- Timeline
- Timeline
- How it Works
- Attack Types
- Impacts
- Protection
- Removal
What is Ransomware?
Ransomware is a type of malware that blocks access to victims' files, applications, and other network areas. It is called ransomware because bad actors demand payment, or a ransom, to restore access. Several terms refer to ransomware, including:
- Ransomware as a Service (RaaS): A subscription model for deploying ransomware attacks, often exchanging profits for services.
- Triple Extortion: When adversaries demand additional ransoms to prevent the leak of information gathered during their attacks, this often includes a payment to keep information private, a second payment to decrypt data, and a payment from victims of the breach to keep their personal data secure.
- Ransomware Payments/Settlements: Monetary payments to adversaries to decrypt data and allow access again. These are often requested as cryptocurrency to avoid tracking. It is not recommended to pay these ransoms, as there are no guarantees that your data will actually be decrypted upon payment.
Ransomware Timeline
The first known deployment of ransomware occurred in 1989 when Dr. Joseph Popp, an evolutionary biologist, sent 20,000 floppy disks infected with a computer virus to attendees of the World Health Organization's International AIDS Conference. Once loaded onto the computer, the virus locked files, hid directories, and demanded a $189 payment to a Panamanian P.O. Box for restored access.
Ransomware exploded in prevalence and sophistication in the mid-2000s, with numerous evolutions in the space. From 2005 to 2020, it exploded in use and complexity, making it a go-to tactic for bad actors. It quickly became one of the most commonly used tools for cybercriminals during cyberattacks, creating headaches for organizations worldwide.
The sophistication and use of ransomware continue to rise, with more complex and devastating attacks striking enterprises and service providers worldwide. As attacks get more complex, the sums of money demanded as ransom increases. Triple and even quadruple extortion are becoming commonplace to maximize the gains from these attacks.
How Does Ransomware Work?
Ransomware infiltrates your operating system and encrypts files and folders to block access. It is installed on servers and endpoints through multiple methods of breaching the system, including phishing, brute force, and more. Once ransomware bypasses cybersecurity measures and is installed on your device, cybercriminals demand a ransom to decrypt and allow access back to your files or devices.
Types of Ransomware Attacks
Several types of ransomware attacks can plague a variety of systems. Some examples include:
- Locker Ransomware: Impacting Microsoft Windows systems, Locker ransomware completely kicks the owner out of a device in place of encrypting files. This is commonly accomplished by getting a user to download malware via social engineering tactics, granting access to the target system.
- Crypto Ransomware: Also impacting Windows systems, Crypto ransomware encrypts files once the malware is downloaded, demanding cryptocurrency as a ransom payment to unlock them. The malware is typically delivered via infected email attachments.
- Extortionware: Impacting a variety of systems, including Windows, macOS, Linux, and some IoT devices, Extortionware is used to lock down a device, copy private information, and threaten to leak it if ransom is not paid.
- Scareware: This type of ransomware can infect Android, macOS, and Windows devices. It accomplishes its goals by tricking a device owner to download a product or service to resolve an issue. It does so by opening faked websites that show a popup or message of scan results or other fear-mongering language to drive swift action. Once the popup is engaged with, it downloads the malware, enabling adversaries to infect your device.
Impact of Ransomware
Ransomware affects all individuals and businesses differently. Two common threads, however, are stress and resource strain.
Impact on Individuals
Individuals impacted by ransomware can suffer from mental health issues due to the stress of an attack. Dealing with upset customers, cybercriminals, and loss of trust takes a toll on the mental health of those who combat ransomware. Individuals also have to reallocate resources from other efforts to combat a ransomware attack, further increasing stress and forcing other focus areas to suffer.
Impact on Businesses
The impact on businesses is more tied to financial stress. This stems from the cost of combatting a ransomware attack as well as revenue loss due to lost trust or the inability to access key servers or files. Resource strain is also prevalent, as it takes a strong, coordinated effort to remove and recover from a malicious ransomware attack.
How to Protect Against Ransomware
The primary way to protect against a ransomware attack is to take preventative measures. These include training staff on topics like spotting a phishing email. Maintaining strong IT best practices to ensure networks stay secure and available is also paramount. This includes having a strong security stack, including endpoint detection and response (EDR) and network detection and response (NDR) platform, to maintain strong visibility across the network and the devices connected to it.
Removing Ransomware
The key to removing ransomware is swift detection. Should the malware infiltrate the network, a strong NDR solution can help identify a ransomware attack in short order. Several other ways a ransomware infection can be detected, including anti-virus alarms, file name changes, file extension changes, encrypted files, or increased CPU usage.
Once a ransomware attack has been detected, it is time to remove it. There are three primary methods to do so:
- Reset the computer to factory settings, losing all files
- Pay the ransom and hope the adversary keeps their word and decrypts your files (not recommended)
- Use available tools to remove the ransomware
There are several steps to take to remove the ransomware, and the process can be arduous. First, you must disconnect the infected device(s) from the internet and all other storage media to prevent the spread of ransomware across the network. Next, an investigation is needed to discover where the threats are and what types of malware are on the device(s). From there, you can quarantine and/or remove malicious files. A ransomware decryption tool can help decrypt files that have been locked by ransomware. Finally, you should restore any available backups of non-encrypted files. If a backup is not available, it can be significantly more difficult to recover fully from a ransomware attack.
How NETSCOUT Helps
NETSCOUT offers advanced NDR solutions to identify threats and malicious activity across complex networks quickly. Malware can be detected in short order with Omnis Cyber Intelligence due to its comprehensive network visibility capabilities. Learn more, and get a demo today from NETSCOUT.