Ransomware explained

When you open your newspaper, chances are pretty high that there is yet again an item or even a headline on cyber-attacks. Especially ransomware cyber-attacks are omni-present these days. These attacks lock people’s computers and their data where after users are asked to pay a ransom in order to get their files and systems back.

Recent examples are Asco, a Belgian company in the aerospace industry with 1.500 employees in Belgium, Germany, Canada and the US, that got hit by a Ransomware attack in June 2019 and lost its entire production capability for almost a month and is still recovering today. More recently, the University of Maastricht got hit and lost the bulk of their Windows-based systems, causing an interruption in their teaching activity, and in the end had to pay the ransom in order to get their systems back.
The story of these articles is usually the same, impacted companies lose their ability to do business and to run their operations, hereby impacting their profit, their employees and the reputation of the organization in the long-term.

This news coverage is good for creating awareness about this growing problem, but they rarely help you to understand how to avoid this problem in the first place, and how to properly respond to such an attack if you become a victim yourself.

Before we dive into avoiding and responding to ransomware attacks, it is important to understand what ransomware is, how it operates, who is behind it and what is their motivation.

The majority of ransomware attacks are driven by financial gain, only a minority have sabotage in mind.  
Financially driven attacks are usually executed in an opportunistic fashion by organised crime or malicious individuals that want to make as much money as possible with the least effort by making as many potential victims with a single attack, going for the lowest hanging fruit first. If the attack is sabotage driven, it is typically targeted and more sophisticated to damage the specific organization and its operations.

Each ransomware attack starts with a piece of malicious software (malware) that the attacker wants to deploy on your system to take over control. The attacker has various ways of doing this, which are called attack vectors:

• Exploits: These are malicious software tools that abuse known unpatched and unknown vulnerabilities on your system. These exploit tools – also called exploit kits – are usually executed when a potential victim visits a website that got compromised. Malicious software hidden on the site or in an advertisement will redirect you unnoticed and when your system is vulnerable, a drive-by download of the ransomware malware is executed, and your system becomes infected.
• Phishing with malicious email attachments and links: An attacker crafts emails, likely from a trusted source and with familiar content, and attaches a malicious file that looks like a normal document. When you open the attachment, the ransomware malware is installed or downloaded, and your system becomes infected. Like attachments, the attacker can also embed links (URLS) in the email and lure you into visiting these links. When clicked, the link will download the malware and your system becomes infected too.
• Downloads: Ransomware can also be hidden in downloads executed by yourself when they come from an untrusted or compromised source. When opened, the malware will be installed and infect your system.
• USB drives: Like downloads, the malware can also hide on compromised USB drives and when plugged in, the malware will try install and infect your system.
• Network: Some types of malware can spread through the network by exploiting known unpatched and unknown vulnerabilities in the network protocols used by your system. This means that if an already infected machine is connected to your network, the ransomware can infect any unpatched system that is connected to the same network if no other protections are in place. Usually, they have the ability to propagate lighting fast. An example of this is the WannaCry ransomware which infected and brought down hundreds of thousands of machines in a matter of days and caused a major disruption in UK hospitals.

Once the malware is on your system, it will phone home to a Command and Control (C&C) server on the internet, where it will get instructions from the attacker on what to do next. At this stage and given the attacker has control over your system, a few things can happen in parallel or sequential:

• The malware encrypts your files with an encryption key only known to attacker, this could include connected USB and network drives and even connected backup systems;
• The malware looks for sensitive information that could be used for extorsion, or for re-selling on the black market when it concerns valuable intellectual property, credit card information, or customer data. Some attacks will also look for crypto-currency wallets that might exist on the infected system and can be transferred to the attacker;
• The malware starts looking for other systems on your network or systems directly attached to your system and will try to infect them too, where after the same actions can be applied as with the initial host system. This is called lateral movement. With lateral movement, it’s usually the attacker’s goal to obtain as much access to as many systems within the organisation. Especially the organisation’s domain controllers are seen as the keys to the Kingdom. Systems controlling production installations are also highly targeted as they can wreak havoc to a company’s business, making the victim more willing to pay the ransom;
• In some cases, the attacker can also use your infected infrastructure as a starting point to hack into your customers or suppliers that are connected through e.g. shared private networks, applications, documents or by sending out phishing emails originating from your organization.

How can I prevent all of this?

Preventing ransomware attacks requires a layered approach that involves technology-based controls, user awareness and training, in combination with the right IT policies, procedures and processes that together form the basis of a good cyber security hygiene. This will help you not only preventing ransomware attacks but increase your overall cyber resilience, and it will help you recover from an attack more rapidly while limiting the impact to your business.

• Train your staff regularly on how to use IT systems responsibly based on company policies and how to recognize phishing attempts. Educate them to never click on unverified links, open untrusted email attachments, download files from unknown sites, connect unfamiliar USB-drives, or hand-over personal data, including usernames and passwords;
• Protect each end-point system with up-to-date end-point protection software (e.g. anti-virus, anti-phishing, web-protection);
• Patch/update all software in your environment regularly, including operating systems, network devices, applications, mobile phones and other software frequently. A lot of ransomware attacks are still successfully exploiting system vulnerabilities that are known and for which a patch is available for many months;
• Backup – Probably the most important countermeasure against Ransomware is backing up all systems, also including your securely configured cloud storage. These regular backups should be stored at a different location and should be isolated from the overall network, so that any infection could be prevented from spreading to the backup. These backups and their recovery should be regularly tested, including the integrity of backups;
• Control your email, web and remote access – The organisation’s email and web access should be configured to scan and limit the type of attachment and downloads that are coming in (e.g. office files with Macro’s enabled or JavaScript), stop executable file downloads, and detect and prevent access to known bad sites, URLs and scripts. Ideally, all incoming external mail is also tagged as EXTERNAL to inform the user that she/he has to be more vigilant;
• Access to systems and network drives should be based on a least access privilege mechanism, so that a regular user and his/her system don’t have full control over it as it would give also full access to any malware infection. Where possible, strong authentication mechanisms should be implemented;
• Monitor your environment, this might not immediately detect and stop the initial infection, but it will be help you to detect any lateral movement and malicious behaviour in your organisation early and will allow you to react more quickly, limiting any further damage;
• Have an incident response plan ready for ransomware. Knowing what to do and who to contact in case of an attack is key in trying to limit the impact of the attack.

What to do if you are under attack

You have carefully followed the guidelines above but still all of sudden your screen looks like this?