What is someone who demands payment to stop an attack on an organizations technology infrastructure?

Ransomware is a type of malicious software [malware] that threatens to publish or blocks access to data or a computer system, usually by encrypting it, until the victim pays a ransom fee to the attacker. In many cases, the ransom demand comes with a deadline. If the victim doesn’t pay in time, the data is gone forever or the ransom increases.

Ransomware attacks are all too common these days. Major companies in North America and Europe alike have fallen victim to it. Cybercriminals will attack any consumer or any business and victims come from all industries.

Several government agencies, including the FBI, advise against paying the ransom to keep from encouraging the ransomware cycle, as does the No More Ransom Project. Furthermore, half of the victims who pay the ransom are likely to suffer from repeat ransomware attacks, especially if it is not cleaned from the system.

History of Ransomware Attacks

Ransomware can be traced back to 1989 when the “AIDS virus” was used to extort funds from recipients of the ransomware. Payments for that attack were made by mail to Panama, at which point a decryption key was also mailed back to the user.

In 1996, ransomware was known as “cryptoviral extortion,” introduced by Moti Yung and Adam Young from Columbia University. This idea, born in academia, illustrated the progression, strength, and creation of modern cryptographic tools. Young and Yung presented the first cryptovirology attack at the 1996 IEEE Security and Privacy conference. Their virus contained the attacker’s public key and encrypted the victim’s files. The malware then prompted the victim to send asymmetric ciphertext to the attacker to decipher and return the decryption key—for a fee.

Attackers have grown creative over the years by requiring payments that are nearly impossible to trace, which helps cybercriminals remain anonymous. For example, notorious mobile ransomware Fusob requires victims to pay using Apple iTunes gift cards instead of normal currencies, like dollars.

Ransomware attacks began to soar in popularity with the growth of cyptocurrencies, such as Bitcoin. Cryptocurrency is a digital currency that uses encryption techniques to verify and secure transactions and control the creation of new units. Beyond Bitcoin, there are other popular cryptocurrencies that attackers prompt victims to use, such as Ethereum, Litecoin, and Ripple.

Ransomware has attacked organizations in nearly every vertical, with one of the most famous viruses being the attacks on Presbyterian Memorial Hospital. This attack highlighted the potential damage and risks of ransomware. Labs, pharmacies and emergency rooms were hit.

Social engineering attackers have become more innovative over time. The Guardian wrote about a situation where new ransomware victims were asked to have two other users install the link and pay a ransom in order to have their files decrypted.

More Information on Locky Ransomware >

Presbyterian Memorial Hospital Ransomware Attack >

Examples of Ransomware

By learning about the major ransomware attacks below, organizations will gain a solid foundation of the tactics, exploits, and characteristics of most ransomware attacks. While there continues to be variations in the code, targets, and functions of ransomware, the innovation in ransomware attacks are typically incremental.

How Ransomware Works

Ransomware is a type of malware designed to extort money from its victims, who are blocked or prevented from accessing data on their systems. The two most prevalent types of ransomware are encryptors and screen lockers. Encryptors, as the name implies, encrypt data on a system, making the content useless without the decryption key. Screen lockers, on the other hand, simply block access to the system with a “lock” screen, asserting that the system is encrypted.

Why You Shouldn’t Pay Ransomware

After ransomware encrypts files, it shows a screen to the user announcing files are encrypted and the amount of money that must be paid. Usually, the victim is given a specific amount of time to pay or the ransom increases. Attackers also threaten to expose businesses and announce that they were victims of ransomware publicly.

The biggest risk of paying is never receiving cipher keys to decrypt data. The organization is out the money and still doesn’t have decryption keys. Most experts advise against paying the ransom to stop perpetuating the monetary benefits to attackers, but many organizations are left without a choice. Ransomware authors require cryptocurrency payments, so the money transfer cannot be reversed.

Ransomware Prevention and Detection

Prevention for ransomware attacks typically involves setting up and testing backups as well as applying ransomware protection in security tools. Security tools such as email protection gateways are the first line of defense, while endpoints are a secondary defense. Intrusion Detection Systems [IDSs] are sometimes used to detect ransomware command-and-control to alert against a ransomware system calling out to a control server. User training is important, but user training is just one of several layers of defense to protect against ransomware, and it comes into play after the delivery of ransomware via an email phish.

A fallback measure, in case other ransomware preventative defenses fail, is to stockpile Bitcoin. This is more prevalent where immediate harm could impact customers or users at the affected firm. Hospitals and the hospitality industry are at particular risk of ransomware, as patients’ lives could be affected or people could be locked in or out of facilities.

Before/After

Ransomware Statistics

The following ransomware statistics illustrate the rising epidemic and the billions it has cost victims. To stay up to date on the latest ransomware statistics, you can also check out the Proofpoint blog.

4,000

An average of 4,000 ransomware episodes occur every day. Source: FBI Internet Crime Report.

39%

Ransomware is the top variety of malicious software, found in 39% of cases where malware was identified. Source: Verizon’s 2018 Data Breach Investigations Report.

46%

In our latest State of the Phish™ Report, only 46% of respondents could correctly define ransomware.

42%

of U.S. respondents to our 2017 User Risk Report could not correctly identify what ransomware is.

Ransomware Survival Guide

Ransomware attackers collected on average $115,123 per incident in 2019, but costs soared to $312,493 in 2020. One recorded event cost an organization $30 million. In addition to the ransom itself, these attacks can exact a heavy cost: business disruption, remediation costs, and a diminished brand.

Ransomware FAQs

Is ransomware a virus?

Ransomware and viruses are both forms of malware, but ransomware is not a virus. Ransomware is considered its own category of malware, but it does not self-replicate like a virus. Both viruses and ransomware damage files, but they act differently once the payload is delivered.

What is the WannaCry ransomware attack?

The WannaCry ransomware took advantage of a Microsoft Windows vulnerability to spread quickly across the internet and encrypt files to hold them hostage. It encrypts files with cryptographically secure algorithms so that targeted victims are forced to pay the ransom in Bitcoin to obtain the private key or recover from backups. The files cannot be decrypted, so many organizations were forced to pay the ransom.

What is DarkSide ransomware?

The hacking group known as DarkSide created the DarkSide malware that works as ransomware-as-a-service [RaaS]. The malware double extorts its targets by first requiring payment to decrypt files and second to require payment for the exfiltrated sensitive data. It targets servers hosting the Remote Desktop Protocol [RDP] and brute forces the password to gain access to the machine’s local files.

How long does it take to recover from ransomware?

The time it takes varies wildly depending on the extent of the damage, the efficiency of the organization’s disaster recovery plan, response times, and the containment and eradication timeframes. Without good backups and disaster recovery plans, organizations could stay offline for days, which is a severe revenue-impacting event.

Ransomware Attacks on the Rise – What You Need to Know

Ransomware is one of today’s most disruptive forms of cyber attacks, putting victims out of business, forcing hospitals to turn away patients, and bringing entire city governments and municipalities to a standstill.

How to Prepare for Ransomware Attacks

Download the Gartner report to learn how to prepare for ransomware and what you should do before, during and after an attack.

The First Step: Initial Access Leads to Ransomware

Ransomware attacks still use email -- but not in the way you might think.