How Ransomware Works Infographic
In the last few years, we have seen many ransomware-related incidents in Information Security. It’s more likely that the word ransomware has become a common occurrence for you and everyone else because our lives are so related to computing nowadays. A fine example of a ransomware attack is WannaCry Ransomware, – A global epidemic in the digital world that happened in 2017. Let’s explore more about ransomware in detail. What is Ransomware? Ransomware is a type of malware that encrypts data, including images, videos, and essential documents owned by victims. It later helps the attackers extort ransom in exchange for a key to decrypt the data and make it accessible to victims. These ransom amounts can vary from hundreds to millions of dollars and are to be paid in the form of bitcoin or any other cryptocurrency so that they cannot be traced easily. How Does A Ransomware Attack Work? What Are The Three Types of Ransomware? Screen Locking: Such ransomware attacks lock the victim entirely out of their devices, making it impossible to access the files or anything stored on the devices. In such attacks, the victim gets to see a message window on the infected device screen asking for ransom in exchange for unlocking the device. The details are mentioned in that display message, including payment addresses. The same message window also has a countdown to create a panic situation. Encrypted Ransomware: This malware uses encryption algorithms to encrypt the data present on the victim’s device. Through this, a note is shared in the form of a text file that explains the situation to the victim and asks them for ransom to get a decryption key to decrypt their data. Scareware: This malware uses social engineering to trick victims into believing their device is infected through display pop-ups. Then, the victims are manipulated or convinced to buy and download fake software to fix the same phony issue. Live Ransomware Attacks Happened In The Wild. Ransomware attacks can have significant impacts on businesses and organizations, disrupting operations and leading to significant financial losses. Here are three of the several live ransomware attacks that have happened in the past: WannaCry Ransomware Attack: In May 2017, the WannaCry ransomware attack affected more than 200,000 computers in 150 countries. The attack used a vulnerability in Microsoft Windows to spread rapidly across networks (a type of ransomware worm), encrypting users’ data and demanding a ransom in order to decrypt it. The attack caused widespread disruption in hospitals, businesses, and government agencies. AIIMS India, November 2022 Ransomware Attack: On November 23, 2022, the All India Institute of Medical Sciences (AIIMS) suffered a ransomware attack that resulted in the disruption of its digital patient management system. In this case, the attackers encrypted the data and demanded a ransom for the decryption key. Due to the attack, the online appointment system remained offline, and all services, including outpatient and inpatient departments and labs, had to be conducted manually. REvil ransomware attack: In 2020, the REvil (also known as Sodinokibi) ransomware attack targeted several large organizations, including the travel company CWT and the software company Citrix. The attackers demanded multi-million dollar ransom payments in exchange for decrypting the affected systems. What If You Get Infected By Ransomware? There are several countermeasures a victim must follow if their system has been compromised by ransomware. A few of them are as follows: Make sure you isolate the affected device/system and users as soon as possible. Ransomware usually tries to peek into the internal network and capture as many devices as possible on the same network. Make sure to note down important details related to the ransomware infecting your system. Valuable information such as encrypted file extension, the ransom note, any new changes in the system, etc. As soon as you discover a ransomware attack happening on your device, you can choose to turn off your device or system to stop the ransomware from spreading. This can save some of your data. It is advisable to disable any kind of cron job or maintenance task that can interfere with the infected files. Such files can be valuable for forensic analysis. If the information related to ransomware collected is identifiable and already has a decryption algorithm or tool available online, search for it. One example of a place to search for such decryption tools is No More Ransom. Should You Pay The Ransom? It is generally not recommended to pay a ransom to threat actors who have encrypted your data or otherwise taken control of your computer systems through a ransomware attack. There are several reasons for this: Prevention Against Ransomware Attacks Below are a few ways to prevent Ransomware and strengthen your defense: FAQ
