Overview

Ransomware is a form of malware. Cybercriminals use ransomware as a tool to steal data and essentially hold it hostage. They only release the data when they receive a ransom payment. Organizations most vulnerable to ransomware attacks hold sensitive data, such as personal information, financial data, and intellectual property.

Ransomware dates back to the 1980s but did not become widespread news until the early 2000s. Today, ransomware attacks are the third-most used cyberattack method, accounting for over 10% of all data breaches. The emergence of cryptocurrency made ransomware even more appealing, as it simplifies the ransom payment.

Technology plays a big role in ransomware, as cybercriminals continually advance their methods to quickly gain access and encrypt data. More companies are digitalizing, partly due to COVID restrictions and precautions. As such, more data is available in remote settings than ever before.

Ransomware is here to stay, so keep reading to learn how your organization can reduce ransomware risk.

Ransomware Meaning: The Evolution of Ransomware

Ransomware technology was first developed by a Harvard-trained evolutionary biologist by the name of Joseph L. Popp. He launched the AIDS Trojan by giving diskettes infected with ransomware to attendees of an international AIDS conference held by the World Health Organization in Stockholm, Sweden. The code hid file directories on their computers and demanded $189 be sent to Panama to free up their computers.

Even though the risk of ransomware has come a long way since then, its primary mission remains the same: to extort or scam money from unsuspecting users. It evolved from existing on a diskette to traveling across the internet, through emails, sound, and video downloads—and even inside images. In recent years, it has been a tool for cryptominers, who need computing power to generate cryptocurrencies. Because mining digital assets requires a lot of expensive electricity, ransomware has been developed to force a user’s computer to mine crypto—all for the benefit of a cryptominer hundreds or thousands of miles away.

How Does Ransomware Work?

Firmware updates enable hardware devices to continue operating efficiently and securely. These updates typically involve some form of program alteration that fixes a known bug or patches against specific vulnerabilities.

How does ransomware work? Regardless of the ransomware definition, once it enters your computer, it secretly infects it. The software then proceeds to attack files and access and alter credentials without the user being able to tell. As a result, the computer infrastructure is effectively held hostage by the person who controls the malware.

File Encryption

Ransomware known as cryptoware encrypts the files of the victim’s work or personal computer. This makes it so the computer’s owner cannot search for or access these files unless they pay a ransom to the attacker. The attacker is the only one who can access the files because they are hidden behind the encryption password. Sometimes, the attacker will lock out the entire computer and then demand a ransom before releasing the new password.

With leakware and doxware, the attacker threatens to publish sensitive information on the victim’s hard drive if they do not pay a ransom. Companies with private proprietary information like patents and sensitive schematics may find themselves a favorite target of leakware and doxware.

Ransom and Demands

Hackers tend to ask for payment settlements using methods such as Western Union or through a text message. This helps them hide their identity. Once they have the money, they decrypt the files and free up the system. Some demand bitcoin ransomware settlements due to their anonymity and a lack of a middleman.

Keep in mind that some attackers masquerade as U.S. law enforcement or government officials. They may say they are shutting down the victim’s computer because pornography or pirated software was found on it. They then demand the victim pay a “fine” before they release their computer.

Ransomware Attacks

Today, ransomware is often sent through phishing emails. These malicious attachments infect the user’s computer after being opened. Some, such as CryptoLocker, act as a Trojan horse, infecting your computer and then looking for files to encrypt. Ransomware can also be spread through drive-by downloading, which is when a user visits a website that happens to be infected. The malware on that site is then downloaded and installed without the user even knowing about it.

Social engineering plays a big role in a ransomware attack as well. This is when people try to manipulate others into divulging personal or confidential information. One common social engineering tactic is using emails or texts to scare the target into sharing sensitive information, opening a malicious file, or clicking on a malicious link.

Malspam

Malspam is short for “malware spam,” and it is email that delivers malware to the target’s inbox. The attachments or URLs (web addresses) in the email may contain or link to malware, or they may have phishing messages inside it.

