What is Ransomware? An Easy-to-Understand Guide

Ransomware, or ransom malware, is a type of malware used to prevent access to computer systems by infecting them with a virus and threatening not to remove it until demands are met. In most cases, the ransom is monetary, with payment demanded in cryptocurrency (e.g., Bitcoin). Depending on the type of ransomware malware, denial of access could be permanent if the ransom is not paid.

Ransomware has wreaked havoc on organizations and individuals for more than 30 years. In 1989, Joseph L. Popp, a Harvard-educated biologist, introduced a Trojan by sending 20,000 compromised diskettes named “AIDS Information—Introductory Diskettes” to attendees of a World Health Organization AIDS conference.

The Trojan encrypted file names on the computers and hid directories for the systems where users inserted the diskette. Then, a message popped up, telling users to pay $189 to PC Cyborg Corp. (by mail to a PO box in Panama) to have their systems decrypted.

Ransomware criminals are as varied as their approaches and targets. However, what remains consistent about ransomware is that small and medium businesses are the target of the bulk of attacks, because they lack the depth of security infrastructure that larger organizations have, making them easier targets.

Ransomware is used by individuals, small groups, and crime syndicates. The accessibility and ease of use make it readily accessible as would-be criminals can buy ransomware on the dark web or use ransomware-as-a-service.

The primary roles in a ransomware operation are:

The more committed cybercriminals band together in networks to leverage reach, resources, and skills. The way these ransomware networks organize differs, but the three most common structures are:

1. Consolidated ownership and operations
One organization or individual controls all three operational functions and keeps 100% of the profits.

2. Channel-styled operations
The lead organization handles ransomware procurement and hosting as well as payment collection and distribution. Campaign development and execution, or the spread of ransomware, is managed by a third-party organization or individual who generally receives 50-75% of the profits. This model is popularly known as ransomware-as-a-service.

3. Ransomware infrastructure-in-a-box
A third-party service provider packages and sells the bundle of products and services needed to launch ransomware attacks and collect payment. Then the attacker procures the ransomware, buys the bundled solution, and keeps 100% of the profits.

How Ransomware Works

There are three main types of ransomware, ranging from annoying to potentially devastating:

1. 1. Scareware Ransomware
   Scareware malware tricks users into believing that their system is infected and they need to purchase a product to repair it. Users are inundated with pop-up notifications intended to bully them into buying the fake solution. While the pop-ups are annoying, there is no underlying threat to the systems until users click on their malicious links.
2. 2. Screen Lockers or Locker Ransomware
   Screen locker ransomware is a form of malware that freezes users out of their systems. It blocks them from logging in or accessing files. Payment is demanded to regain access.
   
   A common tactic for locker ransomware is to put an official-looking seal on the page (e.g., FBI or US Department of Justice) with a note stating that illegal activity has been detected on the computer and the user must pay a fine. Screen locker ransomware uses non-encrypting malware to lock the infected computer.
3. 3. Encrypting Ransomware or Crypto Ransomware
   Encryption ransomware is a form of malware that uses complex algorithms to lock all data on the targeted system. The danger of crypto ransomware is that it usually cannot be decrypted without a key.

Two signs a system may have been infected by ransomware:

1. 1. The screen is locked and shows a message about how to pay to unlock the system, and/or the file directories contain a “ransom note.”
2. 2. Files have a new extension appended to the file names, such as .ecc, .ezz, .exx, .zzz, .xyz, .aaa, .abc, .ccc, .vvv, .xxx, .ttt, .micro, .encrypted, .locked, .crypto, _crypt, .crinf, .r5a, .XRNT, .XTBL, .crypt, .R16M01D05, .pzdc, .good, .LOL!, .OMG!, .RDM, .RRK, .encryptedRSA, .crjoker, .EnCiPhErEd, .LeChiffre, .keybtc@inbox_com, .0x0, .bleep, .1999, .vault, .HA3, .toxcrypt, .magic, .SUPERCRYPT, .CTBL, .CTB2, .locky, or 6-7 length extension consisting of random characters.

Ransomware Entry Points

Ransomware depends not on the complexity of its code, but the vulnerabilities of its targets. At its core, ransomware is a worm looking for a hole. Preparation for a near-inevitable ransomware attack helps to prevent the malware from breaching systems and closing holes.

Many organizations have porous security perimeters, especially considering the spike in remote workers. However, ransomware usually finds easier access, entering from a download delivered via a phishing  email, because that point of entry requires the least effort on the part of the attacker.

The ransomware appears as a link or attachment, often from a known source, with an enticement to click it. The attachment or link is an executable file that unleashes the ransomware. 

Inadvertent downloads of malware from an infected website—sometimes executed by clicking, others by simply landing on the site—are also popular attack points for ransomware. (This includes chat and social media messaging.) This stealthy ransomware enters systems through vulnerabilities in various browser plugins, with the delivery mechanism being merely visiting a website.

This ransomware, known as drive-by ransomware, is delivered in the background, often without the user being aware of it. Other entry points include good old-fashioned social engineering and malware carried on USB drives.

More sophisticated ransomware attacks take advantage of backdoors or vulnerabilities in systems and networks. Attackers probe targets to find weaknesses in security systems, such as lapsed patches and updates, gaps in the configuration of security tools, and non-secure remote users.

Ransomware Attack Profiles

Ransomware attacks do not necessarily begin at the time of entry. Often, ransomware works quietly, without users noticing it. It lurks in the background while it prepares for its attack on the point-of-entry system or spreads across the network to other systems before activating and making its presence known.

