BotNet News

Ransomware is malware that encrypts data, locking devices and making them unusable. Cyber criminals demand a fee (often in cryptocurrency or other untraceable methods) in exchange for decrypting the files. The attack typically starts with a phishing email with malicious attachment or a link to a fake website. Once the malware has been downloaded, it starts identifying targets and searching for files to encrypt. Some variants will also delete backup or shadow copies of targeted files to make recovery harder.

Once ransomware has gained access to the victim’s computer, it will usually display a message on screen requesting a payment in exchange for the key to unlock the files. The message will often claim that the victim’s computer has been used to store child pornography or other illegal content, and threaten to reveal this to regulators unless a ransom is paid.

Many organisations are reluctant to pay the ransom, as paying does not guarantee data recovery and may encourage future attacks. Restoring from backups takes time and impedes productivity, while law enforcement investigations require research that delays recovery even further.

Keeping devices updated with the latest software is one of the most effective ways to reduce ransomware risk. This will include updates that block known ransomware strains, as well as tools like FortiToken that help to prevent the spread of malware and provide two-factor authentication. Additionally, leaving computers on at all times will prevent the loss of volatile memory due to encryption – which can render an unusable machine.