Ransomware has been a prominent threat to individuals, enterprises, as well as small and middle businesses alike since the mid-2000s. According to the FBI, the Internet Crime Complaint Center (IC3) received 1,783 complaints in 2017 with a total cost of over $2.3 million. However, these complaints only represent attacks reported to the IC3.
The actual number of attacks and their costs are much higher with many organizations choosing to handle things internally to avoid any public or stakeholder backlash that could damage their reputation. According to Statista, 2017 had an estimated 184 million attacks.
Initially, ransomware targeted individuals, who still make up the majority of attacks up to date. Along the way, however, attackers started targeting institutions that could not carry out operations without the full access of their data, which include hospitals, universities, and government offices. In this article, we will discuss all about ransomware, how to prevent it, what to do if you are infected, and the importance of backups.
What is Ransomware?
It is a type of malware that is uniquely designed to lock you out of your computer system or to encrypt your data so that you cannot access it. It can, further, take advantage of your operating system’s vulnerabilities and spread to other networks or systems.
Once ransomware has successfully infected your computer systems, the individual behind the attack will then demand a ransom (hence the name) to relinquish all access to, and control of, your systems or decrypt your data. Some types of ransomware include crypto malware, lockers, scareware, Doxware (leakware), and Ransom-as-a-service (RaaS).
These cybercriminals usually launch such attacks from afar and demand untraceable, non-refundable payments in the form of cryptocurrencies such as bitcoins. In some latest ransomware attacks, the criminals have gone a step further to ask for payment in the form of gift cards such as Google Play or Apple iTunes, which can later be converted into merchandise or cash.
Unfortunately, successful ransomware attacks rarely leave digital evidence behind that can be used to trace the perpetrators or recover the monies paid out. Furthermore, there is no guarantee that your data will be decrypted in full even if you pay the ransom.
The History of Ransomware and Its Evolution
The first incident can be dated back to 1989 when, supposedly, a Harvard-educated biologist infected the computers of several attendees of the WHO’s Internal AIDS conference. From the mid-2000s, cybercriminals have become more creative with their attacks, and after 2012, ransomware spread globally with the use of asymmetric RSA encryption.
Today, ransomware varieties have become increasingly advanced when it comes to their capabilities for encrypting files, evading detection, spreading across systems, and coercing ransoms from users. The new age of attacks involves advanced development techniques such as the use of crypters to make reverse-engineering extremely difficult or the use of advanced distribution efforts including pre-built infrastructures that widely and easily distribute new varieties.
Spear-phishing campaigns are quickly replacing traditional phishing email blasts since the latter are now frequently filtered out as spam mail. More sophisticated attackers have developed downloadable toolkits that can be deployed by persons with less technical skills. Other forms of ransomware-monetizing schemes include RaaS programs that have revolutionized CryptoLocker, Locky, CryptoWall, and TeslaCrypt.
Additionally, attackers are now using offline encryption methods that take advantage of legitimate system features (like Microsoft’s CryptoAPI) to eliminate the need for command and control communications.
How Do You Get Ransomware?
Ransomware can be spread in many ways with the most common being phishing emails containing malicious attachments. Here, email attachments come masquerading as legitimate files from a trusted source. Once you download and open an infected file, it can take over your computer especially if it has a built-in social engineering tool to trick you into allowing administrative access. Other more aggressive types of ransomware families exploit security holes in your system to infect and encrypt your computer without the need for any trickery.
Attackers also use deceptive messages on social media to gain access to victims’ computers. One of the most common channels used is Facebook Messenger. Here, the attacker creates an account that mimics one of your current friend’s. They then send messages with file attachments. Once opened, the attacker gains access to your device and locks down all connected networks.
Your computer can also be infected through drive-by downloading. This occurs when you unknowingly visit an infected website resulting in malicious software download and install without your knowledge. Your attacker can then encrypt data on your machine.
One variant called crypto-ransomware is used to encrypt your files and spreads similarly through social media (think web-based instant messaging apps). Other infection methods include exploiting vulnerable Web servers to gain access into your organization’s network and using online pop-ups.
Once an attacker has taken over your computer systems, the first thing they do is to lock or encrypt your files. At the end of the attack, your files cannot be opened or decrypted without a key known only to your attacker and probably stored on their system.
At this point, you will receive a message explaining the inaccessible state of your files and a ransom demand for money through an untraceable payment method such as cryptocurrency. Sometimes, your attacker may be creative enough to assume the identity of a law enforcement agency and claim to have shut down your systems due to the presence of illegal content such as pirated software or pornography. They then demand payment in the form of a fine.
In a leakware or doxware attack, your attacker will threaten to publicize any sensitive data on your device unless you pay them. However, since finding and extracting such data requires technical expertise, the most common types of attacks are encryption-related.
