What is Ransomware?

Ransomware is malware that a user or organization uses to deny access to files on their computer.

They encrypt these files and demand a ransom payment for the decryption key.

These malware place organizations in a position where paying the ransom is the easiest and cheapest way to regain access to their files.

In short, it is a type of malware attack in which the attacker locks and encrypts the victim’s data, important files and then demands a payment to unlock and decrypt the data.

Ransomware Attack Examples

There are thousands of strains of ransomware malware.

Below we list some examples of malware that have had a global impact and caused extensive damage.

1. Ryuk

Ryuk is an example of a very targeted ransomware variant.

It infects machines via phishing emails or by using compromised user credentials to log into enterprise systems using the Remote Desktop Protocol (RDP).

2. Cryptolocker

Cryptolocker was released in 2017, and affected over 500,000 computers.

It typically infects computers through email, file sharing sites, and unprotected downloads.

In addition, it not only encrypts files on the local machine, but can also scan mapped network drives and encrypt files that allow them to be written.

3. Maze

The Maze ransomware is famous for being the first ransomware variant to combine file encryption and data theft.

When targets started refusing to pay ransoms, Maze began collecting sensitive data from victims’ computers before encrypting it.

4. WannaCry

WannaCry is an encrypting ransomware that exploits a vulnerability in the Windows SMB protocol, and has a self-propagation mechanism that lets it infect other machines.

Above all, it is not relatively easy to detect and remove.

5. Scareware

Scareware, as it turns out, is not that scary. It includes rogue security software and tech support scams.

You will receive a pop-up message claiming that you have found malware and the only way to get rid of it is to pay.

To clarify, if you do nothing, pop-ups will continue to explode, but your files are basically safe.

How Does Ransomware Work?

In order to be successful, it needs to gain access to a target system, encrypt the files there, and demand a ransom from the victim.

Ransomware attack stages:

1. Infection

Ransomware operators tend to prefer a few specific infection vectors.

One of these is phishing emails. If the email recipient falls for the phish, then the ransomware is downloaded and executed on their computer.

In short, it is covertly downloaded and installed on the device.

2. Execution

It scans and maps locations for targeted file types. Some ransomware attacks also delete or encrypt any backup files and folders.

3. Data Encryption

After ransomware has gained access to a system, it can begin encrypting its files.

Most ransomware variants are cautious in their selection of files to encrypt to ensure system stability.

4. User Notification

It adds a file informing of the pay-for-decryption process. And then, used it to display a ransom note to the user.

5. Cleanup

Ransomware usually terminates and deletes itself, leaving only the payment instruction files.

6. Ransom Demand

Typically, they demand a set amount of cryptocurrency in exchange for access to the victim’s files.

If the ransom is paid, the ransomware operator will either provide a copy of the private key used to protect the symmetric encryption key or a copy of the symmetric encryption key itself.