What is Ransomware?
by
Reading Time: 6 min
Do you ever ask yourself what is ransomware or how it can impact you? The purpose of ransomware is to encrypt your important files using malicious software. The criminals then demand payment from you in exchange for the decryption key, challenging you to prove that you have paid the ransom before they will provide you with instructions to recover your files. It’s the equivalent of paying off a kidnapper for the release of your loved one.
“There were 236.1 million ransomware assaults worldwide in the first half of 2022. Between the second and fourth quarters of 2021, there were 133 million fewer attacks, a sharp decline from approximately 189 million cases.” ~Statista
Ransomware has been in the news, and you’ve probably seen reports about computers locking themselves down until people pay for a key to escape. But what is it exactly, how does it work, and how can we defend ourselves against it?
Key Takeaways
- Ransomware encrypts important files, demanding payment for the decryption key.
- Common types of ransomware include WannaCry, Locky, Maze, and NotPetya, each operating in slightly different ways.
- Ransomware attacks can compromise data, cause significant downtime, and lead to loss of revenue.
- Preventative measures such as network segmentation and airgap backups can help protect against ransomware threats.
- Staff training on identifying phishing attacks is essential for minimizing the risk of ransomware infections.
How does Ransomware Work?
Ransomware is typically installed as an attachment to spam emails or exploiting software vulnerabilities on the victim’s computer.
The infection may be hidden in a file the user downloads from the Internet or installed manually by an attacker, often via software packaged with commercial products.
Once installed, it waits for a trigger condition (such as connecting to the Internet) before locking the system and demanding a ransom for its release. The ransom can be paid using either cryptocurrencies or credit cards.
Protect Against Ransomware with PowerDMARC!
Types of Ransomware
“As of 2021, the average ransomware breach cost was $4.62 million, not including the ransom.”~IBM
Here are some common types:
WannaCry
In 2017, the ransomware assault known as WannaCry affected more than 150 nations. Upon infecting a Windows machine, WannaCry encrypts user files and demands a bitcoin ransom to unlock them.
Locky
Locky is one of the oldest forms of ransomware and was first discovered in February 2016. The malware encrypts files rapidly and spreads through phishing emails with attachments that look like invoices or other business documents.
Maze
Maze is a newer ransomware that was first discovered in May 2019. It works similarly to Locky, except that it ends encrypted file names with .maze instead of locky. Spam emails also spread Maze, but it infects your computer by opening an attached file.
NotPetya
According to early reports, NotPetya is a ransomware variation of Petya, a strain initially discovered in 2016. Now, NotPetya is a type of malware called a wiper, which destroys data instead of demanding a ransom.
Scareware
Scareware is phony software that demands payment to fix problems it claims to have found on your computers, such as viruses or other issues. While some scareware locks the computer, others saturate the screen with pop-up notifications without causing any file damage.
Doxware
As a result of doxware or leakware, people become alarmed and pay a ransom to prevent their confidential information from being leaked online. One variant is police-themed ransomware. A fine may be paid to avoid jail time, and the company is posing as law enforcement.
Petya
The Petya ransomware encrypts entire computers, unlike several other variants. Petya overwrites the master boot record, which prevents the operating system from booting.
Ryuk
Ryuk infects computers by downloading malware or sending phishing emails. It uses a dropper to install a trojan and establish a permanent network connection on the victim’s computer. APTs are created with tools such as keyloggers, privilege escalation, and lateral movement, all of which begin with Ryuk. The attacker installs Ryuk on every other system he has access to.
What is Ransomware’s Impact on Business?
Ransomware is one of the fastest-growing cyber threats today.
Here are some of the ways ransomware can affect your business:
- Ransomware can compromise your data, which can be expensive to recover or replace.
- Your systems may be damaged beyond repair, as some ransomware attacks overwrite files with random characters until they’re unusable.
- You may experience downtime and loss of productivity, which could lead to lost revenue or customer loyalty.
- The hacker could steal your company’s data and sell it on the black market or use it against other companies in future attacks.
How To Protect Your Business From Ransomware Attacks?
“Install security software and keep it up to date with security patches. Many ransomware assaults employ earlier versions for which security software countermeasures are available.” ~Steven Weisman, a professor at Bentley University.
To protect your business from ransomware, you can take the following steps:
Network Segmentation
Network segmentation is the process of isolating one network from another. By isolating networks, you can protect your business and its data.
You should create separate segments for public Wi-Fi, employee devices, and internal network traffic. This way, if an attack occurs in one segment, it won’t affect the others.
AirGap Backups
AirGap backups are a type of backup that’s completely offline and cannot be accessed without physically removing the storage device from the computer it’s connected to. The idea is that if there’s no way to access the files on that device, then there’s no way an attacker can access them either. A good example of this would be using an external hard drive that has been completely disconnected from any internet connections or other devices with access to it.
Domain-based Message Authentication, Reporting & Conformance
More often than not, ransomware is distributed via emails. Fraudulent emails come with phishing links that can initiate ransomware installations on your computer. To prevent this, DMARC acts as the first line of defense against ransomware.
DMARC prevents phishing emails from reaching your customers in the first place. This helps stop ransomware distributed via emails at the root of inception. To learn more, read our detailed guide on DMARC and ransomware.
Least Privilege (Zero Trust for User Permissions)
Least privilege refers to granting users only the minimum permissions necessary for their roles within your organization. When you hire someone new or reassign a role within your company, you will give them only those permissions needed for their specific role — nothing more or less than that required for them to do their job efficiently and effectively.
Protect Your Network
Firewalls are the first line of defense for networks. It monitors incoming and outgoing traffic on your network and blocks unwanted connections. The firewall can also monitor traffic for certain applications, such as email, to ensure it is safe.
Staff Training & Phishing Tests
Training your employees on phishing attacks is essential. This will help them identify phishing emails before becoming a major company problem. A phishing test can also help identify employees who may be more susceptible to phishing attacks because they don’t know how to identify them correctly.
Maintenance & Updates
Regular maintenance of your computers will help prevent malware from infecting them in the first place. You should also update all software regularly to ensure that bugs are fixed as soon as possible and that new software versions are released with new security features built in.
Related Read: How To Recover from a Ransomware Attack?
Conclusion
Ransomware isn’t a mistake. It’s a deliberate method of attack, with malicious implementations ranging from slightly annoying to downright destructive. There is no sign that ransomware will slow down, and its impact is significant and growing. All businesses and organizations need to be prepared for this.
You need to be on top of security to make yourself and your business safe. Use the tools and guides provided by PowerDMARC if you want to stay safe from these vulnerabilities.
Domain & Email Security Expert at PowerDMARC
Ahona is the Marketing Manager at PowerDMARC, with 5+ years of experience in writing about cybersecurity topics, specializing in domain and email security. Ahona holds a post-graduation degree in Journalism and Communications, solidifying her career in the security sector since 2019.
Latest posts by Ahona Rudra (see all)
