Ransomware
What is it and how can we defend against it.
Ransomware is a type of malware that encrypts a victim’s files or locks them out of their system, then demands a ransom payment (usually in cryptocurrency) to restore access.
Here's how it works:
- Infection: Often begins through phishing emails, malicious downloads, or exploiting vulnerabilities.
- Encryption: The malware encrypts files or locks the system, making data inaccessible.
- Ransom Demand: A message appears demanding payment in exchange for a decryption key.
- Payment & Consequences:
- Paying doesn’t guarantee data recovery.
- Encourages further attacks.
- Some variants also threaten to leak stolen data (known as double extortion).
Common Ransomware Variants
- WannaCry – Spread rapidly in 2017 using a Windows vulnerability.
- Ryuk – Often used in targeted attacks on large organisations.
- LockBit – A ransomware-as-a-service (RaaS) model used by affiliates.
How to Protect Against Ransomware:
- Back up data regularly (and store backups offline).
- Keep software and systems updated.
- Use strong email filtering and educate users about phishing.
- Implement endpoint protection and network segmentation.
- Disable macros in Office files from unknown sources.