What is Ransomware?
Ransomware is malware that secretly infects a device, then encrypts files and demands payment to unlock the data. It is often distributed through phishing emails, which contain malicious attachments that infect the victim when they open them. It can also be spread through drive-by downloads, in which users visit a website that is infected, unknowingly downloading the ransomware and installing it on their devices.
The attackers typically display a notification that the data has been encrypted and demand a specified sum of money in a digital currency, such as Bitcoin, to regain access to the data. The hackers can threaten to publish the data publicly if payment is not made within a given time period. If the ransom is not paid, the attackers can continue to attack the same device or spread the infection to others using the same method.
Often, the attackers target small- and midsize businesses (SMBs) because they don’t have strong cybersecurity measures in place. However, it’s also common for them to target government agencies because they are easy targets and can disrupt the lives of a large number of people.
Ransomware attacks are becoming more frequent and costly, according to online virus aggregator VirusTotal. The increase is partly due to improved methods of detecting ransomware, but it has been driven by organized gangs that are making a profit. They are advertising services on the dark web, hiring experts to steal credentials and find vulnerabilities in networks, and improving the malware to avoid detection by antivirus software.