What is ransomware (ransomware): It is a malware that infiltrates a computer system and encrypts files or even the entire system.
Ransomware has emerged as one of the most dangerous types of cyber attacks in recent years. Ransomware is a type of malicious software (malware) that encrypts all the data of a computer system, preventing access. This encryption process can only be decrypted with a private key in the attacker's possession, and to obtain this key, attackers usually demand money. Hence, the name ransomware.
Ransomware poses a major threat to both individual users and companies. Attackers demand money under the threat of encryption or deletion of critical data and usually have no intention of decrypting or returning the data until payment is made. In addition, many ransomware attacks also cause huge financial losses and reputational damage to users or companies.
Ransomware attacks are usually carried out with infectious files from internet sources such as spam email or a malicious website. Attackers aim to spread the ransomware by getting users to install the malware using misleading emails, social engineering or misleading websites.
Ransomware History
Ransomware attacks were first carried out in 1989 by a virus called the AIDS computer program. This virus posed as a virtual disk drive, presented users with fake information about AIDS, and encrypted files on users' computers and decrypted them for money.
However, today's modern ransomware attacks largely began with a virus called GPCode, which emerged in 2005. GPCode was the first ransomware virus to encrypt files using the AES algorithm.
In recent years, ransomware attacks have shown an increasing trend. In particular, the WannaCry attack in 2017 was a major attack that affected many organizations around the world. WannaCry exploited a vulnerability stemming from an NSA leak, demanding $300 in Bitcoin in exchange for users to decrypt their files.
In 2020, cyberattacks increased during the COVID-19 pandemic, with healthcare organizations being particularly targeted. For example, the Düsseldorf University Hospital in Germany was forced to temporarily close its emergency services due to a ransomware attack in September 2020.
How does Ransomware Work?
Once placed on the system, Ransomware uses strong encryption algorithms to encrypt the system or files. It then shows the user a message demanding a ransom. This message states that payment is required to decrypt the files.
Usually, the payment is made through cryptocurrencies, and the attackers usually give a certain amount of time for the solution. In the absence of payment, the attackers usually permanently delete the files or take other malicious actions that reduce your chances of decryption.
Let's examine an example of Ransomware written in Python.
Full code:
Ransomware attack techniques
- Phishing emails: Attackers send fake emails to victims' email accounts, which contain files or links to malware. These emails often contain fake information that looks official and is intended to scam victims.
- Malicious websites: Attackers can redirect victims to malicious websites where they can download malware. These websites often look like official websites and use social engineering techniques to attract victims' attention.
- Weak firewalls: If victims have networks or devices that are weak in terms of firewalls or other protection methods, it can make it easier for attackers to plant ransomware on the system.
- Accidental downloads: Victims can infect their systems by accidentally downloading files containing malware. This can often happen when downloading files from unsafe sources or installing fake software updates.
- RDP attacks: Attackers can infiltrate and install ransomware on target systems via remote desktop protocol (RDP). These attacks are usually carried out over RDP connections with weak passwords or without authentication.
Most Popular Ransomware Groups
- REvil/Sodinokibi: REvil is a ransomware gang that emerged in 2019. They are also known as Sodinokibi. This gang targets large companies and organizations as well as small businesses and individual users. Recently, REvil carried out a massive attack by exploiting a vulnerability in a software called Kaseya.
- DarkSide: DarkSide is a ransomware gang that emerged in 2020. This gang has been responsible for major attacks such as the Colonial Pipeline attack. DarkSide mostly targets large companies and their attacks usually result in a ransom demand.
- Ryuk: Ryuk is a ransomware gang that emerged in 2018. This gang has targeted many companies around the world. Ryuk chooses its targets carefully and often demands large payments.
- Maze: Maze is a ransomware gang that emerged in 2019. This gang is known for its threat to expose stolen data. Attackers encrypt their targets' data and then steal a copy of it. Then, when the ransom demand is not met, they threaten to expose the stolen data.
- Conti Conti is a ransomware gang that emerged in 2020. This gang has targeted many large companies and often demands high ransoms.
Most Popular Ransomware
- WannaCry: WannaCry is a ransomware that emerged in 2017. WannaCry spread by exploiting a vulnerability in Microsoft Windows operating systems and affected millions of devices worldwide.
- Petya/NotPetya: Petya is a ransomware that emerged in 2016. It targeted many companies around the world. It is also known under the name NotPetya and became more deadly with an update released in 2017.
- Locky: Locky is a ransomware that emerged in 2016. It spread through macros inserted into Microsoft Office documents. Locky affected many organizations and individual users around the world.
- CryptoLocker: CryptoLocker is a ransomware that emerged in 2013. It spread in email attachments and on misleading websites. CryptoLocker affected the personal and business data of many people.
- REvil/Sodinokibi: REvil/Sodinokibi is popular as both a ransomware gang and software. It emerged in 2019 and has targeted many large companies.
How to Protect Yourself from a Ransomware Attack?
- Update your security software: Keep track of updates to your security software, virus identification databases and update your software regularly.
- Use strong passwords: Protect your accounts by using complex and strong passwords. Change your passwords regularly and do not use the same password for different accounts.
- Be careful about opening email attachments: Be careful before opening email attachments from unknown or suspicious sources. Always scan email attachments for viruses before opening them.
- Make backups: Back up your data regularly and keep backups in a safe place. This will allow you to restore your data without losing it if it is encrypted.
- Update: Keep your operating system, browsers and other software up-to-date. Updates make your system more secure by closing vulnerabilities that cybercriminals can exploit.
- Be vigilant: When browsing the internet, avoid clicking on unknown websites or suspicious content. Also, use a secure connection (https) for online transactions.
- Educate: Provide regular cybersecurity training to employees in your business. These trainings increase employees' awareness of ransomware and other cyberattacks, making them more prepared for potential attacks.
What to Do During a Ransomware Attack?
- Stop the attack immediately: If you notice signs of ransomware on your computer, immediately shut down your computer and disconnect from the network. This can prevent the spread of ransomware and further damage to your data.
- Get help from experts: To deal with a ransomware attack, it is recommended that you seek help from a specialized security company. These companies can use the best methods to recover your data.
- Back up your data: Making regular backups before a ransomware attack can prevent you from losing your data. You can restore your data using your backup files if you have them.
- Don't pay ransom: Paying a ransom can encourage cybercriminals to continue ransomware attacks and does not guarantee the return of your data. You should not even consider the idea of paying a ransom.
- Take security measures: To avoid ransomware attacks, you should keep your computer up-to-date by using a strong antivirus software. You should also use strong passwords, avoid clicking on spam emails and only download software from trusted sources.
CONCLUSION
Ransomware poses a major threat not only to individual users, but also to companies. It is therefore important for all users and businesses to use up-to-date antivirus software and make regular backups to protect against malware infections. Users should also be wary of misleading emails, websites and other internet sources.
