What is Ransomware?

Ransomware Survival Guide

Definition

Ransomware is a type of malicious software (malware) that threatens to publish or blocks access to data or a computer system, usually by encrypting it, until the victim pays a ransom fee to the attacker. In many cases, the ransom demand comes with a deadline. If the victim doesn’t pay in time, the data is gone forever or the ransom increases.

Ransomware attacks are all too common these days. Major companies in North America and Europe alike have fallen victim to it. Cybercriminals will attack any consumer or any business and victims come from all industries.

Several government agencies, including the FBI, advise against paying the ransom to keep from encouraging the ransomware cycle, as does the No More Ransom Project. Furthermore, half of the victims who pay the ransom are likely to suffer from repeat ransomware attacks, especially if it is not cleaned from the system.

History of Ransomware Attacks

Ransomware can be traced back to 1989 when the “AIDS virus” was used to extort funds from recipients of the ransomware. Payments for that attack were made by mail to Panama, at which point a decryption key was also mailed back to the user.

In 1996, ransomware was known as “cryptoviral extortion,” introduced by Moti Yung and Adam Young from Columbia University. This idea, born in academia, illustrated the progression, strength, and creation of modern cryptographic tools. Young and Yung presented the first cryptovirology attack at the 1996 IEEE Security and Privacy conference. Their virus contained the attacker’s public key and encrypted the victim’s files. The malware then prompted the victim to send asymmetric ciphertext to the attacker to decipher and return the decryption key—for a fee.

Attackers have grown creative over the years by requiring payments that are nearly impossible to trace, which helps cybercriminals remain anonymous. For example, notorious mobile ransomware Fusob requires victims to pay using Apple iTunes gift cards instead of normal currencies, like dollars.

Ransomware attacks began to soar in popularity with the growth of cyptocurrencies, such as Bitcoin. Cryptocurrency is a digital currency that uses encryption techniques to verify and secure transactions and control the creation of new units. Beyond Bitcoin, there are other popular cryptocurrencies that attackers prompt victims to use, such as Ethereum, Litecoin, and Ripple.

Ransomware has attacked organizations in nearly every vertical, with one of the most famous viruses being the attacks on Presbyterian Memorial Hospital. This attack highlighted the potential damage and risks of ransomware. Labs, pharmacies and emergency rooms were hit.

Social engineering attackers have become more innovative over time. The Guardian wrote about a situation where new ransomware victims were asked to have two other users install the link and pay a ransom in order to have their files decrypted.

More Information on Locky Ransomware >

Presbyterian Memorial Hospital Ransomware Attack >

Examples of Ransomware

By learning about the major ransomware attacks below, organizations will gain a solid foundation of the tactics, exploits, and characteristics of most ransomware attacks. While there continues to be variations in the code, targets, and functions of ransomware, the innovation in ransomware attacks are typically incremental.

  • WannaCry – A powerful Microsoft exploit was leveraged to create a worldwide ransomware worm that infected over 250,000 systems before a killswitch was tripped to stop its spread. Proofpoint was involved in finding the sample used to find the killswitch and in deconstructing the ransomware. Learn more about Proofpoint’s involvement in stopping WannaCry.
  • CryptoLocker – This was one of the first of the current generation of ransomware that required cryptocurrency for payment (Bitcoin) and encrypted a user’s hard drive and attached network drives. Cryptolocker was spread via an email with an attachment that claimed to be FedEx and UPS tracking notifications. A decryption tool was released for this in 2014. But various reports suggest that upwards of $27 million was extorted by CryptoLocker.
  • NotPetya – Considered one of the most damaging ransomware attacks, NotPetya leveraged tactics from its namesake, Petya, such as infecting and encrypting the master boot record of a Microsoft Windows-based system. NotPetya leveraged the same vulnerability from WannaCry to spread rapidly, demanding payment in bitcoin to undo the changes. It has been classified by some as a wiper, since NotPetya cannot undo its changes to the master boot record and renders the target system unrecoverable.
  • Bad Rabbit – Considered a cousin of NotPetya and using similar code and exploits to spread, Bad Rabbit was a visible ransomware that appeared to target Russia and Ukraine, mostly impacting media companies there. Unlike NotPetya, Bad Rabbit did allow for decryption if the ransom was paid. The majority of cases indicate that it was spread via a fake Flash player update that can impact users via a drive by attack.
  • REvil – REvil is authored by a group of financially motivated attackers. It exfiltrates data before it encrypts it so that targeted victims can be blackmailed into paying if they choose not to send the ransom. The attack stemmed from compromised IT management software used to patch Windows and Mac infrastructure. Attackers compromised the Kaseya software used to inject the REvil ransomware onto corporate systems.
  • Ryuk – Ryuk is a manually distributed ransomware application mainly used in spear-phishing. Targets are carefully chosen using reconnaissance. Email messages are sent to chosen victims, and all files hosted on the infected system are then encrypted.

