Ransomware

How is ransomware delivered?

Ransomware has become a malware of choice for cybercriminals due to how effective it has been. And with the advent of Ransomware-as-a-Service (RaaS), it has become relatively easier to buy and launch. RaaS allows people who want to launch an attack without any technical skills to just pay experts to do it for them. These providers want repeat business so they make sure their code is top quality. It is now easier to launch an attack, and this combined with the fact that people are willing to pay, means these attacks are on the rise.

Cybercriminals have come up with many innovative ways to breach cybersecurity, but statistically speaking, these are the most common means that cybercriminals employ to attack their victims.

• Phishing: Over the past few years, phishing has become the most common delivery mechanism for cybercriminals to spread ransomware. In 2021, Statista reported that 54% of ransomware attacks were delivered through phishing.
  
  Through this method, hackers imitate trusted sources using personalized and carefully crafted emails typically designed to imitate emails from consumer companies the victim is likely to deal with (such as a courier service or an OTT platform) or from managers in their companies to trick victims into opening an attachment or link that contains malware. Once the attachment or link is opened, hackers then gain control of the functions necessary to encrypt the victim’s data. With more advanced forms of ransomware, the malware will begin to spread to other machines once it has gained a foothold on one machine. This method has become extremely successful because all it takes is an unknowing employee to open a seemingly trustworthy link or attachment and the whole organization can be compromised.

• Drive-by downloads from suspicious websites: Sometimes when users visit suspicious websites, malicious downloads can take place without their knowledge. With this method, hackers embed malicious code on websites or redirect unsuspecting victims to another website that they control. This gives cybercriminals the opportunity to silently scan the user’s device for weaknesses or vulnerabilities. And if these criminals find a vulnerability they are looking for, they will execute a code that will surprise the victim with a ransom note demanding payment for their files to be returned.

• USBs and other portable media: This is a physical route that cybercriminals use to breach IT environments with ransomware and malware. USBs and other portable devices are infected with malware, and when plugged into a device or computer, it takes over the data, allowing cybercriminals to demand ransom.

How does ransomware work?

Ransomware solely depends on gaining access to a user’s system and remotely encrypting their files to demand a ransom in return for that data. These are the three major stages of a ransomware attack:

• Ransomware delivery and infection: Just like any other malware, ransomware has multiple delivery mechanisms. However, as mentioned earlier, cybercriminals tend to use some of the more successful delivery mechanisms of ransomware, which include phishing emails, drive-by downloads and physical breaches.
• Encryption: Once the ransomware has breached the system, it starts encrypting files. An operating system is built with an encryption functionality, which means that the ransomware will simply access files, encrypt them with a key controlled by the attacker and replace the originals with these encrypted files. Some more complex variants of ransomware also delete backups to make recovery without paying the ransom even more difficult.
• Demands: After all files are encrypted, the ransomware then delivers a ransom demand, usually through a ransom note displayed on screen or as text files placed in each encrypted directory. Once the ransom is paid, the cybercriminal will usually provide a copy of the private key used to encrypt those files to restore access to the victim.

How to detect ransomware?

You’d probably know that your systems have been infected with ransomware when you see a ransom demand popping up on your screen. However, there are other common indicators of ransomware attacks that include:

• Suspicious file activity: It’s almost always a red flag when you see hundreds of failed file modifications because this could be due to ransomware attempting to scan and encrypt those files.
• Loss of access to certain files: This could be due to a ransomware encrypting, deleting or renaming the data.
• Increased disk activity: When your CPU or disc activity has increased unexpectedly, this could be due to the ransomware attempting to access files on your system.
• Unexpected network communication: This could be due to the communication between the cybercriminals, ransomware and your server.

Best ways to prevent and recover from ransomware in 2022

While it’s almost impossible to be completely impervious to cyberthreats, there are some best practices your business can follow to reduce the risk of falling victim to ransomware and to quickly get back up and running in the unfortunate event of an attack.

• Patch management: Software vendors periodically release new updates or patches to their existing software to fix security vulnerabilities and other bugs. However, it can be a daunting task to keep track of and ensure that all your devices and OS patches are made on time. Incorporate a patch management solution in your IT network. This can help avoid major cybersecurity risks due to patchable vulnerabilities.
• Educate your employees: Since phishing has become the weapon of choice for ransomware attacks, it is crucial that you educate your employees on how to identify suspicious emails and what to do with them. You can also teach them common red flags in emails to ensure that they don’t make the mistake of opening an attachment or a link.
• Explore email security solutions: There are many email security solutions in the market that can help you keep your employees’ emails safe by scanning them and flagging suspicious emails. There are also solutions that deliver phishing simulations so users can learn in a safe environment, how to spot a phishing attack in real life.
• Monitoring: Keep your systems always monitored to ensure that you pick up signs of suspicious activity. Stay on the lookout for unusual activity and be sure to investigate it. You can also make use of a remote monitoring solution that allows you to identify issues without having to be on-site and rectify them immediately.
• Create physical backups: It is important to back up critical data to external devices to give your business a fail-safe in the event of an attack or incident.
• Make use of cloud backup: The vulnerabilities in cloud-based environments are harder to exploit. Back up your data on cloud storage solutions because they also allow you to restore to previous versions of your files, allowing you to return to an unencrypted version in the event of a ransomware attacks.
• Implement good password discipline: A lot of attacks are from compromised credentials that are readily on sale on the dark web. A lot of passwords are very common, so hackers tend to try those first. A password manager can help secure your passwords. There tools that monitor the dark web for credentials that are on sale and you can easily spot ones from your organization – to help prevent attacks. Using two-factor authentication will also help protect against attacks.