What is Ransomware

This virus can block access to your computer data until you pay. After online payment, you will have access to your files or data storage. Be careful with ransomware.

The Evolution of Ransomware

Ransomware first emerged 30 years ago. Participants at a science conference found a message on their computer screens telling them to send $189 to a Panama bank account. Only after that, would they have access to the files again. Then, nobody heard about ransomware for 15 years.

In the 2000s when the Internet became more popular, ransomware came back. Attackers started infecting computer users via malicious websites and emails with spam. Now, we use the Internet, PCs and smartphones so attackers have many more targets. That’s why we need to protect our devices from ransomware.

How ransomware works

• Step 1. The infection: A victim’s device can be infected in different ways. A computer user can open an attachment or weblink, click on an email, install software, or plug in an unknown USB drive.
• Step 2. The encryption: Once a person has ransomware, the virus starts its work. It infects a computer and encrypts files.
• Step 3. Notification: Victims of a ransomware attack find out about it after notification. The message appears on the screen of the device.
• Step 4. Payment: The process of payment is simple. The price that attackers ask to pay for having access to a device is often reasonable. So, it is easy to take action. That is why many victims prefer to fix the problem with ransomware themselves.
  Mostly, attackers ask victims to pay in cryptocurrencies, like Bitcoin. Credit card payments or wire transfers are traceable.
• Step 5. Unlocking the files: After payment, the victim gets the key to decrypt the files. In most cases, after files are decrypted the ransomware should delete itself.

Infection and Distribution Vectors

Attackers can buy malware on open websites and distribute it to victims. When they have a ransomware project in hand, the next step is to choose how to distribute it. There are a lot of ways to do it.

Attackers can choose email attachments that contain malicious files with hidden code. It can be delivered by weblink or a fake software installer. When a computer user has opened the file with malware, everything else happens invisibly. The victim knows nothing about ransomware for minutes, hours, or even days.

File Encryption

File encryption prevents malicious or unauthorized parties from accessing data.  Encryption protects file systems or cloud storage by encrypting them with a unique key. Only keyholders can get access to files that are stored on the disk.

Ransom Demand

The victim sees the full-screen window on the device. It informs that the user’s computer has been blocked and access will be provided after payment. Attackers can ask computer users to pay as low as $50 to as much as $10,000. When payment is made, attackers restore access to the device.

How do I get ransomware?

Attackers must gain access to a network or device, to infect someone’s device or data.  Then, malware infects someone’s device or data and locks it. There are several different ways to be infected:

1. Email: Someone who opens an email from an unknown address risks getting a message with malicious spam. The email might contain links to websites that infect the device with ransomware.
2. Online Ad: Internet users who click on online ads can become victims of ransomware. Users can be directed to infected websites while browsing web pages or clicking on an ad. Then, the server chooses the malware that suits the computer user and infects the device.
3. Spear Phishing: This way attackers target employees of the company. For instance, a good example is sending emails to employees of a certain company that appear to be from the CEO or HR department. For instance, the CEO asks employees to take an important survey or download a document. The email is fake, and it infects the device with malware.

Ransomware Statistics

• 304 million ransomware attacks happened worldwide in 2020.
• 4 new attacks start each minute.
• 73% of ransomware attacks are successful.
• $20 billion was the global cost to recover devices after ransomware attacks in 2021.
• 75% of attacks hit companies with less than $50M in annual income.
• 97% of all ransomware viruses need less than 4 hours to reach the target.
• $178,000 is the average payment for an attacker to unlock a system.

Why Is It So Hard to Find Ransomware Perpetrators?

Mostly, attackers ask the victim to make a payment in cryptocurrency because it is difficult to track. Then, cybercriminals convert the payment into paper currency. That is why it is difficult to catch attackers.

The hardest task is to bring them to justice. It is a difficult process that needs to involve local, federal and international government. The process of searching for cybercriminals can last for years. And there is no guarantee that law enforcement agencies will find the attackers. Meanwhile, the quantity of ransomware attacks continues to increase.

Types of ransomware

There are many types of ransomware. Ransom attacks can be divided into two groups. The first type is locker ransomware that blocks access to the user’s device. The second type is crypto-ransomware that restricts access to files on the computer. The most popular variants of ransomware are scareware, screen lockers, encrypting ransomware, crypto malware, and leakware.

Scareware

This type of ransomware infects a device and proposes computer users make a payment to fix the issue. Some types of ransomware block access to the device until the user pays. The others only flood the screen with pop-ups. The way to get rid of it is to make an online payment. But the user still has access to files.

