Ransomware: How it Works and How to remove it

In the last couple of years, there has been an increase in ransomware attacks resulting in severe crippling of businesses and, in some cases, the collapse of businesses.

Picture this: About 37% of small companies that were hit by ransomware had fewer than 100 employees.

Ransomware attacks are designed such that they can lay dormant on your system/device until the device is at its most vulnerable and only then executes an attack.

Let’s learn a bit more about them and what are the causes of ransomware infection.

What Is Ransomware and Causes of Ransomware Infection?

In simple words, ransomware is malware that encrypts the victim’s information and then holds that information at ransom. When hackers inject malware code into a device, the data on the device gets encrypted and deny access to the original owner of the data. To gain access back and decrypt the data, the hackers demand ransom and thus the word ransomware.

What are the causes of Ransomware Infection and Ransomware Statistics

While there are several causes of ransomware infection, the most common and the most effective is a ‘Phishing emails attack,’ at 54%.

Phishing email attacks are among the most common ways hackers install ransomware on your device. There are various types of phishing attacks, like whaling, vishing, and smishing. While they are meant for different devices – the interconnected systems can spread the infection from one device to another.

The other causes of ransomware infections include:

1. Poor user practices/gullibility, at 27%, is the second leading cause of ransomware infection.
2. Lack of cybersecurity training, at 26%, is the third most common cause of ransomware infection.
3. Weak passwords/access management, at 21%, is the fourth most common cause of ransomware infection.
4. Open Remote Desktop Protocol (RDP) access at 20% is another most common cause of ransomware infection.
5. Malicious websites, at 14%, and lost/stolen user credentials, at 10%, are the other top causes of ransomware infection.

Ransomware Attack Examples

Some of the prominent ransomware attack examples include:

1. WannaCry: Packaged as a dropper, a self-contained program that extracts the encryption/decryption application, files containing encryption keys, and the Tor communication program, ‘WannaCry’ is an encrypting ransomware that exploits a vulnerability in the Windows SMB protocol.
2. Cerber: Used by cybercriminals to carry out attacks and spread their foot with the malware developer, Cerber is ransomware-as-a-service (RaaS). It runs silently on your machine while encrypting files and may also try to prevent antivirus and Windows security features from running. Cerber also prevents users from restoring the system, and encryption is completed successfully, it displays a ransom note on the desktop wallpaper.
3. Locky: Released in 2016, Locky can encrypt 160 files at a go. Locky is usually distributed through exploit kits or phishing emails.
4. Cryptolocker: Released in 2017, Cryptolocker has affected more than 500,000 computers. Cryptolocker is usually spread through unprotected downloads or sites that promote file sharing or emails.
5. Ryuk: Cited as one of the most dangerous ransomware attacks dangerous, Ryuk spreads mainly through phishing emails.
6. GrandCrab: GrandCrab was released in 2018 to launch ransomware-based extortion attacks. Interesting is the threat given to the victims about revealing their porn-watching habits. Today, free decryptors are easily available for almost all versions of GrandCrab.
7. Rorschach – The latest addition to the world of ransomware, Rorschach is the fastest encryptor ever seen. It was released in 2023.

Ransomware Distribution Techniques

Ransomware usually gets installed on your device discretely when you click a link or download an attachment with malicious code designed to get secretly installed into a device. There are several ways the bad actors distribute ransomware, including prominent ones.

1. Phishing email: This is the most common way to distribute ransomware. The hackers send emails with links that have malicious code embedded in them. Once the receiver opens the link, the code gets installed into the device.
2. Email attachments: An email from a legit-looking source but with an attachment with malicious code installed is another popular way to distribute ransomware.
3. Social media: Social media has become another popular distribution channel for spreading ransomware. An attractively designed post with a malicious attachment or a link. Once you click, ransomware gets installed in your system.
4. Malvertising: A portmanteau of advertising and malware; Malvertising is when legitimate advertising hides a malicious malware code. 
5. Infected programs: When you install a program from the internet, you may not know whether the program is infected or not.
6. Drive-by infections: These infections happen when you visit an unsafe, suspicious, or fake web page or open or close a pop-up.
7. Traffic Distribution System (TDS): As the name suggests, TDS is a distribution process where users are directed to a malicious site when they click on a legitimate gateway web page. This method is based on
8. Self-propagation: One of the boldest ways to spread ransomware, self-propagation, is the process where the attackers spread the code through networking or infected USB drives.

How ransomware works?

A ransomware attack starts when a malware code in your device encrypts your data. As mentioned earlier, a malicious ransomware code can lay dormant on your device, and you will not know about it till it starts encrypting your data and denying access to the critical data.

And once your device is infected with ransomware, it proceeds in seven stages.

1. Infection: Ransomware is secretly downloaded and installed on your device either through a phishing email or an infected file downloaded from the internet.
2. Execution: The execution starts when ransomware scans and maps the targeted files’ locations. The scanning and mapping of files like locally stored files and mapped and unmapped network and accessible systems.
3. Encryption: Ransomware exchanges a key with the control and command server. This is done by using an encryption key. The key scrambles all the files that were discovered during execution.
4. User notification: Ransomware adds user notifications that are essentially files with instructions to pay for the decryption key. Then those files are used for ransom note display.
5. Cleanup: Once the instruction files are installed successfully, the ransomware usually deletes itself from the infected device.
6. Payment: The instruction to release the payment is flashed on the screen with a link to click. This link takes the victim to a web page where the instructions to make the required payments are mentioned.
7. Decryption: This is one of the trickiest steps. Reason: getting the decryption key is not guaranteed, even after the ransom is paid. The payment is made through a Bitcoin account of the attackers.  

