The Complete Guide to Ransomware

A ransomware attack begins when malicious software is downloaded onto a device. Examples of device types are laptops, smartphones or desktop computers. The malicious software is normally downloaded due to user error or inadequate security protocols.

Over the last few years, phishing attacks have become a popular way of distributing ransomware. A phishing attack is where a cybercriminal will attach an infected document or URL to an email, disguising it as legitimate mail, with the hope that it will trick the recipient into opening it. Once opened, the ransomware is installed on the device.

The ‘trojan horse’ is another popular style of attack that involves disguising ransomware as legitimate software, and then infecting devices after users install this software.

Once  ransomware has infected a system, it will take over the device's critical process; searching for files to encrypt; the virus will scramble all the data on the device or delete those files it can’t encrypt. It will also  infect any external devices attached to the host machine. The virus will also send signals to other devices on the infected network ti infect them as well.

There are many different variants of ransomware, with new ones being created all the time. Below are the most recurrent and famous ransomware types: 

Phishing

The most common delivery system for ransomware is via phishing spam – attachments that arrive in a victim’s email, masquerading as a file that they can trust. According to research from Trend Micro,  a research security firm, 91% of cyber attacks and the resulting data breach begin with a spear-phishing email.

Once the attachment has been downloaded and opened, the malware can take over the victim’s computer, encrypting some of the user’s files. When this happens, the only way the files can be decrypted is through a mathematical key only known to by the attacker.

There have also been cases where malware will display a message claiming that the user’s ‘Windows’ is locked. The user is then encouraged to call a “Microsoft” phone number and enter a six-digit code to reactivate the system. The message alleges that the phone call is free, but this isn’t true. While on the phone calling the fake ‘Microsoft’, the user racks up long-distance call charges.

Doxware

Another malware is called leakware or doxware. This is where the attacker will threaten to release sensitive data on the victim’s hard drive unless a ransom is paid. Often targeting emails and word documents, there have also been cases of mobile variants where private messages, pictures, and contact lists from users’ phones have been released.

Doxware is recognized as a more effective malware than ransomware – in terms of getting the money from the victim. With ransomware, you can maintain separate backups of data that is no longer accessible, but with doxware, once an attacker has information that the victim doesn’t want to be made public, there is little to be done apart from paying up.

Anatova

A discovery for 2019 was the ransomware Anatova. This new, extremely advanced type of ransomware disguises itself as the icon of a game or application to trick the user into downloading it. An extremely advanced form of malware, it adapts quickly and uses evasion and spreading techniques to prevent its discovery. Due to its modular design, it can embed additional functionalities allowing it to thwart anti-ransomware methods. Fortunately, the McAfee Advanced Threat Research team discovered this new ransomware family in early 2019 before it became a significant threat.

Dharma

A variant of CrySiS, Dharma ransomware has been around since 2018, but cybercriminals continue to release new variants, which are impossible to decrypt.

GandCrab

Malicious ransomware that uses AES encryption and drops a file called ‘GandCrab.exe’ onto the system. GandCrab targets consumers and businesses with PCs running Microsoft Windows. On May 31^st, 2019, the cybercriminals behind GandCrab sent an announcement saying they were stopping all further GandCrab ransomware attacks claiming they had made over $2 billion in ransom payments and they were taking a “well-earnt retirement.”

Emotet

Emotet was originally a malware that targeted banks – it would sneak onto your computer and steal sensitive and private information. First, on the scene in 2014, Emotet has gone through a variety of versions, evolving into ransomware that can evade detection even by some anti-malware products. Since its inception, Emotet has stolen banking logins, financial data, and Bitcoin wallets from individuals, companies and government entities across Europe and the USA.

Using worm-like capabilities to spread to other computers, hackers usually introduce Emotet by spam emails – made to look legitimate and with the use of tempting language to trick the victim into clicking on the link.

Accorind to the US Department of Homeland Security, Emotet is one of the most costly and destructive malware .The estimated cost of the average Emotet attack is upwards of $1 million to clean up.

Ryuk

Ryuk specifically targets large organizations for a high-financial return. According to CrowdStrike, between August 2018 and January 2019, Ryuk netted over 705.80 bitcoins across 52 transactions totaling a value of $3,701,893.98. It first turned heads with its attack on Tribune Publishing’s operations over the Christmas period of 2018. At first, the company thought the attack was just a server outage, but it was soon clear it was the Ryuk ransomware.

Another term for ransomware such as Ryuk that targets large enterprises for high ROI is ‘big game hunting.’ These large-scale attacks involve detailed customization of campaigns to best suit the individual targets, increasing the attack’s effectiveness. ‘Big game hunting’ therefore requires much more work from the hacker; it is also normally launched in phases. For example, phase one might be a phishing attack focusing on infecting’ an enterprises network with malware to map the system and identify crucial assets to target. Phases two and three will then be a series of extortion and ransom attacks/demands.

Should I pay the ransom?

You would think that paying a ransom to gain access to your data was bad enough, but that can pale in comparison to the actual damage costs involved with an attack. Additional implications include:

• Damage and destruction (or loss) of data
• Lost productivity
• Post-attack disruption to the normal course of business
• Forensic investigation
• Restoration and deletion of hostage data and systems
• Reputational harm
• Employee training in direct response to the attacks
  

When you take the above into account, it is no wonder that ransomware damages are predicted to climb to $11.5 billion this year, with an attack projected every 14 seconds by the end of this year, up from every 40 seconds last year.

When you speak to cybercrime experts, most urge you not to pay the ransoms as funding ransomware attackers will only help create more ransomware.

Although, many organizations go against this advice weighing up the cost of the encrypted data against the ransom being asked. Last year, in the US, 45% of companies hit with ransomware paid their attackers. But why?

While refusing to pay ransomware is suggested for the wider business community, refusing to pay may not be the best course of action for the business itself. When there is a chance the business may permanently lose access to vital data, incur fines from regulators or go out of business altogether businesses’ options may seem bleak. The choice between paying a relatively modest ransom and staying in business or refusing to pay to help the wider business community is a no brainer for most.

In some ransomware cases, the ransom demanded is often set at a point that it’s worth the attacker’s while, but low enough that it is often cheaper than a victim paying to reconstruct their lost data. Discounts are also sometimes offered if the victim pays within a certain timeframe e.g., 3 days.

With that in mind, some companies are building up reserves of Bitcoin specifically for ransom payments. For example in the UK, organizations seem more likely to pay ransoms. According to Gotham Sharma, managing director at Exeltek Consulting Group, “About a third of mid-sized British companies report having Bitcoin on hand to respond to ransomware emergencies when other options can’t be immediately exhausted.”

icon

Start your ransomware data recovery now with a free consultation.

Contact our team of experts. Ontrack accommodates everyone – from the largest government or enterprise organization to an individual who may have lost their digital photos and everyone in between.