How Ransomware Works

Ransomware is a type of malware designed to extort money from its victims, who are blocked or prevented from accessing data on their systems. The two most prevalent types of ransomware are encryptors and screen lockers. Encryptors, as the name implies, encrypt data on a system, making the content useless without the decryption key. Screen lockers, on the other hand, simply block access to the system with a “lock” screen, asserting that the system is encrypted.

Example of ransomware attack

Figure 1: How Ransomware tries to trick a victim into installing it

Victims are often notified on a lock screen (common to both encryptors and screen lockers) to purchase a cryptocurrency, like Bitcoin, to pay the ransom fee. Once the ransom is paid, customers receive the decryption key and may attempt to decrypt files. Decryption is not guaranteed, as multiple sources report varying degrees of success with decryption after paying ransoms. Sometimes victims never receive the keys. Some attacks install malware on the computer system even after the ransom is paid and the data is released.

While originally focused largely on personal computers, encrypting ransomware has increasingly targeted business users, as businesses will often pay more to unlock critical systems and resume daily operations than individuals.

Enterprise ransomware infections or viruses usually start with a malicious email. An unsuspecting user opens an attachment or clicks on a URL that is malicious or has been compromised.

At that point, a ransomware agent is installed and begins encrypting key files on the victim’s PC and any attached file shares. After encrypting the data, the ransomware displays a message on the infected device. The message explains what has occurred and how to pay the attackers. If the victims pay, the ransomware promises they’ll get a code to unlock their data.

Who is At Risk?

Any device connected to the internet is at risk of becoming the next ransomware victim. Ransomware scans a local device and any network-connected storage, which means that a vulnerable device also makes the local network a potential victim. If the local network is a business, the ransomware could encrypt important documents and system files that could halt services and productivity.

If a device connects to the internet, it should be updated with the latest software security patches, and it should have anti-malware installed that detects and stops ransomware. Outdated operating systems such as Windows XP that are no longer maintained are at a much higher risk.

The Business Impact from Ransomware

A business that falls victim to ransomware can lose thousands of dollars in productivity and data loss. Attackers with access to data will blackmail victims into paying the ransom by threatening to release data and expose the data breach, so organizations that do not pay fast enough could experience additional side effects such as brand damage and litigation.

Ransomware stops productivity, so the first step is containment. After containment, the organization can either restore from backups or pay the ransom. Law enforcement gets involved in investigations, but tracking ransomware authors requires research time that just delays recovery. Root-cause analysis identifies the vulnerability, but any delays in recovery impacts productivity and business revenue.

Why is Ransomware Spreading?

With more people working from home, threat actors increased their use of phishing. Phishing is a primary starting point for ransomware infection. The phishing email targets employees, both low-privileged users and high-privileged users. Email is inexpensive and easy to use, so it makes a convenient way for attackers to spread ransomware.

Documents are normally passed in email, so users think nothing of opening a file in an email attachment. The malicious macro runs, downloads ransomware to the local device, and then delivers its payload. The ease of spreading ransomware in email is why it’s a common malware attack.

Who are the Malicious Actors?

Sophisticated attacks might use ransomware with authors who build their own versions. Variants use the codebase from an existent ransomware version and alter just enough of the functions to change the payload and method of attack. Ransomware authors can customize their malware to perform any action and use a preferred encryption cipher.

Attackers are not always authors. Some ransomware authors sell their software to others or lease it for use. Ransomware can be leased as malware-as-a-service (MaaS) where customers authenticate into a dashboard and launch their own campaign. Therefore, attackers are not always coders and malware experts. They are also individuals who pay authors to lease their ransomware.

Why You Shouldn’t Pay Ransomware

After ransomware encrypts files, it shows a screen to the user announcing files are encrypted and the amount of money that must be paid. Usually, the victim is given a specific amount of time to pay or the ransom increases. Attackers also threaten to expose businesses and announce that they were victims of ransomware publicly.

The biggest risk of paying is never receiving cipher keys to decrypt data. The organization is out the money and still doesn’t have decryption keys. Most experts advise against paying the ransom to stop perpetuating the monetary benefits to attackers, but many organizations are left without a choice. Ransomware authors require cryptocurrency payments, so the money transfer cannot be reversed.

Steps for Responding to an Attack

The payload from ransomware is immediate. The malware displays a message to the user with instructions for payment and information on what happened to files. It’s important for administrators to react quickly because some ransomware attempts to spread to other locations on the network and find critical files in additional scans. You can take a few basic steps to properly respond to ransomware, but note that expert intervention is usually required for root-cause analysis, cleanup, and investigations.

