Ransomware – A Growing Threat to Businesses
Ransomware is malware that encrypts data or blocks access to devices and systems until a demand for payment is met. When a business suffers a ransomware attack, it can be difficult and expensive to recover. Cyber insurance policies may cover paying a ransom, but experts warn that doing so only enriches criminals and encourages more attacks.
Ransom attacks are increasingly complex and sophisticated, with many different variants and delivery methods. Ransomware is now a profitable tactic for criminals and a growing threat to businesses. After a lull in 2022 due to Russian-Ukrainian tensions, hackers are ramping up again this year.
The emergence of smaller criminal “affiliates” and advanced online services are making it easier and cheaper for attackers to mount a ransomware attack. For example, phishing emails are now more effective than ever and can be customized to target specific people or organizations. In addition, online marketplaces now offer hacking tools and credentials for sale. One recently shut down website, Genesis Market, offered stolen credentials for as little as $1 each.
Using these tools, attackers can infect individual computers or entire networks. Once a machine is infected, the malware spreads to other machines by exploiting vulnerabilities or using fileless malware techniques to hide in memory and on mapped network drives.
Once an attack is detected, businesses should have the ability to quarantine a device or system to limit its impact and to identify the source. They should also have the capability to quickly recover from a ransomware attack by leveraging backups or other alternative solutions. Finally, they should have rapid threat detection and response capabilities that automatically isolate atypical behavior on endpoints and block C&C server connections to prevent lateral movement.