Ransomware – A Growing Threat to Organizations and Consumers
Ransomware is malware that encrypts files on an infected device, then displays a message threatening to delete or expose the encrypted data unless a ransom is paid. This malware is typically distributed via targeted emails and is used to extort money from victims. This cyberattack is a growing threat to organizations and consumers. It can result in financial loss from a ransom payment, lost productivity, and damaged company reputation.
While the first ransomware attacks were on random individuals, attackers realized that companies are easier targets and began targeting businesses, especially larger corporations. Attackers also developed better malware, finding flaws in systems and networks to gain entry, hiring cybersecurity experts on the Dark Web, and improving their tools to bypass detection by anti-malware scanners.
Several ransomware families have emerged and become more prevalent over the past decade. Defray777, Ryuk, and Clop are examples of popular ransomware.
Attackers are not always the authors of ransomware; some rent or lease it through malware-as-a-service (MaaS) business models, allowing customers to authenticate into a dashboard and launch their own campaigns. The authors then reap the rewards, while the customers take on the liability.
Once an organization is infected with ransomware, it’s important to isolate infected systems and disconnect them from networks and file shares. It is also important to investigate and see if there are any backups of encrypted data. Identifying what strain of ransomware you’re dealing with can help you find decryptors to unlock your data. In addition, it is recommended to report the ransomware to law enforcement. This can help you get a decryptor if it is available, and can also help you determine who launched the attack.