Malvertising

Malvertising involves the distribution of graphic or text ads infected with malware. They often cannot be distinguished from normal ads and can appear alongside regular, harmless advertisements.

Common Ransomware Attack Targets

Cyber criminals like to go for the low-hanging fruit, which often includes small and midsize businesses (SMBs) because they do not have adequate security measures in place. SMBs also are less likely to have large teams of IT professionals who understand what a ransomware attack is.

Ransomware attacks also target companies that have an urgent need to access their files, such as organizations that depend on databases and storehouses of marketing collateral or applications to run their day-to-day business. The business may reason that even though the attacker is asking for a couple thousand dollars, they will lose far more if business interruption continues.

Anyone who has information they really want to keep private may also find themselves a target. The attacker may have an idea how important privacy is to the target and will charge a hefty fee in exchange for not publishing their data.

Unfortunately, anyone can end up a target. In fact, malware does not even need to be sent from the attacker straight to the victim’s computer. It can spread on its own. Malicious code can be embedded in a normal-looking advertisement. Anyone can click on it and end up a victim.

While attacks are the most common on people’s desktops and laptops, any device with an operating system can fall victim. This includes cell phones, tablets, and other mobile devices. To ensure all devices are safe, a comprehensive endpoint detection and response (EDR) solution may be necessary. With EDR, you can identify threats in real time and prepare and protect the devices on your network to make them less susceptible to attack.

Types of Ransomware

Sadly, it is cheap and easy for cyber criminals to get started with these attacks. The software solutions are inexpensive and readily available on the dark web, and some of the more recent ransomware attacks have been executed using malware that is cheap and easy to find. There are several different types of ransomware, and here are some of the most popular ransomware examples:

Ransomware Jargon Terms

While jargon is sometimes created by only a few thought leaders, it soon becomes an element of everyday life. In cybersecurity, concise jargon makes it easier for those “in the know” to talk about threats and the technology used to fight them. This is especially true when it comes to ransomware, where knowing the jargon not only provides insight into the world of ransomware criminals but also makes it easier to evade their attacks. Here are some of the jargon you should be familiar with while on the ransomware battlefield.

Ransomware Detection

Effective ransomware detection involves a combination of education and technology. Here are some of the most effective ways to detect and prevent ransomware attacks:

1. Ensure employees are educated about ransomware: Teach employees how to spot signs of ransomware, such as emails designed to look like they are from authentic businesses, suspicious external links, and questionable file attachments.
2. Create honeypots: A honeypot is a decoy, consisting of fake repositories of files designed to look like attractive targets for attackers. When a ransomware hacker goes after your honeypot, you can detect and stop the attack.
3. Monitor your network and endpoints: With vigilant monitoring, you can log incoming and outgoing traffic, scan files for evidence of attack (such as failed modifications), establish a baseline for acceptable user activity, and then investigate anything that seems out of the ordinary.
4. Deploy antivirus and anti-ransomware tools: These can be used to whitelist acceptable sites and inform you when they detect a threat.

How To Protect Your Business From Ransomware?

Businesses, regardless of their size, are favorite targets of ransomware cyber criminals. Many businesses depend on their computers for their daily operations, to manage crucial files, or to communicate. Any downtime has an effect on the business’s bottom line. Cyber criminals use this to manipulate business owners and employees into paying to regain access to their computers. In many cases, they succeeded in either extorting large sums of money or significantly disrupting operations.

In 2018, SamSam was used to attack the Colorado Department of Transportation as well as the Port of San Diego. The ransomware brought all their services to a halt. Also in 2018, two hackers from Iran allegedly used SamSam to attack upwards of 200 organizations and companies across the United States and Canada. Some of their victims included hospitals, public institutions, and municipalities. The attacks resulted in a loss of an estimated $30 million. Learn more about cyber insurance benefits for ransomware payments.

What To Expect After a Ransomware Attack?

