Ransomware

Ransomware is a type of malicious software that blocks access to a device or to digital files and then demands a ransom payment to restore access. Some ransomware families prevent use of the device by locking the screen, while others prevent access by encrypting files.

After infecting a system, ransomware commonly:

• Encrypts files and restricts user access.
• Displays a warning or ransom note to communicate payment demands.
• In some cases, requests payment through digital payment methods.
• May establish persistence so it can run again after reboot.

^{Ransomware (}AA⁾

In the cited source, ransomware is discussed in two main groups:

• Locker ransomware: restricts access by locking the device or screen.
• Crypto ransomware: restricts access by encrypting files.

The source describes common ways ransomware spreads, including:

• Email messages carrying malicious attachments/links (including phishing content)
• Social engineering tactics to persuade users to click, download, or open files
• Exploiting unpatched/outdated software vulnerabilities
• Malicious redirections via certain ads or deceptive content

A ransomware attack is summarized in the source as typically involving:

1. Gaining access to the system or getting the malware executed
2. Encrypting files or locking the device
3. Notifying the user of the ransom demand

Examples mentioned include CryptoLocker, WannaCry, and Petya.

The source highlights the following practices:

• Security awareness training and post-training attack simulations
• Keeping systems up to date (patch/update management)
• Using anti-malware and anti-spam protections
• Network controls such as firewalls and analyzing suspicious files in a sandbox
• Preparing an incident response plan
• Maintaining an off-site backup plan