Ransomware – What is Ransomware?
Ransomware is malware that encrypts files or prevents access to them until the victim pays a ransom. It has been used to extort money from individuals and businesses of all sizes, including schools, hospitals, police departments, and even entire cities. The attackers demand a payment of the victim’s choosing in cryptocurrency in order to decrypt the affected data. Paying the ransom does not guarantee that the data will be decrypted, and many experts advise against paying it.
Ransomware attacks have evolved significantly since the first attacks in 1989, when AIDS Trojans hid file directories on floppy disks and demanded payments to unlock them. Today, attacks often take advantage of compromised credentials or unpatched vulnerabilities. Attackers exploit remote work tools like RDP and malware kits, which probe devices for vulnerabilities, to infiltrate networks. They can also infect systems with physical USB drives, which bypass network defenses.
Typical ransomware variants encrypt all data, but there are other types that don’t do this. Leakware or doxware is one example, which steals sensitive data instead of encrypting it. The hacker threatens to publish the stolen data, if the victim doesn’t pay the ransom in a short timeframe.
To detect ransomware, machine learning models can look for the general pattern of an infection, using suspicious behavior or specific basic processor instruction patterns. Other detection methods are based on changes to the file, for instance by changing its extension. Scaife et al. (2019) used this feature to monitor for a ransomware signature, and Mehnaz et al. (2020) used similarity between a previous version of the file and its encrypted counterpart to identify it.