WHAT IS RANSOMWARE?

Ransomware is a type of malware and cybercrime that holds data for ransom. Access to data on computer networks, mobile devices, and servers is locked until the victim pays a ransom.

Common ransomware targets include individuals, companies, organizations such as hospitals, governments, and educational institutions. The two main types of ransomware are crypto ransomware and locker ransomware.

Ransomware can take on multiple forms. One of the most common ransomware attack methods is leveraging a phishing scam. A carefully worded email urges the recipient to open an attachment or download a file. This action installs vector ransomware that takes over the computer and can infiltrate the entire computer network, locking everyone out of their computers, the network, and other connected systems.

The goal of ransomware is to convince the victim to pay a ransom to unlock their data. Typically, the criminals behind ransomware attacks will demand payment in cryptocurrency. This is due to its largely untraceable nature. Once the payment is secured, the victim receives an unlock code or decryption file that releases the data on the computer network, mobile device, or servers.

According to the U.S. Treasury’s Financial Crimes Enforcement Network, the average monthly suspicious amount of ransomware transactions totaled over $66 million in 2021. That’s roughly $2.2 million per day. More jaw-dropping is the forecast that ransomware-related damage costs alone are expected to exceed $265 billion by 2031. These facts underscore the reality that technological safeguards alone cannot prevent ransomware attacks nor their many ramifications.

Ransomware is a type of social engineering that criminals use to steal data, infect computers, and infiltrate company networks.

What Are the Main Types of Ransomware?

Crypto Ransomware

Crypto ransomware prevents access to personal files and data. Crypto ransomware is smart enough to find valuable data on the computer or mobile device, encrypt it, and lock the victim out for an indeterminate period.

Crypto ransomware looks for flaws and weaknesses in computers and devices, seeking out data that has not been backed up. This data can be anything deemed essential, including photos, videos, large work projects, tax and financial data, phone numbers, and more.

This type of malware is very savvy, encrypting all valuable data before revealing itself to the victim. This data is held ransom until the victim agrees to pay.

Crypto ransomware typically does not lock the entire computer or mobile device. Victims can usually still any areas that are not encrypted and trapped by the ransomware.

Crypto ransomware is also referred to as a data locker.

Locker Ransomware

Locker ransomware locks and shuts down the entire computer or mobile device. Victims are asked to pay a ransom to release the computer or mobile device.

Typically, the locked system allows only limited access, forcing the victim to only interact with the ransomware criminal. Sections of the keyboard might be locked, or the mouse is frozen, effectively only allowing the victim to respond to the ransomware demands.

Locker ransomware usually does not infiltrate the entire computer network or attack the files on the computer. This facet makes it easier to find this type of malware and remove it without paying the ransom.

Because locker ransomware can be removed from the computer, criminals often use social engineering tactics to convince the victim to pay. For example, the ransomware pretends to be a tax authority or law enforcement agency that threatens to issue fines and other penalties for supposed illegal online activities. This causes the victim to panic and pay whatever price is demanded.

Locker ransomware is also referred to as computer locker.

What Are the Ransomware Techniques?

File Encryption

Crypto ransomware uses either symmetric or asymmetric file encryption. Symmetric encryption uses the same key to encrypt and decrypt the data. Asymmetric encryption uses a public key to encrypt the data and a private key to decrypt the data.

Symmetric encryption is a much faster method of encrypting data and files. If the victim discovers the key, it is much easier to decrypt the data. With asymmetric encryption, the criminal does not need to worry about protecting the public key since it cannot decrypt the data.

Savvy crypto ransomware uses a combination of symmetric and asymmetric file encryption. Common types of file encryption include downloaded public key, embedded public key, and an embedded symmetric key.

Screen Locking

Locker ransomware uses screen locking to lock the victim out of their computer or mobile device. This means the victim cannot access anything on the computer or mobile device, including the operating system or other network services.

Often a ransom message is displayed on the screen in a continuous loop. The screen may include a countdown timer or an increasing ransom demand.

Common types of screen locking include Windows locker ransomware, browser locking, and Android locker ransomware.

How Does Ransomware Work?

Ransomware works by using a variety of methods, including:

Downloaders

When a downloader infiltrates a computer, it downloads more ransomware malware that further infects the computer or mobile device. Typically this type of ransomware allows cyber criminals to control the computer or device.

Malvertisement

Fake criminal advertisements are displayed on real websites and direct the victim to a website hosting an exploit kit.

Phishing

Phishing or spam email uses social engineering techniques to convince victims to download or open attachments.

