Ransomware was, once again, the top cyberattack type of 2021. It has been at the top of the threats list for three years in a row. Experts estimated that a ransomware attack occurred every 11 seconds last year. The average cost of ransomware recovery was estimated to be $1.85 million. These statistics explain why some have proclaimed ransomware to be a modern threat to public safety. In this blog, we'll demystify ransomware and answer some key questions pertaining to it.

What is ransomware?

The clue is in the name. Ransomware is a type of malicious software (malware) that prevents access to important data by encrypting it until a “ransom” is paid. Ransoms are typically requested in a crypto currency to avoid leaving the that comes with cash or bank transactions, which law enforcement agents can use that to track the attackers. Crypto is practically anonymous and a lot harder to track.

When the ransom is paid, the attacker provides the encryption key. However, a new trend has emerged in the last couple of years. Attackers have been increasingly threatening to make data public even after receiving their ransom. This practice is known as “double extortion”. Basically, there is no longer a guarantee that you will get back access to your important data even if you pay the ransom

How does ransomware work?

Ransomware can gain access to a network in several ways. The most common way of deploying ransomware is phishing. For instance, the attacker may pose to be try and trick the user into clicking a link and then provide some personal data. If the user falls for the trick, the attacker gains direct access to the user's credentials and is then able to easily deliver the malware. This method has grown in popularity among ransomware attackers because it's less detectable than older methods of attack in which the malware was embedded as an attachment. Moreover, once the attacker gains the user's credentials in this way they can use it anytime they want.

Other ways of gaining entry include malware, “malvertising” (fake ads carrying the ransomware), chat messages, vulnerable browser plugins, removable devices, email attachments, etc. Sophisticated ransomware could be self-propagating and automatic, needing no human action. They may carry out a drive-by attack that is triggered involuntarily by a user.

Once ransomware enters a device, it may try to proliferate into connected devices, drives or networks. Sometimes, ransomware can lay dormant for a while. During this gestation period, it may extort critical data and back itself up alongside legitimate files on the network to prevent backups from being used for recovery. 

What is an example of a ransomware attack?

Ransomware wasn't very well-known until 2017 when WannaCry shocked the world of cybersecurity. In a day, over 230,000 people across the world found out their files were encrypted. They could only retrieve these files by paying a ransom in

How did that ransomware incident happen? It was widely believed that the infection originated from a phishing email. However, researchers later concluded that the ransomware started by exploiting a vulnerability in a Windows that had already been identified by Windows two months earlier.

Interestingly, Windows had released a patch to protect against the vulnerability. That's why the WannaCry attackers were only to affect those computers that were not patched against the vulnerability that Microsoft had already identified. This example goes to show exactly how critical it is to keep up to date with patching.

WannaCry wreaked havoc across sectors in over 150 countries. UK's National Health Service (NHS) was one of WannaCry's most severely affected targets . Many hospitals were forced to cancel their operations and stop the important work they were tasked with doing.

The actual ransom payments were only between $300-$600 per user but the total cost of the ransomware is estimated to be around $4 billion. Several other ransomware attacks have taken the world by storm since then. But Wannacry continues to be a prime example of a ransomware attack.

Who is behind ransomware attacks?

Ransomware can be created from scratch or by modifying existing ransomware. This is usually done by coders or malware experts. However, not all ransomware attackers are coders or malware experts. Some ransomware creators sell their malware or lease it to others. After all, is a booming business. That's why anyone can launch a ransomware attack - regardless of whether they are technical or not.

How long does it take to notice a ransomware attack?

The answer to this question varies from case to case. Sometimes a ransomware attack may be spotted early. At other times, a ransomware attack may be spotted only too late. How long it takes for a company to notice a ransomware attack usually depends on several factors like:

• Knowledge and experience levels of the experts
• Type of ransomware
• Size of the IT infrastructure
• Type of protection used against ransomware

How to prevent a ransomware attack?

Ransomware attacks are hard to prevent because they may be caused by the simplest of human errors. However, you can still take the following steps to prevent yourself and your company from falling prey to a ransomware attack.

Use phishing protection

Phishing emails cause about 91% of cyberattacks. This is arguably because legacy email security software is not effective at blocking phishing attacks. They rarely are designed to prevent new forms of malware.

Using software that offers phishing protection can help nip the problem in the bud by blocking problematic emails before they even reach the inbox. Advanced phishing protection software can offer greater protection by analyzing the business relationships of employees and creating trusted profiles. They can scan for irregularities in email contents and flag attacks early. Lastly, they can even learn daily to grow smarter and fight new threats

Invest in security awareness training

95% of cybersecurity threats are caused by human error. Companies can reduce the risk of experiencing a cybersecurity disaster by approximately 70% if they train their employees to identify and mitigate phishing threats. Phishing simulation (sending fake phishing emails) is an effective way of helping employees and users learn how to identify malicious emails in a safe environment. You can even automate the training and reporting process to make it stress-free and result-oriented for employees

Automate patch management

As we already noted, the WannaCry ransomware attack especially affected those computers that had not downloaded a recently released Windows update. This goes to show how critical it is to manage patches. Unpatched systems offer a gateway to cyber criminals. The trouble is managing all patches on many endpoints. This is where an automated patch management tool can do all your heavy lifting for you and ensure that your applications are always up to date, so your network is less susceptible to ransomware attacks.

Scan for vulnerabilities

If you're going to protect your device and network against ransomware, you need to constantly be on the lookout for potential dangers – within and outside of your network and take measures to protect against them. The Ponemon Institute research we cited before also revealed that 34% of the victims had been aware of their vulnerability but had just not deployed the appropriate patchesAdvanced vulnerability scanning tools offer real-time protection through automation and allow you to stay ahead of all ransomware dangers.