[Ransomware] Ransomware Demanding 'Ransom' - Risks and Survival Strategies

Illustration depicting the threat of ransomware

Introduction

Picture this: your computer screen suddenly goes dark, and a foreboding red warning emerges: "Your files have been encrypted. Please pay to recover them." The sight of this message induces panic and dread. This nefarious cyberattack is none other than ransomware – a digital hostage situation where your data is held captive, and a ransom is demanded for its release.

Fear not, for this article serves as your guide to navigate through this unsettling landscape. Join us as we delve into the world of ransomware, understanding its nuances, exploring how it permeates our daily lives, and equipping you with strategies to prevent and combat this cyber threat.

1. What is Ransomware?

Ransomware, a portmanteau of the words "ransom" and "malware," denotes malicious software that infiltrates a computer without the user's consent. This nefarious program encrypts the user's data, rendering it inaccessible, and subsequently demands a ransom for the decryption key. In the event of a computer infected with ransomware rebooting before encryption completion, a message is displayed, stating, "Your computer is infected with ransomware." Once the files are encrypted, the program demands an initial ransom of $300, doubling to $600 if the payment isn't made within three days. After seven days, the software prevents the recovery of files, intensifying the urgency to comply with the ransom demand.

2. Risks of Ransomware

Ransomware poses a pervasive threat, targeting nearly every operating system, from mobile to macOS, leaving users vulnerable at any given moment. Even in cases where victims decide to pay the hackers, there's no assurance that their files will be fully restored; in some instances, the data vanishes despite complying with the extortion demands. The immediacy of its impact is felt as it swiftly encrypts files on the victim's computer, exerting pressure on memory resources. Even after the malware is eradicated, its aftermath lingers, leading to a significant performance degradation of over 90%.

3. Attack Methods Recognized by International Standards

International standards play a crucial role in defining security requirements and countermeasures against targeted email attacks, providing a reliable framework registered with the International Telecommunication Union (ITU), a specialized UN agency. Let's delve into how ransomware is addressed in these authoritative documents of email security.

Ransomware attacks often commence with phishing or targeted email attacks, where malevolent actors employ deceptive emails to induce recipients into downloading malware. Specifically, International Standards, as outlined in 7.1.2 Malware in Attachment, address the threat posed by malicious email attachments.

"Malicious email attachments are a type of threat in which an attacker hides malware inside a file that is typically sent by email. Attachments in these malicious emails can be disguised as documents, executable files, and even image and video files. These files can also be encrypted with different extensions. Attacks using executable files can spoof the sender's address to trick the recipient into opening an email containing a malicious document."

Given that ransomware falls under the category of malware, it's logical to infer that the methods outlined above could be adapted for launching a ransomware attack on a victim. Let's get a little more specific about how a ransomware attack could be executed.

Malware Hidden in Common Files

Ransomware often infiltrates systems by concealing itself within seemingly harmless files. Attackers embed ransomware in attachments that masquerade as ordinary documents, executables, or multimedia files – the same file types susceptible to the malware mentioned in the article.

Disguised Attachments

Similar to the discussion on various file types disguising malware, ransomware adopts the same camouflage strategy. The unsuspecting user, upon opening these infected files, unknowingly triggers the execution of the ransomware.

Use of Encrypted Files

The reference to encrypted extensions aligns with ransomware characteristics. Ransomware is notorious for encrypting users' files and demanding a ransom for the decryption key. An encrypted file embedded in an email can serve as the initial breach point, activating the ransomware upon execution.

Sender Address Spoofing

Commonly employed in phishing emails for ransomware distribution, sender address spoofing aims to make the email appear from a trusted source. By manipulating the sender's address, attackers increase the likelihood of recipients opening the attachment, inadvertently installing the ransomware.

3. Case Study

- WannaCry

On May 12, 2017, the world witnessed the outbreak of WannaCry, a highly contagious virus leveraging worm-like characteristics. This malicious software made a global impact, infecting 300,000 PCs across 150 countries, including major nations like the United States, United Kingdom, and Russia. It ruthlessly crippled computer networks in hospitals, banks, and businesses, causing extensive disruptions worldwide. The estimated damage ranged from $4 billion to $8 billion, solidifying WannaCry as one of the most financially devastating cyber incidents in history.

