What is Ransomware? A Complete Guide
What is Ransomware? A Complete Guide Know the in’s and out’s of ransomware and how to prevent it from affecting your organisation. Get a Quote Download Datasheet Ransomware What is Ransomware? A Complete Guide Ransomware is a malicious attempt to collect ransom by blackmailing you to publish or harm your data or computer system. The hacker usually enters and controls your computer system through encryption and email phishing. They notoriously demand ransom money with a deadline and threaten to misuse your computer page or data if you fail to comply. By Cian Fitzpatrick | April 13, 2023 Cybercriminals find a way to enter your computer via infected email attachments or web links. They take control over the whole computer through the attachment you download or the link you click. Anyone can fall into these traps, and it is essential to be aware of these threats to stop them. Ransomware is not just another cybersecurity issue nowadays. Many industries use digital solutions to store valuable data and information in their digital databases. And falling victim to ransomware makes victims more vulnerable to paying higher fees because of the availability of such invaluable information to scammers. Criminals with access to such crucial data, devices, or systems can also threaten to publicly disclose or sell the data on the dark web, thereby powering the attacker while bargaining for ransom. Ransomware is becoming increasingly devastating and destructive if we look back at the past half-decade. Although financial motives have consistently driven ransomware perpetrators, victims’ potential refusal to pay the ransom poses even greater risks, as hackers may misuse or make the data and information available to the public. History of Ransomware 1980’s The first ransomware attempt dates back to the late 1980s. A Harvard graduate biologist, Joseph L. Popp, sends out over 20,000 floppy discs to the attendees of the World Health Organisation’s AIDS conference. He initially says that the disc is a survey done for AIDS minimization and convinces the event guests that it only carries relevant questionnaires. Therefore, Popp gets access to the computer systems and blocks them, asking for $189 to return them to normalcy. Unfortunately, his extortion plans did not go as planned, as the malware attempt was deciphered soon before most victims sent money to his Panama hideaway. This was the first ever known attempt at extortion through computer hacking, making Popp the “father of ransomware.” 2000’s Ransomware would go silent for the next few decades but ultimately return in the early 2000s. It was a booming era of the internet, and email became popular, becoming part of everybody’s lifestyle. And so, with the development of internet benefits, ill-intentioned misusing by the general public was also on the rise. The scams were no longer on floppy discs. Scammers were using email phishing and website links as bait to lure in potential victims. 2010’s In 2017, the WannaCry ransomware attack struck on a massive global scale, impacting hundreds of thousands of systems across more than 150 countries and various industries. This event is often regarded as the largest ransomware attack in history. 2020’s When the Maze group disbanded in 2020, a new threat emerged: the double-extortion Egregor RaaS variant. Interestingly, after collecting the ransom, the attackers gave victims tips on enhancing their system security. Over the last five years, “big-game hunting” has come to represent the increasing focus on targeting large corporations in cyberattacks. While earlier ransomware attacks were aimed at multiple individual victims, attackers now concentrate on thoroughly researching high-profile targets to maximise their profits. Some notable recent victims include the cities of Atlanta and Baltimore, Colonial Pipeline, and JBS USA. The global COVID-19 pandemic further fueled the growth of double extortion variants and RaaS. In a significant incident in May 2021, the REvil RaaS variant was employed in a large-scale attack against managed service provider Kaseya. The attackers demanded a whopping $70 million to release over one million compromised devices. Types of Ransomware Cyberattacks nowadays come in different forms. They enter and hold a valuable area of your business’s digital platform, demanding a ransom fee. Recent incidents have indicated that some criminals show no mercy at all when it comes to ransomware. So let’s look into and understand the most recurring forms of ransomware: Scareware Scareware is malicious software that falsely claims to have found a virus or other issue on your device. It then urges you to download or buy harmful software to address the problem. Typically, scareware serves as an entry point to build up more complex cyberattacks rather than being an independent attack. Screen lockers Screen-locking ransomware takes control of your computer by blocking access to the operating system. When you turn on the device, you will only see a ransom message or a fake one pretending to be from a trusted source like the FBI. And the message will ask you for payment to get your computer back. Encrypting ransomware Encrypting ransomware is the most common and recurring form of ransomware. You can view folders and applications on your device but cannot open those files. File names are often changed, and a new file or message containing a ransom note is typically added. Some Popular Ransomware Variants: Ransomware Examples Since it first appeared 30 years ago, ransomware has been evolving with technology. The world has witnessed numerous cybercrime attempts through ransomware, and an uncountable number of firms have fallen into this trap. We have compiled the most common and famous ransomware variants: Ryuk Ryuk is one of the most notorious ransomware types. It targets large Microsoft Windows systems used by public organisations. It encrypts the data on infected operating systems and makes it inaccessible until the victims pay a ransom, typically in untraceable Bitcoin. Ryuk targets businesses and institutions rather than individual consumers. REvil (Sodinokibi) Sodinokibi (REvil or Ransomware Evil) surfaced in 2019 as a private ransomware-as-a-service (RaaS) operation. It uses affiliates for distribution, sharing ransom profits between developers and affiliates. Sodinokibi targets high-profile attacks against large organisations and public figures, seeking substantial