Screen lockers

Locker ransomware completely freezes computer users out of the PC. Malicious software blocks access to the data and applications. Meanwhile, on the screen appears a ransom demand to make an online payment. Also, the computer user sees a countdown clock. It  motivates the victim to act.

Encrypting ransomware

Encrypting ransomware is the most damaging variant. Attackers encrypt data or files and demand a payment to decrypt it. The user can use a device, but does not have the ability to open the encrypted files.

Sometimes, it leads to complete data loss. If cybercriminals get access to users’ files, no cybersecurity specialist or antivirus program will be able to return it to you. Even if the user pays, there is no guarantee that attackers will give files back.

Doxware or leakware

Doxware or leakware is ransomware that threatens to publish the victim’s sensitive data. It can be personal information or commercial data about a company. Attackers extort a payment to prevent data from being sent to the wrong people or being leaked to the web. Usually, people panic and pay a ransom.

Ransomware Examples

The most popular ransomware:

• REvil: IBM’s security X-Force reports REvil is the third most popular of all ransomware incidents. It can infect a user’s device through spam, exploit kits, unpatched VPNs, remote desktop protocols. This ransomware became well-known within four months of its detection.
• Ryuk: Attackers use Ryuk to target healthcare organizations. A good example is the attack against United Health Services in 2020. This ransomware reaches victims through exploit kits or phishing letters.
• Robinhood: This ransomware receives access to files through a phishing attack or security vulnerability. Then, malicious software encrypts files and the computer user gets a ransom note. The victim needs a decryption key. Attackers demand online payment in bitcoin to provide a decryption key for the user.
• DoppelPaymer: Businessmen are the targets of DoppelPaymer. While infected, this ransomware is gaining access to admin data. Then, malicious software changes the security password to prevent users from logging into the system. Cybercriminals contact the victim and ask for payment.
• Snake: Snake is also well known as Ekans. This ransomware encrypts most data on the target network. Then, attackers demand a payment to decrypt files. Mostly, this ransomware focuses on industrial control systems. This type was created to reach companies in the industrial sector. For instance, automobile manufacturer Honda and power company Enel Group were hit by Snake.

Mac ransomware

The first ransomware for Mac OS was dropped in 2016. Malicious software started to work. It infected an application called Transmission and encrypted files. Findzip and MacRansom are the next generations of ransomware for Mac Os. These types were discovered in 2017.

New types of malicious software for Mac OS appeared in 2020: ThiefQuest and EvilQuest. Victims downloaded software through pirate websites with hidden damaging files. The virus encrypted files and demanded payment to decrypt them.

Mobile ransomware

Mobile ransomware pressures victims to make online payments to unlock their mobile phones. Android ransomware targets the user who uses a mobile phone with an Android operating system.

There are two categories that infect Android phone users: crypto ransomware and locking ransomware. Crypto ransomware encrypts important data. Then, attackers demand payment to decrypt it. In the case of locking ransomware, attackers control the user interface and block the device. When the victim pays a ransom, attackers unblock the phone.

iPhones and iPads are more protected from malware attackers. There is no iPhone ransomware. It is unlikely that iPhone users get ransomware on their mobile devices. The only way is a situation when an attacker can simulate a ransomware attack. People can be scared by criminals. Then, they pay a ransom even if the files weren’t encrypted.

Who do ransomware authors target?

When ransomware appeared, the main target of attackers was people. Then, cybercriminals understood that business attacks can be the key to earning more money. Now, the healthcare industry, IT, and manufacturing are the prime targets for attackers. Cybercriminals need money. That is why they target credit-worthy businesses from the UK, USA, and Canada.

How does ransomware affect my business?

Ransomware is a big challenge for businesses of all sizes. It can lead to data loss. Valuable information can be blocked for days or can be deleted forever. In this case, the company risks lost reputation, productivity and money.

What to do if I’m infected

When someone realizes that ransomware has been deployed, the user needs to act quickly to save data. Here are several points to follow:

1. Disconnect the computer from WIFI and other devices that are connected to the PC. That will prevent the infection from spreading.
2. Find out how the device was infected.
3. Report to the authorities. The FBI tells ransomware victims to report attacks.
4. Find the proper way to deal with ransomware. It depends on the risk of malware, the importance of files or data, and the type of ransomware that was deployed.  One response is to pay a ransom. The second is to try to remove the malware, which requires professional help.
5. The user needs to wipe the system and reinstall it from safe backups.

How to Remove Ransomware?

To remove ransomware from a device, the user can try anti-ransomware software. It is designed to find malware and delete it.

