What is Ransomware?

Ransomware is a type of malware designed to prohibit an user to access the files on his computer. The malicious attackers encrypt the files and demand ransom payment for the decryption key. Few ransomware emerge with some additional functions such as data theft, providing further incentive for ransomware victims to pay the ransom. Ransomware can infect various devices such as printers, smartphones, point-of-sale (POS) terminals or any other endpoint with significant vulnerabilities. 

By time, ransomware has become a popular and prominent type of malware. We have evidenced many recent ransomware attacks which have impacted the hospitals and deny them to provide crucial services, crippled public services in cities, and caused important damage to any organizations.

How Ransomware works?

Ransomware’s task is to gain successful access to the target’s system, encrypt the files. On successful completion of the task, the attackers demand for ransom payment from the victim. Each variant of ransomware works in different stages to execute the task.

1. Infection and Distribution phase

There are numerous ways for ransomware to gain access to an organization’s system. However, ransomware tends to follow a few specific ways. The most popular of them is phishing emails. A malicious email, containing a link to a website hosting malicious download or an attachment that has a downloader function built in, is sent to the victim. If the target gets trapped into it, the ransomware is downloaded and executed on their computer. 

Another preferable ransomware infection technique takes advantage of the Remote Desktop Protocol (RDP) services. Here, the attacker uses the stolen credentials of the victim to authenticate and remotely access the target’s computer. Thus, the attacker can easily download the malware and execute it on the system under their control.

2. Encryption of Data phase

Once the ransomware has gained access to the system, it can begin with encrypting the files. Attackers encrypt the files with an attacker- controlled key, and replace the originals with the encrypted ones. Some ransomware variants delete backup and shadow copies of files to attempt recovery without the decryption key, which is a bit difficult.

3. Ransom Demand phase

Once the attacker is done with encryption, the ransomware is prepared to make a ransom demand. It often results in change in the display background  to a ransom note or text files placed in each encrypted directory containing the ransom note. Generally, these notes demand a set amount of cryptocurrency in exchange for granting access to the victim’s files. If the ransom is paid, the ransomware operator will provide a copy of the private key used to protect the symmetric encryption key or copy of the symmetric encryption key itself. The information provided by them can be entered into a decryption program to reverse the encryption and restore access to the user’s files.

Apart from these three phases discussed, some ransomware variants like Maze, performs file scanning, register information, and steal data before encryption. WannaCry ransomware scans other vulnerable devices to infect and encrypt.

Examples of Some Famous Ransomware Attacks

There are many famous variants of ransomware malware which have created a global impact and widespread damage.

• Locky- Locky has the potential to encrypt 160 file types, primarily those files that are used by designers, engineers and testers. It was first released in 2016. This is distributed by exploit kits or phishing. Attackers send emails that lures the user to open a Microsoft Office Word or Excel file with malicious macros or a ZIP file that installs the malware on extraction.
• Cerber- It is ransomware-as-a-service (RaaS), used by the malicious attackers to execute attacks and spread their loot with the malware developer. It works silently while encrypting the files and may try to prevent antivirus and Windows security features from running, to prevent users from restoring the system. When it encrypts the files successfully, it displays a ransom note on the desktop wallpaper.
• WannaCry- WannaCry is an encrypting ransomware that exploits a vulnerability in the Windows SMB protocol, and has a self-propagation mechanism that allows it to infect other machines. It is packaged as a dropper, a self-contained program that extracts the encryption/ decryption application, files containing encryption keys, and the Tor communication program. In 2017, WannaCry spread rapidly across 150 countries, affecting 2,30,000 computers and causing an estimated $4 billion in damages.
• Cryptolocker- It was released in 2017, and affected 5,00,000 computers on an average. It generally infects computers through email, file sharing sites, and unprotected downloads. Along with encrypting files on the system, it can also scan mapped network drives, and encrypt files that it has permission to write to.
• Ryuk- Ryuk infects systems through phishing emails or drive-by downloads. It uses a dropper that extracts a trojan on the target’s computer and sets up a persistent network connection. Then, the attackers can use Ryuk as a basis for an Advanced Persistent Threat (APT). This results in installation of additional tools like keyloggers, to perform privilege escalation and lateral movement. Thereafter, attackers install the trojan in many systems and activate the locker ransomware and encrypt the files.

Why are Ransomware Attacks originating?

The modern craze for ransomware began with the WannaCry outbreak of 2017. It was a large-scale attack which proved that ransomware attacks were possible and significantly profitable. Soon after that, many ransomware variants have been developed and used in various attacks. 

After the COVID-19 pandemic, the urge of ransomware attacks increased as most of the organizations at that time had gone digital. Organizations pivoted to remote work, gaps were created in their cyber defenses. Malicious attackers took the advantage of this and exploited the vulnerabilities to inject ransomware.

In the year 2023, ransomware attacks have targeted 10% of organizations globally, at an average level. This was recorded as the highest rate recorded in recent years.

How does Ransomware Attacks affect Businesses?

Ransomware attacks can affect a business severely and may create various impacts on a business. The common impacts are discussed below:

• Data loss: Ransomware attacks encrypt the data as a part of their extortion efforts. This, in turn, results in data loss, even after payment of ransom and receiving a decryptor.
• Data Breach: The attackers are mainly pivoting to double or triple extortion attacks. These attacks indulge in data theft and potential exposure along with data encryption.
• Financial Loss: Ransomware attacks are executed to force the target to pay a ransom. Also, the organizations may cost in remediating the infection, lost business, and potential legal fees.
• Brand Damage: These types of attacks can have an impact on the reputation of the business with customers and partners, as these attacks involve breach of customer data.
• Downtime: Ransomware encrypts sensitive data, and triple extortion attacks may inject DDoS attacks. These can cause significant operational downtime for an organization.
• Legal and Regulatory Penalties: Ransomware attacks are often caused due to negligence in the security panel, which may result in breach of critical data. Regulators can penalize the company and sue on legal grounds.

How to prevent Ransomware Attacks?

There are several practices which can help you protect against Malware and Ransomware attacks. Some of them are discussed below:

1. Endpoint Protection- For protection against ransomware, anti-virus is an obvious step. But anti-virus can only protect against some variants of ransomware. Modern endpoint protection platforms provide protection against obfuscated ransomware and fileless attacks like WannaCry, or zero-day malware whose signature is not found in malware databases. They also provide device firewalls and Endpoint Detection and Response (EDR) capabilities, thus, helping security teams to detect and block attacks emerging on endpoints in real time.
2. Data Backup- Backup your data regularly to an external hard-drive, using versioning control and the 3-2-1 rule (create three backup copies on two different media with one backup stored in a separate location). You can disconnect the hard-drive from the device to prevent encryption of backup data.
3. Application Whitelisting and control- Keep a setup of device controls that allow you to limit applications installed on the device to a centrally-controlled whitelist. You can enhance your browsing security settings, disable Adobe Flash and other vulnerable browser plugins. Use web filtering to prevent users from visiting malicious sites.
4. Patch Management- Always keep your operating systems and installed applications updated and install security patches. Perform vulnerability scans to find known vulnerabilities and remediate them soon.
5. Email Protection- Organizations must train their employees to recognize social engineering emails, and perform drills to test if they could identify and avoid phishing. Use spam protection and endpoint protection technology to automatically block suspicious emails, and block malicious links, if the user clicks on them.
6. Network Defenses- Use a firewall or web application firewall (WAF), Intrusion Prevention/ Intrusion Detection Systems (IPS/ IDS), and other controls to prevent ransomware from communicating with Command and Control centers.

Want to start your learning journey on Cyber Security and Ethical Hacking field?