How does a Ransomware attack work
Cybersecurity
What is Ransomware?
Ransomware is a type of malware that infects your computer and encrypts all files on it. This means that if you don't pay the ransom, the only way to regain access to your files is to pay more money.
A ransomware attack is likely to happen every 11 seconds in the year 2022. And because many people have been left without access to their files after paying the ransom, this crime has become extremely lucrative for cybercriminals.
Both individuals and companies can be victims of ransomware. If ransomware hits one device in your organization, it can quickly spread to other devices in your network.
Cybercriminals would demand between $500 and $1000 from individuals, and if it’s a business, the ransom demanded can go up to a nine-digit number. Usually, ransoms are demanded in the form of bitcoin, making it difficult to track the payments.
How does a ransomware attack work?
A ransomware attacker might initially seem like a habitual criminal, but with the increase of ransomware as a service, anyone can easily learn to hack your system.
Five reasons why companies fall victim to ransomware attacks:
- When the device is not up to the minute
- When the device doesn’t have updated software
- Delayed or no patching of web browsers or operating systems
- No proper backup or Incident Response Plan in place
- Not immediately responding to attacks
There are three steps that happen in a ransomware attack:
- Intrusion and diffusion:
Using the vulnerabilities available on your network or website, or through social engineering tactics, ransomware attackers will try to gain access to your files. After hunting through your files, the ransomware will find the one containing the most important information and encrypt it.
Intruders will then demand a huge ransom to decrypt your file. Cybercriminals also threaten to publish your sensitive data on the ransomware leak sites to damage your reputation.
The three most common infection vectors through which attackers gain access to your systems are phishing emails, Remote Desktop Protocol, and delayed patching of your systems and applications.
Ransomware can also be targeted to auto-install on your system through websites you or your employees frequently use.
Threats need not always be from external sources; people inside your organisation can also be a reason for a ransomware attack.
- Encryption:
The targeted and encrypted files will be decrypted only with the encryption key. An encryption key will be generated once the ransomware gains access to your system. The key will again be encrypted to generate a symmetric key.
The symmetric key will be available to the victims only when they pay the ransom or their files are gone forever.
- Demanding the ransom:
Once your files are encrypted, the attackers will threaten you to pay the ransom within a set time frame, say 24 to 48 hours.
If you don't pay the hackers, they could delete the key, eliminating your chance of decrypting your files or making your data available to the public. Usually, the victims comply with these demands, and the attack is over.
But hackers are not always true to their words. The keys might or might not work as promised. Paying the amount might lead to future attacks and you might become an appealing target.
Apart from paying the ransom, there are several direct and indirect costs that are involved apart from paying the ransom, like mitigating the attack, dealing with downtime and outages.
51% of victims would never engage in business with organisations that have previously experienced a cyber-attack or data breach.