BotNet News

Cyber-actors gain access to your network, systems and data then encrypt it or steal the information. The attackers then demand a ransom to provide you with decryption or guarantee that your stolen data will not be made public or sold. Ransomware attacks are becoming increasingly sophisticated. Examples include the COVID-19-related CovidLock ransomware that encrypts data from Android devices and LockerGoga ransomware that locks victims out of their networks. Another example is Ryuk ransomware, which has been hitting large organisations and critical infrastructure since 2018. The Ryuk attack is different because it is manually deployed from a remote server, uses encryption to block systems and disables Windows System Restore to prevent recovery, and requires a payment of $1 million or more.

A growing trend is human-operated ransomware where actors target identity infrastructure with social engineering, brute force and privilege escalation to gain access to the network. Once in the network, they move laterally across siloed systems and services to evade detection and then deploy ransomware to encrypt or exfiltrate data.

Ransomware attacks can have devastating impacts on businesses, including downtime and lost productivity. A recent report from Coveware indicates that average ransomware attacks last 16.2 days, and cost organizations an estimated $1.1 billion in 2023. These costs are a combination of ransom payments, downtime, recovery and related expenses. The key is to avoid these costly attacks by protecting against ransomware with strong security and reliable backups. When ransomware does hit, quickly disconnect any infected systems and devices from the network. Make sure to power down devices if you are unable to disconnect them, and create a list of all devices infected with suspicious file extensions so that the affected devices can be isolated from the network.