  • Determine which systems are impacted. You must isolate systems so that they cannot affect the rest of the environment. This step is part of containment that will minimize damage to the environment.
  • Disconnect systems, and power them down if necessary. Ransomware spreads rapidly on the network, so any systems must be disconnected either by disabling network access or powering them down.
  • Prioritize restoration of systems so that the most critical ones can be returned to normal faster. Usually, priority is based on productivity and revenue impact.
  • Eradicate the threat from the network. Attackers might use backdoors, so eradication must be done by a trusted expert. The expert needs access to logs so that a root-cause analysis will identify the vulnerability and all systems impacted.
  • Have a professional review the environment for potential security upgrades. It’s common for a ransomware victim to be a target for a second attack. If the vulnerability is not found, it can be exploited again.

New Ransomware Threats

Authors constantly change code into new variants to avoid detection. Administrators and anti-malware developers must keep up with these new methods so that detection of threats happens quickly before it can propagate across the network. Here are a few new threats:

  • DLL side loading. Malware attempts to hide from detection by using DLLs and services that look like legitimate functions.
  • Web servers as targets. Malware on a shared hosting environment can affect all sites hosted on the server. Ransomware such as Ryuk targets hosted sites, mainly using phishing emails.
  • Spear-phishing is preferred over standard phishing. Instead of sending malware to thousands of targets, attackers perform reconnaissance on potential targets for their high-privilege network access.
  • Ransomware-as-a-Service (RaaS) lets users launch attacks without any cybersecurity knowledge. The introduction of RaaS has led to an increase in ransomware attacks.

A primary reason for an increase in threats using ransomware is remote work. The pandemic introduced a new way of working globally. An at-home workforce is much more vulnerable to threats. Home users do not have the enterprise-level cybersecurity necessary to protect from sophisticated attacks, and many of these users comingle their personal devices with work devices. Since ransomware scans the network for vulnerable devices, personal computers infected with malware can also infect network-connected business machines.

Ransomware Prevention and Detection

Prevention for ransomware attacks typically involves setting up and testing backups as well as applying ransomware protection in security tools. Security tools such as email protection gateways are the first line of defense, while endpoints are a secondary defense. Intrusion Detection Systems (IDSs) are sometimes used to detect ransomware command-and-control to alert against a ransomware system calling out to a control server. User training is important, but user training is just one of several layers of defense to protect against ransomware, and it comes into play after the delivery of ransomware via an email phish.

A fallback measure, in case other ransomware preventative defenses fail, is to stockpile Bitcoin. This is more prevalent where immediate harm could impact customers or users at the affected firm. Hospitals and the hospitality industry are at particular risk of ransomware, as patients’ lives could be affected or people could be locked in or out of facilities.

Before/After

How to Prevent Ransomware Attacks

  • Defend your email against Ransomware – Email phishing and spam are the main way that ransomware attacks are distributed. Secure Email Gateways with targeted attack protection are crucial for detecting and blocking malicious emails that deliver ransomware. These solutions protect against malicious attachments, malicious documents, and URLs in emails delivered to user computers.
  • Defend your mobile devices against RansomwareMobile attack protection products, when used in conjunction with mobile device management (MDM) tools, can analyze applications on users’ devices and immediately alert users and IT to any applications that might compromise the environment.
  • Defend your web surfing against Ransomware – Secure web gateways can scan users’ web surfing traffic to identify malicious web ads that might lead them to ransomware.
  • Monitor your server, network and back up key systems – Monitoring tools can detect unusual file access activities, viruses, network C&C traffic and CPU loads, possibly in time to block ransomware from activating. Keeping a full image copy of crucial systems can reduce the risk of a crashed or encrypted machine causing a crucial operational bottleneck.

How to Remove Ransomware

  • Call federal and local law enforcement – Just as someone would call a federal agency for a kidnapping, organizations need to call the same bureau for ransomware. Their forensic technicians can ensure systems aren’t compromised in other ways, gather information to better protect organizations going forward and try to find the attackers.

Ransomware Recovery

  • Learn about anti-ransomware resources – No More Ransom portal and Bleeping Computer have tips, suggestions and even some decryptors for selected ransomware attacks.
  • Restore data – If organizations have followed best practices and kept system backups, they can restore their systems and resume normal operations.

Ransomware Statistics

The following ransomware statistics illustrate the rising epidemic and the billions it has cost victims. To stay up to date on the latest ransomware statistics, you can also check out the Proofpoint blog.

4,000

An average of 4,000 ransomware episodes occur every day. Source: FBI Internet Crime Report.

39%

Ransomware is the top variety of malicious software, found in 39% of cases where malware was identified. Source: Verizon’s 2018 Data Breach Investigations Report.

46%

In our latest State of the Phish™ Report, only 46% of respondents could correctly define ransomware.

42%

of U.S. respondents to our 2017 User Risk Report could not correctly identify what ransomware is.

Ransomware Survival Guide Cover

Ransomware Survival Guide

Ransomware attackers collected on average $115,123 per incident in 2019, but costs soared to $312,493 in 2020. One recorded event cost an organization $30 million. In addition to the ransom itself, these attacks can exact a heavy cost: business disruption, remediation costs, and a diminished brand.