What is Ransomware?
Ransomware is a type of malicious software that encrypts files on a victim’s computer and demands a ransom payment in order to decrypt the files. Ransomware attacks have increased in frequency in recent years, targeting both individuals and organizations.
Ransomware is considered a huge threat because it can completely paralyze a business or individual by denying access to important data and systems. The ransom demand is often made in cryptocurrency, such as Bitcoin, to maintain the attacker’s anonymity.
Some common ransomware variants include CryptoLocker, CryptoWall, Locky, SamSam and Ryuk. However, new strains of ransomware are constantly being developed and deployed by cybercriminals.
How Ransomware Works
Ransomware typically spreads through phishing emails containing malicious attachments or links. Once activated, the ransomware will rapidly encrypt designated file types across local drives and mapped network drives.
Encryption algorithms used by ransomware are often complex and use asymmetric cryptography to generate public and private keys. Restoring files without the decryption key is next to impossible.
After encrypting files, the ransomware displays a ransom note demanding payment, usually within a short timeframe. The ransom demand often increases if payment is not made quickly. Ransomware threat actors will sometimes threaten to delete files if payment is not made.
CryptoLocker, CryptoWall and other ransomware families also try to encrypt files in accessible cloud storage folders like Dropbox to maximize impact.
Preventing Ransomware Attacks
There are several best practices individuals and organizations can follow to prevent and mitigate ransomware attacks:
-
Install reputable antivirus software and keep signature definitions up-to-date to detect known ransomware variants before encryption occurs. Use scanning and real-time protection features.
-
Keep all software, including operating systems, up-to-date with the latest security patches. Unpatched software vulnerabilities are often exploited to deliver ransomware.
-
Be wary of unknown email attachments and links, especially compressed files like ZIP files. Scan attachments with antivirus software before opening.
-
Exercise caution with email attachments even if the sender appears to be someone you know. Accounts are sometimes compromised.
-
Disable macro scripts in Microsoft Office to eliminate a common ransomware infection vector. Consider Office macros a security risk.
-
Back up critical data regularly. Store backups offline and immutable to prevent ransomware encrypting backups too. Test backups periodically for integrity.
-
Use email security and spam filtering solutions to block malicious emails and phishing attacks designed to spread ransomware before they reach end users.
-
Restrict write permissions and disable execution of macros from internet zones for Office applications via Group Policy. Limit users’ ability to install unauthorized software.
-
Ensure robust firewall and IPS systems are enabled to help prevent outside attackers from infiltrating your network with ransomware. Focus on remote access points.
-
Train employees to recognize phishing attacks. Launch simulated phishing campaigns to identify gaps and improve user awareness.
Recovering from a Ransomware Attack
If ransomware encryption occurs before detection, organizations have several options:
-
Isolate the infection to prevent wider spread across networks then disable network shares, remove infected nodes, and disable backups to avoid backup encryption.
-
Investigate if a decryptor is available from a reputable source. Free decryption tools exist for some ransomware families but must match the exact strain.
-
Restore from clean backups to return to the most recent unaffected state if the backups were not encrypted and are intact. This may result in some data loss between last backup and infection.
-
If all else fails, payment of ransom may be the only way to recover encrypted files. This is controversial, does not guarantee files can be decrypted, and encourages future attacks. Cyberinsurance may cover ransom payments.
-
An encrypted system may need to be wiped and reimaged, with data restored from backups. If backups are encrypted, data may be irrecoverable without paying the attackers.
Summary
-
Ransomware is a serious cyber threat that encrypts files and demands ransom payment for decryption. New strains are constantly developed.
-
Prevention is critical since file recovery without decryption keys is difficult. Security awareness training, keeping software updated, avoiding suspicious email attachments, restricting Office macros, and comprehensive backups are key.
-
If infected, isolate the ransomware, disable network shares, remove affected nodes and investigate decryption options. Restoring from clean backups provides recovery without paying ransoms.
Ransomware events can significantly impact business operations and revenue. However, focusing on ransomware prevention, mitigation, response planning and user training will help reduce the likelihood of a successful attack. Maintaining offline backups and emergency response plans will enable restoring business operations quickly if ransomware strikes.