- NotPetya

The NotPetya ransomware attack, originating in Ukraine in 2017, had far-reaching consequences for businesses globally. Distinguishing itself from typical cybercrimes, this incident was considered an act of cyberwarfare, causing billions of dollars in damages. Unlike conventional ransomware, NotPetya didn't follow the usual pattern of encrypting users' files for ransom. Instead, it adopted a more destructive approach, corrupting files on targeted systems.

4. How Ransomware Works and Types of Attacks

Ransomware infiltrates your system through various avenues such as email attachments, phishing sites, and downloads. Once inside, it initiates a surge in CPU, hard disk, and memory usage, commencing the encryption process on files. This encryption renders user data inaccessible. Following the encryption, the ransomware dispatches a message to the user, demanding payment of the ransom. Typically, these ransoms are paid in cryptocurrency, accompanied by threats of permanent damage or public release of files if the payment is not made.

- Crypto Ransomware: Directly encrypts files or data on the victim's disk using robust encryption algorithms, making file recovery extremely challenging without the specific decryption key. Crypto ransomware commonly infiltrates systems through email attachments, malicious ads, and phishing websites.

- Locker Ransomware: Operates by locking down a user's entire system or specific functions, preventing normal computer usage. To regain access, victims are coerced into paying a ransom to unlock their system.

- Scareware: Disguised as fake security software or cleanup tools, scareware induces fear by presenting fake virus warnings or system error messages. Users are then pressured into paying for fraudulent security software to resolve the non-existent issues.

- Doxware: Focuses on stealing personal information and subsequently extorting a ransom to prevent the disclosure of this sensitive data. The term "doxing" refers to the act of harvesting and publishing individuals' personal information online.

5. How to Avoid Ransomware

Ransomware infections can occur through various channels, including unsecured emails, fake websites, software downloads, or malicious attachments. Therefore, it is necessary for PC users to thoroughly manage security, such as avoiding access to unsafe routes and taking backup and security measures.

- Comply with the International Email Security Standard: First, to respond to the threat of new malware attacks, it is necessary to conduct behavior-based analysis to detect new viruses that are not registered in patterns. Second, it is recommended to scan the attachments contained in incoming emails and quarantine them if they are determined to be malicious. Third, all URLs should be checked for malware, and the final URL within multiple linked URLs should be tracked.

- Update your security software: Install antivirus software from leading vendors that are proven to provide good protection, and regularly keep your antivirus and security software up to date to increase your defense against new ransomware.

- Strengthen network security: Prevent the propagation of ransomware through strong firewall and intranet security. It's important to understand the core principles of network defense. Encryption, access control, and surveillance and detection can prevent security incidents before they happen.

- Regular backups: Regularly backing up your data is a crucial defense against ransomware attacks because they allow you to restore lost or corrupted data and recover from cyberattacks. It's important to back up your important files regularly so that you have a backup to recover your data in the event of a ransomware infection.

6. Solutions

Paying the ransom isn't the only option: paying the hackers is a guarantee that the ransomware attack is successful, which can trigger further attacks from the same or other hackers.

First of all, disconnect the infected device from all network connections immediately, but don't turn it off. In very serious cases, it may be necessary to block Wi-Fi, disable critical network connections, and disconnect from the internet.

Next, you should reset your passwords, especially administrator and other system accounts. At this point, you need to be careful not to cut yourself off from the systems you need to recover.

Check to see if a decryption solution exists, and if not, you may need to attempt a system restore or reinstall the computer to a factory state. Safely and completely format the infected device and reinstall the OS.

Afterward, install and update your antivirus software to the latest version and run it. Reconnect to the network, monitor network traffic, and run virus scans to determine any residual infections.

It is imperative for businesses to view cybersecurity as a fundamental necessity rather than an optional consideration. Recent ransomware incidents underscore the critical importance of timely security updates for computer systems. This serves as a wake-up call, emphasizing the need for heightened cybersecurity awareness and a deeper understanding of security measures. To proactively prevent ransomware attacks, trust in established standards is vital. Regular data backups, coupled with wariness against clicking on attachments or links in untrusted emails, form the cornerstone of a resilient cybersecurity strategy. By embracing these practices, businesses can fortify their defenses, reduce risks, and contribute to a more secure digital environment.

7. References

https://www.nomoreransom.org/en/index.html

https://www.beyondtrust.com/blog/entry/will-darkside-pipeline-ransomware-attack-fuel-cybersecurity-upgrades-for-critical-infrastructure

https://www.microsoft.com/en-us/security/blog/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

<ITU-T Recommendations>

https://www.itu.int/ITU-T/recommendations/rec.aspx?rec=15710&lang=en