosecutor’s Office (OM), the National Cyber Security Center (NCSC), Cyberveilig Nederland (CVNL) and several private parties from the cybersecurity sector have been working hard for the past year and a half on this public-private partnership called “Melissa. Cybersecurity companies operate on the front lines against criminals and other malicious actors who cause great harm to Dutch interests and economy. By working better together and sharing more information with each other, we can really make a difference and make the Netherlands an unattractive target for cybercriminals.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhy is the partnership called \"Melissa\"?<\/a>\n\t\t\t\t\t<\/h3>\n\t\t\t\t\t

While setting up the collaboration, it emerged that several organizations were dealing with a negotiator named “Melissa” in contacts with cybercriminals. Melissa appeared to negotiate on behalf of several cybercriminal organizations: information that was very useful to both private and public parties. The continued cooperation and creation of the covenant was therefore named “Melissa.<\/p>\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t\t\t\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t<\/i><\/span>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\n\t\t\t\t\t\t\t\t\t\t\t\tWhat exactly does the collaboration entail? <\/a>\n\t\t\t\t\t<\/h3>\n\t\t\t\t\t

The goal of the Melissa partnership is to make the Netherlands an unattractive target for the ransomware attack chain. To achieve this objective, we will:<\/p>\n