28TH JUN 2024
As you tirelessly browse through useless Instagram reels, an email notification pops up on your computer screen regarding a matter of dire urgency - a warning about changing your bank account credentials due to a breach they faced.
As panic enters your system, you rapidly click on the attachment provided with the email. The screen goes black. You’re greeted with a message announcing that all your data is now being held hostage.
Scared, you try to click on a document on your computer, only to see a password prompt locking access to your file. Clicking on other important files serves up the same prompt.
Unfortunately, you have fallen victim to a malicious cyber attack known as ransomware.
Ransomware is malware designed to hold your data hostage via encryption until a certain sum of money is paid by the individual or group it belongs to. In some cases, failure to pay can wipe your data completely.
Attackers also use crypto-ransomware - a encryption key is provided to the victim to regain access to their data in exchange for a ransom amount.
On rarer occasions, a screen-locking software can disable a victim’s entire device until the amount is paid.
Multiple types of ransomware are used to obtain information:
Doxware is when attackers threaten to expose victims’ personal data.
Destructive ransomware or wipers, is when data destruction is threatened. In some cases even if the victim pays the ransom, the data is destroyed. These cases are rare, however, as they are generally used by hacktivists rather than ordinary cybercriminals that are motivated solely by monetary gain.
Mobile ransomware is any ransomware that targets mobile devices.
Scareware is ransomware that scares victims into payment, whether through the method of coercing the user to download the malware or the actual method in which the victim’s device is locked or their data encrypted.
The process of infecting a target with ransomware usually occurs in five stages:
In the first stage, an attack vector is used to gain access to data.
Vectors include social engineering methods such as phishing where fraudulent emails, text messages or phone calls are used to lure users.
Attackers can also take advantage of vulnerabilities and weak systems as well as use credential theft and drive-by downloads (compromised websites) in order to seize users’ data.
In the second stage, cybercriminals may use malware such as remote access tools (RAT) to secure their access to the data.
Stage three includes the hacker understanding the system they have gained access to. That way they can expand their efforts by gaining control of other interconnected systems.
Step four of a ransomware attack includes data collection and exportation. Cybercriminals will do this by downloading a copy of the victim’s valuable information, may it be passwords, credentials or intellectual property - nothing is safe from the hacker anymore.
In the last and final stage, files are either identified and encrypted or the user’s device is locked.
Alternatively, the device may be flooded with pop-ups to the point that the device is rendered unusable.
The dreaded ransom note is then sent out via a pop-up window or .txt file.
A particularly dangerous case of ransomware happened in April 2024. A ransomware gang ‘BlackSuit’ launched an attack on a healthcare company Octapharma Plasma.
In the attack, sensitive data belonging to donors - including their addresses and social security numbers, financial data, laboratory data and business data alike was stolen by the cybercriminals. Although little is known about BlackSuit’s ransom demands or negotiations, Octapharma began reopening some of its 180 centers after nearly a week, indicating a possible agreement between the two parties.
The Fulton County ransomware incident occurred in January 2024. Fulton County’s government services were temporarily non-operational as a cybercrime group LockBit launched a ransomware attack against them, threatening to dump highly sensitive information online.
LockBit also claimed to have former President Donald Trump’s criminal case record for attempting to tamper with the 2020 elections.
Jeff Disantis, a spokesperson for the District Attorney’s Office, confirmed the hacking attempt. He said:
LockBit claimed that the information they had could potentially affect upcoming elections but eventually removed the county from their leak site, claiming that a ransom had been paid. The claim of ransom being paid was firmly denied by Fulton County chairman Robb Pitts, who claimed they did not know why LockBit removed the data.
Following the removal of ransomware, systems were slowly restored by Fulton County.
Cryptolocker - A ransomware variant that has been estimated to have extorted a whopping $3 million.
Wannacry - Responsible for around $4 billion in damages after infecting an estimated 300,000 devices.
Ryuk - Targeted larger-scale businesses and companies and demanded an average of $1 million per attack. FBI estimates it extorted $61 million from 2018-2019.
Ransom payments differ from case to case. The Kaseya ransomware for instance demanded a startling $70 million for 1,500 businesses.
There has been a drastic fall recently in the proportion of victims that give in to the ransom demands. This could be credited towards the recent increase in awareness and preparedness when it comes to dealing with cybercrime such as data backups and even threat prevention and detection technology.
Although paying ransoms to cybercriminals is heavily discouraged by US federal law enforcement, in some cases, it can be illegal.
The US Office of Foreign Assets Control (OFAC) has stated that penalties such as criminal charges could be faced by individuals who pay a ransom to attackers from countries under US economic sanctions.
Although the threat of ransomware is terrifying and dangerous for most, there are ways in which individuals can protect themselves from this digital crime.
Here’s what you need to do:
Sensitive or personal data should always be backed up,
Access control policies should be rolled out to limit damage as well as access to sensitive files.
Multifactor authentication methods should be implemented
Formal incident response plans should be drawn up by security and IT teams to obstruct breaches early on.
As technology rapidly becomes more sophisticated, netizens face a constant struggle between the propagation and prevention of digital crimes that threaten to ruin our lives. Taking measures to educate yourself and spreading awareness about best cybersecurity practices can help keep you and the people around you safe from falling for online traps such as ransomware.