Self-Propagation

The ransomware spreads on the affected system, attacking any computers or devices on a shared network.

Traffic Distribution System

Website traffic is redirected to a website that hosts an exploit kit. The exploit kit exposes computer weaknesses, and the ransomware is installed with drive-by-download malware.

What Are Some Examples of Ransomware?

The simulation template used during the 2021 Gone Phishing Tournament is a prime example of how easy it can be for cyber criminals to trick unsuspecting individuals into downloading and/or installing a ransomware file.

Phishing Email

This process starts, as many successful cyber attacks do, with a phishing message that persuades the recipient to click on a malicious link or download a potentially harmful attachment. In the case of the event’s simulation template, the former tactic was used, directing participating end users to a fake webpage through which the ransomware was delivered.

Landing Page

The email and webpage spoofed the Microsoft SharePoint interface for an authentic look and feel. The email message even included instructions on how to download the file, which further enticed the end user to complete the action once they landed on the webpage.

These tactics can be leveraged with minimal effort by anyone looking to infect a device with ransomware and lock the victim(s) out of their computer(s), network, and related systems.

For more information on the 2021 Gone Phishing Tournament simulation template that addressed end user behaviors related to ransomware, download the full report now!

Who Is A Ransomware Target?

Any person, business, organization, or government is a target for ransomware. Cyber criminals are looking for anyone willing to pay a ransom to regain access to their data, computer networks, servers, or mobile devices.

Cyber criminals do not care who they attack with their ransomware. Because of this, it’s critically important that your employees and organization are cyber secure.

The ease of use of ransomware for cyber criminals highlights why it is vital that everyone in your organization is aware of the threats and risks of ransomware.

Ransomware simulation allows you to identify which employees are prone to ransomware and educate your team on how easy it is for social engineering attacks to happen.

How to Prevent Ransomware

1. Invest in your people. Put an emphasis and focus on phishing and security awareness to reduce human risk. Take advantage of free ransomware simulation tools to educate and identify ransomware risks.

2. Give your employees the necessary tools and knowledge they need to recognize ransomware risks. Educate your team on how and when to open unexpected attachments or those from unfamiliar sources.

3. Create internal cyber security heroes committed to keeping your organization cyber secure. This process helps motivate your employees to change their behavior.

4. Use proven security awareness training and ransomware simulation training platforms to provide engaging and effective security awareness education.

5. Foster and create environmental support for behavior change. Create a work environment that inspires learning and encourages a security-conscious culture.

6. Take advantage of automated and simple-to-use training to keep learning engaging, informative, and manageable. Read The Human Fix to Human Risk to learn step-by-step guidelines on developing an effective security awareness program that enhances security behaviors.

7. Provide ongoing communication and campaigns about cyber security, ransomware, and the risks that can come in the format of URLs, emails, and attachments.

8. Use a flexible delivery model that includes animated videos, interactive online training, managed security services, microlearning modules and phishing simulations to provide ongoing support.

9. Benefit from a free CISO coaching session to learn how to improve existing ransomware awareness or create a new security awareness program.

10. Watch our ransomware webcast to learn how easy it is for anyone to become a victim of ransomware and how you can protect your organization.

What is a Ransomware Simulation?

A ransomware simulation is the best way to raise awareness of ransomware risks. It can also help identify which employees are most at risk for ransomware attacks.

Ransomware simulation makes it easy to incorporate cyber security awareness into your organization in an engaging and informative format.

Real-time simulations educate end users and increase organization-wide understanding of ransomware attacks. People see first-hand how easy it is to be tricked into installing ransomware malware on their computers and mobile devices.

What are the Top 10 Benefits of a Ransomware Simulation?

1. Move from beware to be aware of cyber security risks

2. Measure levels of corporate and employee vulnerability

3. Eliminate the cyber threat risk level

4. Increase user awareness of ransomware and social engineering risks

5. Create cyber security heroes and instill a cyber security culture

6. Change behavior to eliminate the automatic trust response cyber criminals rely on

7. Deploy targeted anti-ransomware and anti-phishing solutions

8. Protect valuable corporate and personal data

9. Assess the impacts of cyber security awareness training

10. Meet industry compliance obligations

To learn more about ransomware and how you can keep your organization cyber secure, take advantage of our free security awareness training resources:

FREE RANSOMWARE SIMULATION TRIAL

WATCH WEBCAST

DOWNLOAD eBOOK

Terranova Security is committed to delivering people-centric training that makes your organization cyber security aware.