Who Do Ransomware Authors Target?
Ransomware has evolved over the years from simple email attachments to infected websites, mobile apps, and even digital advertisements. Its effectiveness has increased its demand over the Dark Web where it is sold as ransomware-as-a-service (RaaS) portals. Potential targets include:
- Hospitals: The healthcare industry is perhaps the biggest target due to the sensitivity of its data. If healthcare data is left inaccessible, it can lead to severe repercussions including death.
- Mobile Users: The overdependence on mobile devices has left these gadgets vulnerable to malware attacks. These devices store a lot of personal data, which makes it easy for attackers to compromise our connected lifestyle for personal gain. Downloading compromised mobile apps leads to the decryption of your device.
- The Government: Government offices hold a plethora of critical data making them the perfect victims of attacks. What’s more, perpetrators know that these organizations must remain operational at nearly all times.
- Education Institutions: These institutions are targeted because they not only hold critical data but also have less control over the devices that connect to their networks.
- Energy and Utility Companies: These sectors are attacked for the same reason as government organizations - they have sensitive data and must remain operational.
Why Do You Need Ransomware Protection?
According to the U.S. Department of Justice, this cybercrime has the potential to cause global-scale impacts. Like most other malware, ransomware often infects a computer system by clicking unsafe links or downloading unsafe programs.
However, unlike other malware attacks, it is not removed when you flash your BIOS, wipe your drive, or attempt to return your OS to a prior restore point. The program locks your files before the ransom demand is made. At the same time, the attacker creates a unique decryption key and stores it on his or her servers.
Failure to pay the ransom on time or any attempt to alter the encryption program leads to the permanent deletion of the decryption key, which renders all your locked files inaccessible. More often than not, most similar attacks only end when the victim pays the amount demanded.
Though you can still use an infected computer, the risk of losing valuable data can significantly impact productivity. Other impacts of this attack include:
- Loss or destruction of your critical information.
- Business downtime.
- Damage of hostage systems, files, and data.
- Business disruption during the post-attack period.
- Loss of company reputation.
How to Prevent Ransomware
Ransomware can be scary since you stand to lose critical personal and business data in the process and may result in other short-term and long-term effects even if you pay the ransom. However, there are a few anti-ransomware strategies that you can use to protect yourself and your business.
1. Back Up Your Data
Do not store all your data in one place. Regular data backup is necessary because it allows you to restore any lost data as a result of ransomware attacks and other disasters. Note that CryptoLocker also finds and encrypts data on drives that are mapped. Ergo, you need a regular backup schedule to an external backup service or drive that has no assigned drive letter or is disconnected when no backup is ongoing.
2. Show Hidden File-Extensions
CryptoLocker frequently arrives in a file named with a “.PDF.EXE” extension because attackers count on windows’ default behavior of concealing or hiding known file-extensions. Therefore, by enabling your computer’s ability to see full file-extensions, you can easily spot suspicious ones.
3. Disable Files Running from Local AppData or AppData Folders
One particular notable CryptoLocker behavior is to run its executable files from Local AppData and AppData folders. Thus, you can create rules within your system, either through Windows or an intrusion prevention software, to disallow this behavior. You can always exclude legitimate program files that run from the AppData area.
4. Filter EXEs in Email
If you have a gateway mail scanner with the ability to filter files received by extensions, it may be advisable to deny emails with the “.exe” file-extensions or any files sent with more than one file extension – where one is an executable extension.
If you legitimately need to receive or send executable files within your environment after denying emails with “.exe” extensions, you can opt to use ZIP files that are password protected or exchange emails via cloud services.
5. Disable RDP
Cryptolocker/Filecoder accesses target machines via Remote Desktop Protocol (RDP). This is a Windows utility that allows other users to access your desktop remotely. Disabling RDP can go a long way in protecting your machine from remote attacks.
6. Train Your Employees
Security is always a shared responsibility between you and your employees. Therefore, always ensure that you carry out routine, updated employee training on your system and network security, threat-assessment, and their role in fighting cybercrime.
7. Patch or Update Your Software
Malware authors often count on people running outdated software that has known vulnerabilities they can exploit for their personal or financial gain. Regular software updates can significantly decrease the potential for attacks. This is because some vendors release regular security updates as well as emergency updates.
You can enable automatic updates or manually visit a vendor’s website to get updates. Beware that perpetrators also like to disguise their software as update notifications.
8. Use an Effective Security Suite
Having both a software firewall and anti-malware software can help you identify a potential threat or suspicious behavior. You need both defense layers because malware authors often send out new variants to avoid detection.
Most malware types rely on remote instructions to execute. If you happen to find a new ransomware variant that has gotten past your security software, the chances are that it won't get past your firewall as it attempts to connect remotely with its Command and Control (C&C) server.
