What is Ransomware?

Ransomware is malware that uses encryption to hold victims’ information for ransom. Valuable data from victims are encrypted so they can’t access files, databases, or applications. Then threat actors demand a ransom in return for access to the data. Ransomware is developed to spread through the network targeting databases and file servers, resulting in a massive disruption throughout an entire organization. Ransomware has become a growing threat as cybercriminals are raking in billions of dollars in payments and causing significant damage to businesses and government organizations.

How does ransomware work?

Ransomware utilizes asymmetric encryption called cryptography, which uses encryption and decryption keys on victims’ files. These public-private keys are developed uniquely by the attackers for each victim with the private use to decrypt files stored on the attacker’s server. Once the files are encrypted, the group demands the victim to pay the ransom within 24 to 48 hours or risk losing the data forever. Sometimes victims are faced with paying the ransom to recover their data if a backup is unavailable or the backups themselves are encrypted. If the ransom is paid, the attackers provide the victims with the private key, without which file decryption is impossible.

There are numerous variations of ransomware in the world with some distributed through email spam campaigns or targeted attacks. For ransomware to be implemented, malware needs an attack vector to establish its presence on an endpoint.

Once its presence is established, malware will stay on the system until it completes its tasks. After the exploitation is successful, ransomware drops and implements a malicious binary on the infected system. The binary searches and encrypts valuable files including documents, images, and databases. Additionally, ransomware may exploit network and system vulnerabilities, spreading to other systems and even the entire organization.

Why is ransomware spreading?

There are several reasons why ransomware attacks and their variants are continuing to evolve to counter preventive technologies.

• Malware kits used to develop new malware samples are more widely available
• Using known generic interpreters to create cross-platform ransomware
• Using new techniques to encrypt the entire disk instead of selected files

Ransomware marketplaces are appearing online offering new cybercrooks malware strains and generating extra profit for authors looking for a cut of the ransom payments.

Why is it difficult to find ransomware criminals?

Following the money trail and tracking down cybercriminal groups can be difficult because most of them use anonymous cryptocurrencies like Bitcoin and develop schemes for quick profit. With open-source code and drag-and-drop platforms available for development, the creation of new ransomware variants has accelerated. This has helped amateur scripters develop their own ransomware. Ransomware is usually polymorphic by design, allowing cybercriminals to bypass traditional signature-based security built on file hash.

What is ransomware-as-a-service (RaaS)?

Ransomware-as-a-service (RaaS) is an economic model malware developers utilize to earn money for their creations without having to distribute their threats. Non-technical criminals would buy their products to deploy the infections and pay the developers a percentage of the ransom payment. Customers do much of the work while developers run minimal risks. Some RaaS use subscriptions and others require registration to access the ransomware.

How to defend against ransomware

Follow these tips to avoid ransomware and mitigate damage in case of an attack.

• Back up your data. Having backup copies of your critical files in the cloud and on an external hard drive is the best way to avoid being locked out. You can wipe your computer or device in case of infection and reinstall your backup files. This way you can protect your data and avoid paying malware authors a ransom.
• Secure your backups. Ensure your backup data can’t be accessed for modification or deletion from the systems on which the data is stored. Ransomware will search to encrypt or delete data backups so they can’t be recovered. Use backup systems that deny direct access to backup files.
• Use and update security software. Protect all your with comprehensive security software and keep all software updated. Update your devices’ software whenever possible.
• Practice safe searching. Avoid responding to emails and text messages from unknown sources, and only download applications from trusted sources. Malware authors will use social engineering to deceive people into installing dangerous files.
• Use secure networks. Avoid public Wi-Fi networks because cybercriminals will spy on your internet usage. Consider installing a VPN, which provides a secure connection to the internet no matter where you go.
• Stay Informed. Stay current on the latest threats. In case of ransomware infection, tech companies will help victims by offering decryption tools.
• Implement a security awareness program. Have security awareness training for each employee and vendor regularly to avoid phishing and other social engineering attacks. Conduct regular drills and tests to ensure the training is being observed.
• Purchase 24/7 monitoring. Partner with a cyber counterintelligence company, like SpearTip, which offers 24/7 monitoring in a security operations center (SOC) and offers an endpoint detection and response (EDR) tool. These tools increase network availability and provide immediate remediation to cyber threats.

Having basic knowledge about ransomware and how they are implemented will help companies stay current with the latest threat landscape and improve their network’s security posture. At SpearTip, our certified engineers continuously monitor your networks 24/7 at our Security Operations Centers for potential threats. Being proactive is the most effective way to protect your company’s data. SpearTip’s ShadowSpear, our endpoint detection and response platform, is a great proactive tool to prevent ransomware from encrypting your data. To learn more about how SpearTip defends you from malware, reach out at info@speartip.com.

If your company is experiencing a breach, call our Security Operations Centers at 833.997.7327 to speak directly with an engineer.