RANSOMWARE: TYPES AND PROTECTION

Ransomware

What once sounded like the plot of a mediocre technology thriller has become the stark reality of the technological age in which we live. The rise of ransomware in recent years has turned millions of people around the world into the victims of money-hungry hackers. Since the first major ransomware attack in 2013, this cyber threat has made hackers millions of dollars in ransoms and cost companies billions in losses.

What is ransomware?

Ransomware is malicious software that encrypts files on the infected computer, thus preventing the owner from accessing them. The owner is required to pay money as a ransom in exchange for the key to decrypt his files, hence the name, ransomware. The ransom for private users is usually in the few hundred dollars, while business owners are usually asked for thousands. In most cases, the hackers ask that the ransom be paid in cryptocurrency, so that the authorities cannot trace them.

Like other types of malicious software, ransomware is typically distributed via phishing emails that contain links to harmful content or dangerous attachments. Furthermore, users can unknowingly download it when they visit infected web pages that install malicious software on their computer without their consent. Today, ransomware is also distributed via social media and instant messaging applications.

When you install ransomware on your computer, it will encrypt your files in seconds, so you won't have much time to react. As a rule, you will see a splash screen that will inform you of the encryption and provide instructions for making the payment. If your screen is not locked, you may still be able to see your files, but trying to open them will give you an error message. Some types of ransomware also display FBI or Interpol logos to scare the victim into thinking that the police are involved.

Despite being around since 1989, ransomware is still a very new and poorly researched threat. While all 50 states in the United States have laws on hacking and data leakage, only a few have regulations that specifically refer to ransomware. In states that do, ransomware attacks are classified as misdemeanors or misdemeanors and carry fines of up to $ 25,000 and 25 years in prison.

What types of ransomware are there?

Based on how they affect the functionality of your computer, most ransomware programs belong to one of two types:

Computer Blockers

Also known as blocker ransomware, computer blockers will prevent access to your computer's interface, thus preventing you from using it. If your computer is infected with blocker ransomware, a splash screen with the author's message and payment instructions will appear during system startup. The perpetrator may also try to convince you that the ransom is a fine imposed by the security forces.

This type of ransomware usually only prevents access to the interface of your computer and does not affect your files or the system. So maybe you can remove the ransomware and keep all your files intact.

Data Blockers

Because individual data changes and not only blocks access to the computer interface, data blockers are potentially more dangerous than computer blockers. Also known as crypto ransomware, this software scans your computer for valuable files and changes their extension to one that the computer is not able to recognize. To unlock your files, you will have to pay the ransom and obtain the decryption key.

The hackers behind file lockers usually attack people who don't regularly back up their important files. When faced with the possibility of losing all their files, victims are usually willing to pay the ransom, although a good ransomware decoder can help them regain access to their files without having to pay.

Other Types of Ransomware

In recent years, new types of ransomware have sprung up. Among them:

Scareware: Usually disguised as antivirus software, scareware uses pop-up windows to inform the victim of alleged problems found on their computer. Instead of demanding money outright, the scareware pressures victims to quickly buy fake antivirus software, which will fix all problems instantly. Once installed and paid for, however, the software acts like malware and collects the victim's personal information.

Leak ware: Also known as doxware, this type of ransomware threatens the victim by publishing their personal information if they do not pay the ransom. In most cases, the hackers behind the leakware do not target specific files that may contain sensitive information. Instead, they simply exploit the fact that many users store private information on their computer (photos, videos, credit card information, and personal documents) and count on creating a state of panic.

Ransomware as a Service (Raas): While not exactly a different type of ransomware, RaaS is an emerging business model that is booming on the dark web. Rather than writing their own code, would-be hackers can reach an agreement with a third party who will develop the software for them and distribute it immediately to potential victims. Under this arrangement, the RaaS provider keeps a percentage of the ransom, and the rest goes to the hacker.

Top 5 Most Destructive Ransomware Examples

With new strains emerging almost every day and attacks becoming more and more devastating, hardly a week goes by without a headline in the news about technology related to at least one ransomware attack. Here are the five most devastating ransomware attacks to make the news in recent years.

WannaCry

Exploiting flaws in the Windows Server Message Block protocol, WannaCry encrypted files on Windows computers and ask victims to pay a ransom between $ 300 and $ 600 to deliver decryption keys.

CryptoLocker

Cryptolocker took the world by storm in 2013, infecting more than half a million computers via email attachments and spam messages. Although the threat was removed at the time, there were a few versions of this data blocker in full swing and very strong. Together, they provided their creators with a profit of around $ 3 million in ransoms, making CryptoLocker one of the most profitable ransomware components.

CoinVault

Originally detected in 2014, CoinVault may not have had as strong an impact as other ransomware programs. With thousands of infected Windows computers, mostly in Central and Western Europe, the ransomware branch earned its creators just over $ 23,000. However, this was the first large ransomware attack to be brought to trial.

Bad rabbit

Bad Rabbit first made the news in late 2017, although it was already being distributed via fake Flash updates in June of the same year. This malware component mainly targeted computers in Russia and the rest of Eastern Europe, by blocking access to files on infected devices. Bad Rabbit is still active and requires users to pay about $ 300 in Bitcoin to receive the unlock code and regain access to their files.

NotPetya

First released in 2016, Petya was updated after leaked NSA (US Homeland Security) documents revealed the existence of the EternalBlue hacking tool. It was renamed NotPetya, and this updated version still looked like ransomware, but instead of decrypting the victim's files after payment, they were completely erasing them. NotPetya caused extensive damage to entire networks around the world, but the worst hit were public transport and Ukrainian banks, who reported that the program was part of a cyber-attack perpetrated by Russia.

How to remove ransomware?

When faced with a ransomware attack, many people decide to pay the ransom before risking losing their important files. However, not only do the authorities advise against it, it may not be necessary. Most of the best antivirus software are able to detect and remove ransomware from your computer without deleting its files. This may not work for some of the more advanced branches of ransomware, which is why you need to know how to prevent a ransomware attack. 

To keep your computer safe from ransomware, you should never open suspicious emails or click on any links or attachments they contain. As ransomware takes advantage of software flaws, it is essential that you regularly update your operating system, as well as all programs installed on your computer. Lastly, don't forget to back up your data regularly, whether it's to an external hard drive or a cloud. This way, if the malicious program encrypts your files, it will continue to have access to them.

In addition to all this, it is important to use the best antivirus software to keep your computer protected against any potential threats. The reputable programs have a built-in ransomware decoder that monitors your computer in real time and quickly removes any malicious software components it detects. For optimal protection against ransomware, be sure to enable automatic database updates and schedule scanners.