Ransomware

What is ransomware?

Ransomware is a form of malware (malicious software) that aims to lock a system or encrypt files so that the legitimate user can no longer access them. The attacker then demands a ransom to restore access. This can be demanded in the form of cryptocurrencies such as Bitcoin to maintain anonymity. There are different types of ransomware, but the main idea remains the same: block access to critical data until a payment is made.

How does ransomware get onto a system?

Ransomware enters a system in various ways:

• Phishing emails: The most common method. A seemingly legitimate email contains a malicious attachment or a link to an infected website. As soon as the user opens the attachment or clicks on the link, the ransomware is installed.
• Infected websites: Some websites contain drive-by downloads, where malicious software is downloaded in the background when the website is visited.
• Security vulnerabilities: Outdated software or unsecured networks can easily be exploited by attackers to install ransomware.
• External storage devices: USB sticks or external hard disks that were connected to infected systems can spread ransomware if they are connected to other systems.

How can I protect myself against ransomware?

There are several important measures to protect yourself against ransomware:

• Regular backups: This is the most important defense. Make regular backups of your important data on an external storage device that is separate from the network.
• Anti-virus software and firewalls: Use reliable security software and always keep it up to date.
• Patch management: Ensure that all systems and software are regularly updated to close security gaps.
• Employee training: Most attacks are carried out through phishing. Train your employees to make them aware of suspicious emails or links.
• Network segmentation: Separate critical systems from the rest of the network. This prevents ransomware from spreading quickly throughout the network.

What should I do if my computer has been infected by ransomware?

If your computer is infected, you should act immediately:

• Disconnect the system from the network: This will prevent the ransomware from spreading to other devices on the network.
• Do not panic: Don’t turn off the computer immediately or format it. There are sometimes ways to decrypt the ransomware.
• Contact IT security experts: Experts can help you assess the damage and find the best possible recovery route.
• Check backups: If you have made regular backups, you can restore the system from a backup. Make sure that the backup is not infected as well.
• Report the incident to the relevant authorities, especially if it involves a company.

Should I pay the ransom?

It is generally not advisable to pay the ransom. Paying does not guarantee that you will get the data back or that the attacker will remove the encryption. Furthermore, paying supports the criminal activity and you will be marked as a target for future attacks. Security authorities such as the FBI generally advise against it. However, there are situations where companies feel compelled to pay if the data is business-critical and no backups exist. In such cases, the decision should be made carefully and in consultation with security experts.

How can I tell if my system is affected by ransomware?

There are some typical signs that a system has been affected by ransomware:

• Encrypted files: Files suddenly become inaccessible and have unusual extensions (e.g. “.locked”, “.crypted”).
• Ransom note: A ransom note appears on your screen with instructions on how to pay.
• Slow system: Your computer responds more slowly because the ransomware may be working in the background and encrypting files.
• Unusual network activity: If ransomware is controlled by a command-and-control server, there is often unusual network activity as the system communicates with external servers.

What types of ransomware are there?

There are different types of ransomware:

• Crypto-ransomware: This type encrypts files on a computer and demands a ransom to obtain the key for decryption.
• Locker ransomware: This type blocks access to the system without encrypting files. The user is prevented from using the operating system.
• Ransomware-as-a-Service (RaaS): This is a business model in which cybercriminals sell or rent ransomware to others who can then carry out attacks without having to be experts themselves.

How widespread is ransomware?

Ransomware attacks are widespread worldwide and affect both private individuals and companies. According to reports from security experts, ransomware attacks have increased significantly in recent years, particularly due to the spread of ransomware-as-a-service. Critical infrastructures, the healthcare sector and financial companies are particularly affected. Such attacks are often targeted and can cause enormous economic damage.

Can a ransomware attack permanently destroy data?

Yes, in some cases data can be permanently lost. If no backups exist and the decryption key is not obtained (either because the attacker does not give it out or because the ransomware is poorly programmed), the encrypted data may be unrecoverable. It is therefore extremely important to make regular backups and keep them safe.

How can companies prevent ransomware attacks?

Companies can take several measures to prevent ransomware attacks:

• Employee training: Raising employee awareness of phishing and social engineering.
• Data backup: Regular, automated backups on external, separate systems.
• Zero trust security model: Every system and every user is considered potentially insecure until they are proven to be trustworthy.
• Network segmentation: Separate important systems from less important ones to prevent the spread of malware.
• Incident response plan: A well thought-out emergency plan that defines all measures in the event of a cyber attack.

What is the difference between ransomware and other malware?

Ransomware differs from other malware primarily in its specific intention to block access to data or systems and then demand a ransom. Other malware such as viruses, worms or Trojans can have different goals, such as spying on data, creating botnets or simply destroying data. The main difference lies in the monetary incentive: ransomware attacks aim to extort money directly from the victims.

Who is behind ransomware attacks?

Organized criminals who have joined together in groups or networks are often behind ransomware attacks. These groups often operate from countries with weaker law enforcement in relation to cybercrime. Well-known examples are REvil, DarkSide or Conti, groups that specialize in large-scale ransomware attacks. Some of these groups are also associated with state actors, which means that ransomware attacks could sometimes be supported by governments.

How long does it take to recover from a ransomware attack?

Recovery from a ransomware attack can take days to weeks, depending on the severity of the attack, the size of the organization and the availability of backups. If no backups are available and you have to rely on decryption by the attacker, the process can take even longer or even be impossible. However, organizations with an effective incident response plan and solid backups can be back up and running within a few days.

Zurück zur Übersicht des Glossars