Ransomware.

What is ransomware?

Ransomware is a type of malware that makes files and systems unusable until a ransom is paid. Malware means software built to cause harm. CISA describes ransomware as an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Encryption means scrambling data so it can only be read with the right key. Criminals then demand a ransom in exchange for decryption, which means turning the data back into a readable form.

How does a ransomware attack work?

MITRE describes the encryption step as “data encrypted for impact”. Attackers encrypt data on local and remote drives and withhold the decryption key. MITRE says the goal can be to get money from the victim in exchange for a decryption key, which is what ransomware does. MITRE adds that the targets can include everyday files such as documents, PDFs, images and videos. They can also include system files and disk partitions. In cloud environments, attackers can encrypt storage objects in a compromised account.

MITRE also notes that some malware has worm-like abilities. A worm is malware that spreads across a network on its own. In this case it can use methods such as credential dumping, which means taking stored logins, and SMB, which is a Windows file sharing service.

How do attackers get in?

CISA’s ransomware guide lists several common ways in.

• Internet-facing vulnerabilities and misconfigurations.
• Compromised credentials.
• Phishing, which means fake messages that trick people into clicking or sharing details.
• Precursor malware infections, where earlier malware prepares the way.
• Social engineering, which means manipulating people rather than systems.
• Compromised third-party or managed service providers.

What is a second threat besides encryption?

Some attackers add a second threat. CISA says criminals threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid. Exfiltrated means copied out of the network without permission. This is often called double extortion, because the victim faces two pressures at once.

What does a simple example look like?

This is an illustration only. An attacker uses a stolen password to get in, copies files, encrypts servers, and demands payment while threatening to leak the files.

How can you reduce the risk?

CISA’s guide recommends several defenses.

• Keep offline, encrypted backups of critical data, and regularly test that they work.
• Use phishing-resistant multi-factor authentication for all services, particularly email, VPNs and accounts that reach critical systems.
• Regularly patch and update software and operating systems.
• Use network segmentation and a zero trust approach.
• Restrict PowerShell, a Windows tool for running commands, to specific users case by case.
• Harden domain controllers, the servers that manage logins.

CISA also gives a response checklist. Its first steps include isolating impacted systems and reporting the incident to CISA, the FBI or local law enforcement.

Is ransomware the same as other malware?

No. Malware is the wide group of harmful software. Ransomware is one kind of malware, and its feature is the demand for payment. A phishing email or compromised credentials can be the first way in, as CISA lists.

What should you do first after an attack?

CISA’s response checklist starts with detection and analysis, such as isolating impacted systems and examining logs. It then moves to reporting and notification, and to containment and eradication.

Which terms are related?

Related terms include multi-factor authentication, persistence and initial access broker.

Brandefense Ransomware Intelligence monitors ransomware groups and leaked data.

Examples on our incident pages include the 2021 attacks on Transnet and on South Africa’s Department of Justice, and the 2022 AIIMS Delhi attack, which some reports called ransomware.