Ransomware: How it's Evolved, What it's Future Looks Like, and How to Protect Your Business Against it

Ransomware has been a serious threat to all kinds of organizations for a couple of years, and 2018 is no different. For those who are somehow unaware, ransomware is a form of malicious software that threatens the elimination of hijacked and encrypted data if a user doesn’t pay a ransom. It is known to be one of the most prolific and pervasive threats seen on the Internet today. Below we'll examine how ransomware has evolved over the past several years, what the future of ransomware looks like, and what you can do to protect yourself against it.

Ransomware
Unlike most other malware threats, ransomware isn’t designed to gain access to a system to pilfer data. It’s also not really a con, as anyone that is inundated with ransomware is in a real threat to lose their data (or their money). Ransomware is essentially one of two types of malware. Some are computer viruses that target the CPU. These are called “locker” ransomware. The other prevalent type, called “crypto” ransomware, target and encrypt access to file systems.

Whichever strand gets you (and there are dozens of different strands) the basic premise is the same: after it is unpackaged to the user’s machine (or network) it encrypts access to data/processing/both and gives the system’s user instructions on how to proceed. The user then has to decide whether to pay the ransom or try to restore the data from their backup platform.

Ransomware is such a departure from normal malware in that most strands of malware tries to camouflage itself inside a user's system or network. Ransomware makes sure you know it’s there. The past few years has seen a massive uptick in the amount of ransomware that has been deployed, both in variant, and in frequency. These attacks have hit many municipalities, businesses, and other organizations, with one purpose, to extort money.

With the litany of ransomware attacks conducted on very public forums, it has led people to start to ask, “How are these attacks carried out?” The answer may surprise you.

Delivery
You may think that such a devastating computer virus would have to be delivered by black hat hackers who sit in a basement someplace carrying out some well-devised scheme to defraud your organization. Or maybe it’s sabotage by a disgruntled former worker who didn’t get his/her 25% raise and inexplicably still had access to the network. The truth is that, while it could be either one of those examples, it is most likely the result of an honest act of negligence by someone who has access to your network.

The majority of ransomware attacks are conducted by hackers that try to spoof legitimate company’s emails. Since these emails seem to be coming from a legitimate place, unwitting end-users click on links or download attachments from these emails, resulting in the malware attached being deployed on the system. The code then goes to work encrypting files or the hard drive.

User View (and What They Don’t See)
Once the ransomware has inundated the system and the file or drive is encrypted, the server will send a message to the victim. Usually, the user will get a notice that their files/computer has been encrypted and the only way to get the file back is to follow the instructions given in the notice. This includes payment arrangements and the dreaded countdown meter. If the user doesn’t meet the demands outlined in the notice, their data will be deleted forever, or their computer will be locked. 

What the user doesn’t see, though, is that the hacker, who has control over this data or infrastructure is probably not letting this end-user off the hook. The ransomware is bad enough, to exacerbate things for this foolish user, the hacker can now do what they please with that machine. Sometimes they will include directions that will allow the hacker to steal the victim’s credentials. Even if the ransom is paid, and the files/system is returned to user as agreed upon, many of these attackers will load additional malware onto the system, allowing them to further persecute a person whose only mistake was clicking on a link they assumed was a legitimate source.

How to Avoid Ransomware
It is imperative to have enough security on your machine/network to ensure that any potential threat is eliminated before it can be a problem. A Unified Threat Management tool is a great solution to mitigate network problems. Not only does it have a firewall and antivirus, it comes with a spam filter that can help users from being exposed to emails rife with malware in the first place.

Also imperative: training your staff on how to determine the legitimacy of any message. Ransomware can be deployed via email, messaging services, and social media, so educating them on how to avoid these situations is an integral step in keeping these threats off of your organization’s network.

Having a powerful and up-to-date backup of your organization’s data can be a life-saver in situations like the one outlined above. Macro System’s BDR provides any organization the data protection they need through redundancy. Not only is your data backed up at regular intervals locally, it is also backed up in an offsite data center. Having up-to-date backups on hand could save your hide in several different situations.

For more information about ransomware, what you have to do to keep from experiencing it, and how to protect yourself from all manners of online threats, call us today at 703-359-9211.