BotNet News

Ransomware is malware that encrypts data on an endpoint system, leaving it inaccessible. The attacker demands a ransom to unlock the files, which can range from a few hundred dollars to millions. Once paid, the attackers encrypt the data again and delete it. Cybercriminal gangs have turned ransomware into a lucrative criminal business model.

Once ransomware encrypts your files, you can’t retrieve them with security software or restore from backups. Ransomware gangs often publish the list of victims on publicly available websites as an additional extortion method to motivate organizations to pay.

Threat actors distribute ransomware by using exploit kits to inject it into web applications and web pages that users visit, or through malvertising—legitimate digital ads that hackers have compromised. Some hackers also use other malware that they have developed to steal passwords, banking credentials and personal information to spread ransomware to unwitting victims.

The ransomware gangs that distribute these attacks are constantly evolving their techniques to get past anti-virus and other cybersecurity solutions, including the latest patches and updates for operating systems and apps. To protect against ransomware, educate employees about social engineering and how to avoid suspicious emails and websites.

To detect ransomware on your network, monitor communication between a host and a command and control (C&C) server and look for anomalous behavior. Network traffic analysis identifies patterns of behavior for certain ransomware families, such as the number of packets exchanged and their average size. Machine learning models can learn and identify these characteristics to distinguish them from normal network communication.