9. Prevent Unauthorized Access
There are several preventive steps that you can take to avoid unauthorized access. These security practices can significantly improve your defenses and protect you from all sorts of cyber attacks. They include:
- Never install any software or give administrative privileges unless the software is from a trusted source and you know what it does.
- Install antivirus software to enable your system to detect malicious program as they arrive.
- Install whitelisting software to prevent unauthorized applications from executing.
10. Use Sensible Restrictions
You should place certain limitations on any contractor or employee who:
- Works with devices containing company records, files, or programs
- Uses devices attached to your networks and that could be made vulnerable
- Is a third-party or temporary worker
11. Use Proper Credential Tracking
Any person, employee, or contractor with access to your systems creates a potential vulnerability point for attackers. Turnover, improper restrictions, and failure to update your passwords can result in higher attack probabilities.
Detecting Ransomware Strategies
You need to put in place a multifaceted detection system to ensure comprehensive protection. It should have endpoint protection for user systems, intrusion detection, enterprise virus protection for servers, known malware detection, central logging for event correlation, network port monitoring, and data pattern-detection.
The quick detection of malicious activity allows for immediate containment before it spreads and causes further harm. All your infected systems should be quarantined, remediated, and restored. Sometimes, your systems may not capture a successful ransomware attack until it is too late and you are locked out of your data. Even your backups may be compromised rendering them useless.
Therefore, your system administrators need to remain vigilant during the detection stage to enable them to quickly start containment measures to stop the attack and restore encrypted data. System administrators should also install effective third-party tools that help detect attacks.
Unfortunately, there is no 100 percent guarantee when it comes to cybersecurity. No matter how well your IT department is at the detection and prevention stages of an attack, occasionally, successful attacks happen that force organizations into the recovery stage.
Here, the recovery time is dependent on how widespread the attack was and your level of preparedness. Regardless of scale, from the encryption of a few files to the loss of an entire site's data, it is usually your most critical data that is targeted. Your disaster recovery procedures and tools will be used and tested throughout the whole process.
How to Defend against Ransomware Attacks
Effective ransomware defense ultimately depends on education. You should take the time to learn more about your best options for software updates and automated data backups. Educating yourself and your employees on the telltale signs of a threat or attack and distribution tactics such as spoofed websites, drive-by downloads, and phishing attacks should be your top priority.
You also need to implement security solutions that allow advanced threat protection. Endpoint Detection and Response (EDR) tools are perfect for monitoring activities on your networks and endpoints to identify, protect, and mitigate threats. NetBackup tools also go a long way in detecting and preventing ransomware and other attacks.
There are three types of Ransomware clean-up and preventive tools. The first category is disinfection tools for computers that need clean certification before you can restore data after an incident. This feature is present in many mainstream anti-virus programs.
The second category comprises of decryption tools that are launched once an attack is successfully underway. Unfortunately, these tools are limited and remain dependent on researchers recovering attackers’ individual key databases once they are caught.
The third category is protection tools that use behavioral analysis to spot events suggestive of ransomware presence on a system and have it intercepted before any damage is done.
Some of the best ransomware tools today include Veritas NetBackup appliances, the Trend Micro lock screen tool, Avast tools, BitDefender, Kaspersky tools and Lab decryptors, AVG decryption tools, Webroot SecureAnywhere tools, Malwarebytes, McAfee Interceptor Review, No More Ransom, and CryptoPrevent.
Testing Anti-Ransomware Tools
Testing the effectiveness of ransomware protection tools against real samples is incredibly tricky. Moreover, some tools are specific to particular past incidents that may not be active today.
However, perhaps the best way to test these tools’ effectiveness is to set up a virtual machine (VM) that matches your system environment and has no actual network access. From here, you can test for different attack situations and use restore points from your backups (such as Veritas NetBackup appliances) to see their effectiveness.
The Bottom Line
Crypto-ransomware targeting computer systems has turned into a mass phenomenon in recent years. Without proper ransomware protection tools and training, by the time you see the ransom demand, it is already too late to pull the plug and stop further compromise. The outbreak of different varieties such as WannaCry/NotPetya has shown the extensive damage that a highly distributed attack can do.
While antivirus programs are presently better tuned to detect and block some types of ransomware (usually by watching out for suspicious behavior) having the right type of backup remains the number one defense against this and other malware attacks. Veritas NetBackup Appliances has a range of products that help you prevent and detect attacks as well as recover your data.
Veritas customers include 98% of the Fortune 100, and NetBackup™ is the #1 choice for enterprises looking to protect large amounts of data.
Learn how Veritas keeps your data fully protected across virtual, physical, cloud and legacy workloads with Data Protection Services for Enterprise Businesses.
Also recommended for you:
Need a ransomware protection plan for your organization? We can help.