Ransomware Protection

Prevention is always better than cure – the saying is true when it comes to protecting your organization. Here are six ways to protect your organization from ransomware.

1. Endpoint security: Endpoint security is crucial, and antivirus can help prevent most ransomware attacks. The modern evasive and obfuscated ransomware fileless WannaCry is difficult to detect. The result is looking for solutions like next-generation antivirus that can up your endpoint security.   
2. Data backup: Data backup is another crucial step in protecting against a ransomware attack. You can follow the 3-2-1 rule of data backup. The rule is about creating three copies of data backup; the copies are made on two different media, and one backup is stored in a different location.
3. Patching is important: Regular updates of software applications and operating systems will help you prevent a ransomware attack. Developers keep releasing security patches. Install them and keep your OS and applications up to date to avoid a ransomware attack.
4. Application whitelisting and control: Establish device controls that limit the installation of applications on a device that is centrally controlled by a whitelist. Disable the use of vulnerable plugins like Adobe Flash. Web filtering is another way to protect your business; it restricts users from visiting malicious sites.
5. Email Protection: Social engineering attacks are the most common ways for bad actors to attack your organization. And phishing is the most common social engineering attack; employee training goes a long way in ensuring no employee falls for an email attack.
6. Network defenses: Use basic protections like web application firewall (WAF), Intrusion Prevention, Intrusion Detection systems (IPS/IDS), and other forms of network defenses to keep ransomware away from your devices and organization.

 Steps to Ransomware Removal

Detected a ransomware infection in your network? Follow these five steps to mitigate an active ransomware infection:  

1. Isolation: Isolation is the first step toward mitigating an infection. Before isolating, it is essential to identify infected machines. Once the infected devices are identified, the next step is disconnecting them from the network and then locking the shared drives to prevent the infection from spreading.
2. Investigation: This is where you explore the problem and try to find solutions, like whether data backup is available or not for the encrypted data. This is also where you check which ransomware strain has infected your device and whether the decryptors are available or not. Most importantly, check whether paying a ransom is worthwhile or not.
3. Recovery: You will have to restore your data from the backup in case there are no decryptors available. Ransom paying is not recommended in many countries. However, in certain cases, paying the ransom may be a practical option.
4. Reinforcement: In this step, you share the lessons you learned with your team. These sessions will help you understand how your internal systems were infected and will also help you understand your weak areas in terms of security.
5. Evaluation: With this last step, you evaluate what and why did the incident happen? What can you do to prevent any further infections like these? This is also where you evaluate your current security posture and answer some hard-hitting questions like – why your antivirus or firewall protection failed, what other methods were used to protect your data, and what vulnerabilities were exploited to execute a ransomware attack successfully.

The Business Impact of Ransomware

When we talk about the business impact of ransomware, its financial impact is one aspect. So, what are the impacts of ransomware on a business?

There are five ways a ransomware infection sabotages your business.

1. Business downtime is extended. With encrypted data, the business comes to a standstill, and until you find the decryptors, your business is affected. According to Statista, the average downtime from ransomware attacks increased from 15 days in the first quarter of 2020 to 22 days in the third quarter of 2023. Business downtime is when an organization must shut its units down because of a lack of productivity or disturbance in material distribution.
2. Brand reputation suffers. An organization that has suffered a ransomware attack not only suffers financially but also suffers reputational losses. According to insights by Forbes, about 19% of organizations suffered reputational damages due to cybersecurity breaches.
3. Exposure of sensitive data: Organizations usually pay the ransom out of fear of sensitive data exposure. About 80% of ransomware attacks that occurred in 2021’s first half involved the threat of sensitive data leakage in the dark web, as per recent reports by Kroll.
4. Ransom payments’ financial impact: According to the reports by GRC World Forums, ransom payments have increased from $312,000 in 2020 to $570,000 in 2021 — a 518% increase in 2021. While some organizations had got cyber insurance, they realized that the insurance coverage had changed at the time of the breach.
5. Ransomware as a gateway for future attacks: This is the deadliest technique attackers use; after an attack on one of the business units, the attackers attack other units with vulnerabilities. Especially when they realize organizations are ready to pay a heavy ransom to diffuse the attack.

Ace Data’s Data Protection Solutions

Ransomware attacks are on the rise, and they are here to stay. With each attack becoming more sophisticated, it is up to organizations to protect and secure their data. Ace Data, with its comprehensive cybersecurity solutions, protect your data wherever your data resides – in the cloud or hybrid environment or on the premises.

With a vision and mission to empower our clients’ data lifecycle through end-to-end services and robust cloud delivery models and to deliver complete peace of mind to every customer, Ace Data offers data protection solutions like cloud backup solutions, managed backup services, Disaster Recovery-as-a-Service, Archival-as-a-Service, and Backup & Data Assessment.