After a ransomware attack, you will likely suffer a significant slowdown in business operations. In addition to trying to restart operations, you can expect to:

1. Upgrade your antivirus protection system
2. Train employees on how to avoid a ransomware attack in the future
3. Decrypt your Microsoft Office files, which are a favorite target of cyber criminals
4. Deal with the frustration of employees and management as they suffer a loss in productivity

How To Respond to a Ransomware Attack?

There are steps you can take after a ransomware attack to minimize the damage to your operations. Regardless of the situation, authorities advise not to pay the ransom. Paying the ransom only encourages further attacks as other cyber criminals hear of successful attacks.

Check for Scareware

Scareware is often easy to spot on your computer. It may pop up when you visit the internet, replacing what you would expect to see in your tabs. Sometimes, tabs open up automatically when you click, regardless of where on the screen you click or tap.

Scareware also pops up on an infected computer when it is not connected to the internet. It may come in the form of a message telling you that your device has been infected and needs to be cleaned. It may also appear as an offer to install antivirus software.

Scareware can sometimes be cleaned by taking steps directed by a customer service representative from your computer’s manufacturer. Because these types of ransomware are so common, some companies have trained professionals ready to help users uninstall them.

Consult an Expert

An IT specialist may be able to identify, locate, and get rid of the ransomware. While there is no guarantee they can get it off your computer, some ransomware has been used many times over. As a result, there are decryption keys already out there and circulated among IT pros.

Consulting an expert also has its drawbacks. It often costs a considerable amount of money to hire a professional. Also, there is no way of knowing, before you agree to pay an initial fee, whether the expert will be successful in getting the ransomware off your computer.

How to Remove Ransomware?

Steps to follow to remove ransomware:

1. Isolate the infected devices: Likely, only a few devices will have the ransomware on them. It is important to get these off the network so they cannot infect other connected devices.
2. Identify the kind of attack: The steps you take will largely depend on the type of ransomware you have been infected with. Write down any and all details about the attack and its symptoms.
3. Use antivirus software or hire a professional to do it for you: This can help prevent further attacks, and it may also reveal and eliminate other threats.
4. Recover your encrypted files: Whether you can recover them—and how—will depend on the nature of the attack and the decryption options.
5. Removing the ransomware makes it impossible to respond to the demands of the attacker, which can prevent you from making a harmful, emotional decision. However, this will not decrypt the files that are being held hostage.

You may end up losing the decrypted files or all information on your device, particularly if you have been locked out. On the other hand, with scareware and many screen lockers, you may suffer no adverse effects. With some screen lockers, for example, you can restart the computer in safe mode, and then remove the screen locker using antivirus software. When you reboot your computer, it may be back to normal.

How to Prevent Ransomware Attacks?

The best way to fight against ransomware is to prevent an attack.

How Can Fortinet Help

With the Fortinet Security Fabric, you can block ransomware attacks, protecting all of your endpoints while securing your entire network’s entry points. Because the Security Fabric is powered by FortiGuard Labs, you have the most up-to-date security intelligence, ensuring you are prepared to stop new and emerging threats.

How familiar are you with the most recent ransomware threats and terms? To get caught up, check out the Fortinet ransomware jargon page, which outlines all you need to know to stay a step ahead.

Explore Fortinet Products

FAQs

What is ransomware?

Ransomware is a specific type of malware or malicious software that holds data hostage in exchange for a ransom. It threatens to publish, block, or corrupt data—or prevent a user from working or accessing their computer unless they meet the attacker’s demands.

How does ransomware work?

Regardless of the ransomware definition, once it enters your computer, it secretly infects it. The software then proceeds to attack files and access and alter credentials without the user being able to tell. As a result, the computer infrastructure is effectively held hostage by the person who controls the malwre

What the types of ransomware?

1. Scareware is a type of malware that uses social engineering to scare, shock, or cause a victim anxiety.
2. Screen lockers lock your computer screen, making it seem impossible to access.
3. Encrypting ransomware uses advanced encryption algorithms to encrypt the data on your device.
4. Ransomware threats are constantly evolving and growing more severe. As new security measures arise, hackers are devising more and more ways to invade the computers of individuals and enterprises.