What is Ransomware and How Does it Affect SMBs?
Ransomware is malware that encrypts files, rendering them unusable until a ransom payment is made. Cybercriminals typically demand payment in cryptocurrencies like BitCoin to decrypt the data, and it can be difficult or impossible for victims to recover their original files without paying the ransom.
The most well-known example of ransomware is CryptoLocker, which emerged in 2007, and the WannaCry attack that caused widespread disruption in 2017; however, there are many more examples of this type of malware. Cyber criminals typically distribute ransomware using phishing attacks and other social engineering methods to gain access to a victim’s device or network. Once the victim clicks a malicious link, ransomware lands on the device and begins searching for and encrypting valuable files. Depending on the variant, the malware may also search for and delete backup and shadow copies of those files.
Once the malicious software encrypts files, it leaves behind instructions on how to pay a ransom for a key to unlock the data. While the cybercriminals often ask for payments in Bitcoin, some attackers accept other cryptocurrencies or even prepaid cards like PaySafeCard, MoneyPak or Ukash. Many of the larger ransomware gangs have evolved into organized crime organizations, offering ransomware distribution through digital marketplaces on the Dark Web and recruiting affiliates through online forums.
Businesses of all sizes are targets for ransomware, crippling the organization if no backups are available. Often, these attackers target small and midsize businesses (SMBs) because they lack the resources to hire dedicated cybersecurity professionals. Attacks on these organizations can be particularly devastating, as SMBs rely on their systems to manage critical data and communicate with customers.