Some ransomware is easy to remove. For instance, screenware. This type informs the user that the laptop was locked by police or the FBI, which is a lie. The victim can easily remove this ransomware with an anti-virus program. Other ransomware can be far more difficult to remove, and it is often better to ask cybersecurity professionals to help with malicious software.

How do I protect myself from ransomware?

The user can take some steps in advance to protect a device from ransomware.

1. Start using an anti-virus program with real-time protection. It must be designed to find ransomware. The user or company needs to invest money to buy it. But, it is better to pay for an anti-virus program now, than lose all data and pay attackers in the future.
2. It is wise to create a secure backup of data. The user can use cloud storage or purchase an external hard drive.
3. Always update systems and software. New versions are more resistant to viruses.
4. Be informed. The user needs to know about new popular forms of ransomware.
5. Be careful with spam. Computer users do not need to open all emails. Somebody can send a letter with ransomware. That is why the user always needs to be careful with email letters with spam.

Train all employees on cybersecurity best practices

Employers need to provide cybersecurity training for employees. They need to know how to protect the data. It reduces the chances of becoming a ransomware victim.  

Here are several tips for employees to avoid ransomware:

1. Inform the IT department about suspicious emails.
2. Do not overshare your personal life on social media.
3. Be careful with attachments and emails from an unknown source.
4. Never download programs and files from pirated websites.
5. Use a strong password to log into the device.

Keep your operating system and other software patched and up to date:

Operating system updates are essential to keep the device secure from malicious software. Every update makes computers or tablets more resistant to new types of ransomware and other viruses. Here are several reasons to update your computer:

• Software updates offer a lot of benefits. They repair security weak points and fix device bugs. The latest update of the operating system is more resistant to new types of malicious software.
• Updates help to deal with security breaches. Often, attackers use sensitive parts of the software to infect computers. Operation system updates include software patches. So ,it helps to make devices more secure.
• Operation system updates protect personal information. Emails, photos, and documents are the target if the user’s device is under attack. Attackers can use personal data to sell it on the Internet, and perpetrate a crime. Some weak viruses can be found easily in the user’s PC with updated software.

Use software that can prevent unknown threats:

The best way to protect devices from ransomware is to install an antivirus program. It will protect the user’s computer from all types of malicious software. Some applications have free versions to download with basic protection, but it is better to pay for an app to have full protection.

There are several types of software to use.

1. Bitdefender Antivirus Plus: It is one of the best antiviruses and it is packed with protection against different viruses, including ransomware. Users can purchase protection for all devices, including PCs, Macs, and mobile phones.
2. AVG Antivirus: This software suits best against ransomware. This software includes antivirus, email scanning, and blocking of malicious software.
3. Avast Antivirus: It is one of the most famous antivirus software. Users can download the free basic version. This software suits well to struggle with malicious software and rogue programs. Avast Antivirus is available for both PCs and mobile devices.
4. Webroot Antivirus: This type of antivirus is easy to use. Users need seconds to install it and it uses 2 MB on the hard disk. This software includes ID protection, firewall monitoring, anti-fishing.
5. ESET NOD32 Antivirus: This application has no firewall, vulnerability scanner, file shredder. At the same time, it is more focused on essential functions. Antivirus provides real-time security from malicious software, protecting devices from ransomware and blocking malicious websites.

Should You Pay the Ransom?

To get access to data or devices after a ransomware attack, the user is told to make a payment. The FBI’s advice is not to pay a ransom, because it is always a risk. There is no guarantee that attackers will send a decryption key after payment. In cases where the victim loses important files, it can be cost-effective to pay a ransom.

For instance, the city of Baltimore was attacked by malicious software. Ransomware blocked access to administration data and systems. The government of Baltimore refused to pay attackers $76,000 in Bitcoin.

The ransomware attack cost the Baltimore city budget at least $18 million because of  the amount of data lost and costs to restore the system. So, it is up to the user or company to decide whether to pay a ransom or not.       

Solutions to address the ransomware threat

Computer users can use measures to prevent a ransomware attack.

1. Install anti-virus software to secure devices from ransomware. Security software will block malicious software and different types of viruses. It has the function of real-time scanning and email analysis. So, antivirus programs will help keep you from becoming  a victim.
2. Make a backup of data and isolate external hard drive from the Internet or other devices. Backups let computer users be confident when attackers block access to important data. Even if data has been blocked, the victim continues to work with data and does not lose time. This point is important for entrepreneurs.
3. Install the newest update of the device’s operating system. New versions always update all vulnerable parts of the previous version and make the device more secure against attackers and viruses. Hackers usually improve malicious software to find the weaknesses of the OS. That is why developers also optimize the operating system. The user needs only to install these updates to have the highest level of protection. Ransomware may cause sextortion