What Is Ransomware? The Danger of This Type of Malware

Ransomware is a type of malicious software that extorts users by breaking into their computers and manipulating their data. In recent years, ransomware has been the biggest threat to many organizations and businesses. IT system administrators are constantly looking for ways to stop this kind of malware from getting in. Next, join Mona Media in going through the basics to answer the question “What is ransomware?” in this article.

Ransomware definition

Ransomware is malicious software that encrypts data, locking users out of their devices. To get access back to their data or device, users have to pay hacker a set amount of money known as a ransom. Ransomware is also called extortion malware or extortion software.

The ransom is usually around $250 – $500 for a personal computer. For businesses and organizations it can reach thousands of dollars. Hackers mostly ask victims to pay the ransom by bitcoin and bank transfer. In recent years, ransomware distributors have preferred to take ransom payments in bitcoin because it is highly private and very hard to trace.

How ransomware works

When ransomware infects a computer, it encrypts data files and gives them strange extensions. For example, *.Doc > *.docm; *.xls > *.cerber. These extensions differ from time to time, which makes them laborious to identify. An infected computer will not display any message from the hacker. When one computer is infected with ransomware, the other machines in the system are very likely to end up in the same state.

Origins of ransomware

Early stage

Ransomware was first detected in Russia in 2005–2006. In its earliest form it was a variant called TROJan CRYZIP.A. Data analysts found that when a variant of the Trojan type got into a machine, its data was encrypted immediately. To get access back, a password was needed. To receive the password, users were asked to pay $300.

Growth stage

Over time, ransomware widened its reach. It began to affect text files and spreadsheets with extensions such as *.xl, *.doc, *.exe, and more. In 2011, media around the world reported another kind of ransomware called SMS Ransomware. Besides the usual behavior, SMS Ransomware also sent messages telling users to contact the hacker at a given phone number until they transferred the money as demanded. Another version also made waves by attacking the MBR of server operating systems. In other words, it left the operating system unable to function.

Spread stage

Ransomware first appeared in Russia, but within a short time it had spread across Europe. It peaked in 2012, when a large number of ransomware attacks were recorded in Europe as well as Canada and the US. Today, ransomware can still show up anywhere in the world.

Types of ransomware

Locker Ransomware

Locker ransomware, also called non-encrypting ransomware, does not encrypt the victim's files. Instead, it locks users out of their devices. Victims cannot do anything on the computer except turn the screen on and off. The screen shows detailed instructions for paying the ransom so the owner can get back into the device and use it again.

Ransomware Crypto

Crypto ransomware, also called encrypting ransomware, is the most common kind of extortion software. It typically encrypts users' data such as files and folders. After getting into a computer, it quietly connects to the attacker's server and generates two keys. A public key is used to encrypt your files, while a private key, held on the hacker's server, is used to decrypt them. The affected files get their extensions changed to certain formats and show an error when the user tries to open them.

After encrypting the files, crypto ransomware displays a message on your computer. It tells you that you have been attacked and must pay a ransom if you want your password back. In some cases the attacker adds pressure by demanding payment within a set deadline. After the deadline, the decryption key is destroyed and the ransom goes up.

See also: Server administration: how is it done?

The most dangerous strains

Countless ransomware strains of varying severity have been recorded. Among the best known, the three most dangerous are CryptoLocker, WannaCry and Petya. Others such as TeslaCrypt and Locky can also do considerable damage to your computer.

Ransomware vs. ordinary malware

The differences

Ransomware and ordinary malware have one thing in common: they do everything they can to hide and damage files quietly. The big difference is ransomware's extremely complex encryption. That encryption lets the malware dig deep into users' data files. It gets past the barriers that many antivirus programs put up. However, today's antivirus software is also gradually getting more sensitive to ransomware.

How ransomware hides

Hackers now equip ransomware with many evasion techniques. The most common are the following:

Detection

Detection is a reconnaissance method. Malware often probes its environment to check whether it is running in a virtualized one, so it can avoid being spotted by researchers. The trade-off is that this method prevents it from producing any updated security signature.

Timing

Nothing is perfect, and antivirus software is no exception. Even though it keeps raising alerts, it struggles to protect every part of a system, especially against a dangerous threat like ransomware. Ransomware gets in while the device is turning on or off, when the antivirus has not yet had time to start.

Communication

Once it gets into data files, ransomware immediately contacts its command server for instructions. Antivirus software can use this behavior to detect specific an IP address and block those communications.

False Operation

When a computer is infected with ransomware, a fake program may pop up. Users without much experience may mistake it for a normal operating system program. They follow its instructions and the virus spreads faster.

How to prevent ransomware

To prevent ransomware, you can apply a few measures: do not use free Wi-Fi or networks of unknown origin, and avoid clicking on strange links or emails from unknown addresses. Also back up your data regularly, install antivirus software and keep it updated. Change the default passwords on all access points, put multiple barriers on your own networks, and have a recovery plan in case you lose data.

What to do if you are infected with ransomware

• Step 1: Isolate and segment the network and systems: immediately cut off the infected part from the system, shut those systems down and unplug the network to stop the virus from spreading.
• Step 2: Identify and remove the ransomware: try to find the malicious parts that have infected the computer, identify the strain and plan how to remove it.
• Step 3: Wipe the infected machine and restore from backups: in case any ransomware remains. Delete all infected data and restore everything from scratch using your backups.
• Step 4: Analyze and monitor the system: once the ransomware is completely removed, take time to analyze how the infection happened. That helps you protect your data better.

Notable ransomware attacks

WannaCry

At the top of the list is WannaCry, the malware that caused panic worldwide in 2017. WannaCry exploited a vulnerability in Microsoft's operating system and spread to other computers on the same network. It infected more than 260,000 computers in 117 countries (including Vietnam), causing damage in the hundreds of millions of USD. After the incident was handled, the UK and US governments and Microsoft accused North Korea of being behind the attacks.

GandCrab

In 2018, malware called GandCrab spread through ads that led users to pages hosting the malware, or through emails. To remove it, users were told to install a browser called Thor and pay in cryptocurrency such as Bitcoin, at about 3200 – $1400 depending on the level of infection.

Bad Rabbit

In 2017, several countries in Eastern Europe recorded the appearance of malware called Bad Rabbit. Within a short time it caused serious disruption to many businesses and governments. Through a fake Adobe Flash update request, Bad Rabbit got into servers by luring users into downloading a compromised Adobe Flash file.

NotPetya

Like WannaCry, NotPetya exploited a Microsoft vulnerability to get into users' data. What makes this ransomware more dangerous is that it can spread by itself from one computer to another, and from one set of data to another. On top of that, it destroys the victim's hard drive whether or not the ransom is paid.

This article has given a general overview of what ransomware is and the great harm it causes. We hope that with this knowledge you can take preventive action and know how to respond if you run into these problems.

See more:

• Website security technology and what to optimize
• What kind of attack is a malware attack?
• Cyber security and the challenges it faces