Sometimes ransomware lies dormant after download or downloads in segments to avoid detection. Regardless of its download timeline, once file lockdown begins, ransomware acts quickly—taking between 18 seconds and 16 minutes to encrypt 1,000 files.

Ransomware has two approaches to encryption: Simpler versions use the encryption functions on Windows and Unix, including macOS and Linux, while more sophisticated ransomware uses custom encryption implementations to bypass security software.

“Off-the-shelf” open-source projects offer packaged ransomware. No matter the type of ransomware attack, once files are encrypted, no one can decrypt them without the attacker’s decryption key.

After files are locked down, the ransomware presents a message (i.e., a ransom note) that tells users:

Ransom notes usually reveal the type of ransomware used for the attack.

Who Does Ransomware Target?

Attackers can be loosely classified into two groups, based on their typical ransomware targets:

1. 1. Big-game hunters
   They target organizations with high-value data or assets, especially those sensitive to downtime, as they are more likely to pay a ransom.
2. 2. Spray and pray attackers
   This approach directs attacks at an acquired list of emails or compromised websites. These smaller, generic ransomware attacks cause significant harm and disruption because of their scale.

Five types of organizations that are prime ransomware targets are:

1. 1. Professional services
   Service-oriented businesses, such as real estate, accounting, law firms, and other small-to-medium-sized businesses have been ransomware targets.
2. 2. Healthcare
   Sensitive information makes hospitals and clinics ransomware targets. Both must have electronic medical records accessible to administer and monitor patient care.
3. 3. Education
   Public school districts, trade schools, colleges, and university systems have all been ransomware targets. All are susceptible because of disruption to classes and the sensitive student data that they store.
4. 4. Manufacturing
   Manufacturers have been targeted for ransomware attacks because many require operations to run factory production lines around the clock. Disruption would create impacts across the supply chain.
5. 5. Infrastructure
   Industrial control systems (ICS) are ransomware targets because of their wide-ranging dependencies. Holding critical infrastructure hostage could put access to energy, water, and other utilities at risk.

How to Prevent Ransomware

The most effective way to prevent ransomware attacks is with a combination of technology and user training. While technology is an excellent way to prevent a ransomware attack, people can undermine even the most sophisticated cybersecurity tools.

Ransomware Removal

Ransomware removal approaches vary depending on the type of attack. Following is an overview of tactics for ransomware removal.

How to Remove Screen Locker Ransomware

Most screen locker ransomware can be taken care of with removal tools. There are a number of free removal tools made available by vendors who support the fight to put a stop to the profitability of ransomware.

How to Remove Encrypting or Crypto Ransomware

With backup
First, neutralize the malware with antivirus or other programs. In the case where backups exist, programs can be executed to scan systems and delete the ransomware malware. Once the ransomware has been removed, files can be restored from backups.

Without backup
If there is not a backup for the infected systems, ransomware recovery is more complicated, and success is not guaranteed. Use a tool to scan the system and identify the specific strain of ransomware.

In some cases, there are remedies to remove the malware. If not, a ransomware decryptor tool can be used. This searches for and applies decrypting keys, which are available for free for certain types of ransomware.

If a decryption key is not found, there are two options:

Ransomware Statistics

How to Respond to Ransomware

Ransomware is a frightening prospect, and time does matter in terms of a response. However, it is important to consider how to respond to ransomware before taking action.

If ransomware is detected, a few pre-remediation steps can help with overall recovery.

Should Organizations Pay the Ransom?

Generally, security experts and law enforcement agencies do not support paying ransom in response to a ransomware attack. The primary reason is that there is no guarantee that the files will be released and the extortion will stop.  According to the FBI, “It does not guarantee you or your organization will get any data back. It also encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.” And, organizations that pay ransom are frequently subjected to future attacks, simply because they demonstrate a willingness to negotiate financially with the attackers.

There are a number of industry and government organizations fighting ransomware. An example of a joint effort is “No More Ransom,” an initiative by the National High Tech Crime Unit of the Netherlands’ police, Europol’s European Cybercrime Centre, Kaspersky, and McAfee. The group’s goal is to stop the payment of ransom by helping retrieve their encrypted data without having to pay ransom after an attack.

Ransomware Examples

DarkSide

REvil (a.k.a. Sodin and Sodinokibi)

Ekans

NetWalker (a.k.a. Mailto)

DoppelPaymer

Maze (previously known as ChaCha)

Ragnar Locker

Clop

Nephilim

Ryuk

Tycoon

PonyFinal

Zeppelin (previously Vega or VegaLocker)

TFlower

MegaCortex

ProLock

Thanos

Petya

Understand Ransomware to Fight It

Ransomware has the attention not just of IT, but of executive teams. It ranks among the top priorities for business and IT leaders. To fight ransomware, organizations must understand:

A proactive approach to ransomware prevention can significantly reduce the risk of attack. However, in the event of an attack, planning is the best front-line defense. Effective response procedures expedite containment of the incident, prevent data loss, and streamline the recovery process.

When assessing security as it relates to ransomware, remember content protection and governance. Machines can be replaced, but content may be difficult or impossible to recover. Securing content and providing granular access if a rollback is required enables business continuity after a ransomware attack.

Egnyte has experts ready to answer your questions. For more than a decade, Egnyte has helped more than 16,000 customers with millions of customers worldwide.

Last Updated: 5th August, 2021

Get started with Egnyte.

Request Demo