BotNet News

Ransomware encrypts files and blocks systems, then threatens victims with a demand to pay a ransom. This criminal business model can cost organizations thousands in lost productivity, data loss and brand damage. Payments to attackers encourage further attacks and do not guarantee that stolen data will be returned.

The ransomware threat landscape continues to expand, fueled by the illicit market for ransomware tool kits and anonymous payments. Attackers are able to purchase and deploy malware for relatively low costs, making the threat accessible to parties with varying levels of technical skill.

Attackers typically begin with the low-hanging fruit, such as small and midsize businesses (SMBs) that lack strong security or fully understand the risks of a ransomware attack. Attackers also seek out high-value targets that can be leveraged for double-extortion, including login credentials, customer information and intellectual property.

Once deployed, crypto ransomware identifies and encrypts files, with some malware disabling system restore features and deleting or encrypting backups to increase pressure on victims to pay. Non-encrypting ransomware locks the device screen or floods the device with popups to keep victims from using their systems.

Attackers also leverage the Internet of Things (IoT) to spread ransomware, with connected devices such as printers or video cameras serving as bots that are used to download and launch malware on networks. Attackers may also use social engineering tactics to trick employees into downloading ransomware by sending fake e-mails, links or attachments. Preventing attacks starts with educating staff about common threats and the importance of staying alert to suspicious activity. It is also critical to keep systems and applications updated with the latest software patches and to always back up files to an offline location.