BotNet News

When ransomware infects a system, it prevents or encrypts access to data. The attacker demands a ransom to return the data or allow access to the system. Ransomware typically infects systems through a compromised URL or an attachment that executes malicious macros to give malware control of the system. Attackers primarily target businesses because they can halt productivity and lose valuable information, potentially costing the company millions.

The first known ransomware attack occurred in 1989, when Harvard-educated biologist Joseph L. Popp sent infected floppy disks to AIDS research participants. Upon insertion, the disks, which appeared to contain medical questionnaires, encrypted the victims’ systems and instructed them to send $189 to a P.O. box in Panama.

In 2012, the ransomware family Reveton re-introduced the world to extortion attacks. This new version of ransomware posed as law enforcement and demanded users pay a fine to avoid arrest or prosecution. Victims were told they had been caught hacking into government systems, downloading illegal files or engaging in child pornography. This social engineering tactic was successful because average users doubted their own innocence and felt pressure to pay the ransom.

The best practice is to avoid ransomware altogether. Never open suspicious-looking attachments and always make sure that you only use legitimate USB sticks and other storage media. You should also use anti-virus software and keep it up to date. Additionally, you should segment your network, so that attackers cannot move laterally through your system to reach critical data or systems. Finally, you should make sure to have backups and secure them from ransomware, as this type of malware will search for backup data and encrypt or delete it. Once you’ve regained access to your systems, it is important to report any incidents to law enforcement immediately. This will help with available decryptors and can help you avoid the costly situation of paying a ransom.