6 Ransomware Protection Strategies You Must Know

How Does a Ransomware Attack Work?

Image source: Wikimedia Commons

A ransomware infection usually occurs in two phases:

1. Ransomware encrypts files or locks the device—encryption involves scrambling files or a file structure until the data is no longer usable. Most ransomware programs use data encryption methods that victims cannot reverse without using a unique decryption key. This method enables attackers to demand ransom in exchange for a key.
2. A ransom note appears on the screen—once the ransomware encrypts the files. A note appears to specify a ransom demand, explaining the sum, mode of transfer, and deadline. Usually, attackers threaten that if victims do not meet the deadline, they will either increase the ransom, delete the files, or prevent any future attempt to decrypt them.

As long as the device is infected with ransomware, attempts to open the encrypted files might result in an error message informing you that the files are invalid, corrupt, or cannot be located.

Related content: Read our guide to ransomware detection.

Related content: Read our guide to anti ransomware.

Ransomware Protection Solutions

Dedicated Ransomware Protection Solutions

A dedicated security tool can provide holistic protection against ransomware, both at the network, file system, and application layer. One such solution is Cynet 360, an advanced threat detection and response platform that provides protection against threats, including ransomware, zero-day attacks, advanced persistent threats (APT), and trojans that can evade signature-based security measures.

Cynet provides a multi-layered approach to stop ransomware from executing and encrypting your data:

• Pre-download—applies multiple mechanisms against exploits and fileless malware, which typically serves as a delivery method for the ransomware payload, preventing it from getting to the endpoint in the first place.
• Pre-execution prevention—applies machine-learning-based static analysis to identify ransomware patterns in binary files before they are executed.
• In runtime—employs behavioral analysis to identify ransomware-like behavior, and kill a process if it exhibits such behavior.
• Threat intelligence—uses a live feed comprising over 30 threat intelligence feeds to identify known ransomware.
• Fuzzy detection—employs a fuzzy hashing detection mechanism to detect automated variants of known ransomware.
• Sandbox—runs any loaded file in a sandbox and blocks execution upon identification of ransomware-like behavior.
• Decoy files—plants decoy data files on the hosts and applies a mechanism to ensure these are the first to be encrypted in a case of ransomware. Once Cynet detects that these files are going through encryption it kills the ransomware process.
• Propagation blocking—identifies the networking activity signature generated by hosts when ransomware is auto-propagating, and isolates the hosts from the network.

Cynet 360 provides all these anti-ransomware capabilities and more. 

Learn how Cynet can protect your organization against ransomware and other advanced threats

Windows 10 Ransomware Protection

The Windows operating system now has built-in ransomware protection, as part of Windows Security. This was introduced by Microsoft in Windows 10.

Windows 10 ransomware protection works by only allowing approved applications to make changes to the file system. This can prevent ransomware from encrypting files, but can also interfere with the operation of legitimate applications.

This is why ransomware protection is not enabled by default. To use it, you’ll need to enable it and configure it properly so that existing applications can continue functioning.

To enable Windows 10 ransomware protection:

1. Search for Windows Security in the Windows Start menu.
2. In the Windows Security sidebar, select Virus & threat protection and click Manage ransomware protection.
3. Switch the option Controlled folder access to On. This ensures only applications in the Windows Security allowlist can make changes to files on the operating system.

Decryptors

If a computing system is already infected by ransomware, files have been encrypted, and there are no backups, a last resort is to use decryptors.

There are a range of free decryption tools that are able to reverse the encryption by some types of ransomware. Be sure to use a legitimate descriptor from a source like the No More Ransom Project.

If there is a working decryptor for your ransomware, run it, obtain the key, and use it to decrypt the files. Note that depending on the type of ransomware and available system resources, this can take several hours.

A few important notes about using decryptors:

• Identify ransomware type – before using a decryptor, identify the type of ransomware using Crypto Sheriff. You will need to provide the email address, Bitcoin account or web address shown in the ransomware message.
• Many ransomware types have no decryptor – in many cases there will be no working decryptor for the ransomware strain. In this case, consult with a security professional to see if there are additional ways to restore the files.
• Decryptors do not remove the ransomware – note that decryptors are not enough to clean a ransomware attack from your systems. Ransomware can activate secondary malware or delete your data. Make sure your system is clean from ransomware and all malware before using the decryptor.

How Big Is the Ransomware Threat?

Ransomware is a global menace, threatening organizations of all sizes, and growing in scope and severity. Here are a few statistics that show the magnitude of the threat:

• How many are affected – according to a recent IDC report, 37% of organizations worldwide were the victim of a ransomware attack.
• Critical sectors targeted – The US Cybersecurity and Infrastructure Security Agency (CISA) reported there were ransomware attacks against 14 of 16 critical infrastructure sectors in the US
• Financial losses – according to the US Treasury’s Financial Crimes Enforcement Network (FinCEN), ransomware-related costs were $590 million in the first half of 2021, more than in the entire preceding year.
• Government involvement – Gartner predicts that by 2025, 30% of governments worldwide will have rules or regulations governing ransomware payments.

What are the Most Dangerous Types of Ransomware?

Ryuk

Ryuk ransomware targets large, public-entity Windows systems. It works by encrypting data on an infected system and demanding ransom in Bitcoin. This ransomware appeared in 2018, initially believed to be of North Korean origin, but it is now suspected to be used by Russian criminal groups targeting organizations.

Learn more in our detailed guide to kaseya supply chain attack.

Sodinokibi

REvil/Sodinokibi ransomware encrypts files upon deployment and deletes the ransom request message after infection. The message demands bitcoin, notifying the victim that the demand will double if they do not pay the ransom on time.

REvil is delivered as Ransomware as a Service (RaaS), a model in which code authors develop the ransomware and affiliates spread it to collect the ransom. It was discovered in 2019 and has since become the 4th most distributed ransomware globally, targeting mostly European and American companies.

Netwalker

Netwalker ransomware holds its victim’s data hostage and leaks a sample of the stolen data online, threatening to release all the data to the dark web if the victim does not pay the ransom on time. It was created in 2019 by Circus Spider, a cybercrime group, and later shifted to a RaaS model to operate on a larger scale. It often spreads through phishing emails.

Learn more in our detailed guide to netwalker.

Maze

Maze is a Windows ransomware developed as a variant of ChaCha ransomware. It targets organizations worldwide, demanding a cryptocurrency payment in exchange for the encrypted data, threatening to leak the victim’s confidential data if they refuse to pay.

Maze was discovered in 2019. It is usually distributed through:

• Spam emails, typically through malicious links or attachments like Word or Excel files.
• RDP brute force attacks.
• An exploit kit.
• Through the victim’s client or partner who has already fallen victim to the attack.

Learn more in our detailed guide to maze ransomware.

CryptoWall

CryptoWall ransomware encrypts files and their names and demands a ransom for a decryption key. It typically spreads by phishing and spam emails, hacked websites, malicious ads, or other malware. Cryptowall uses a Trojan horse to deliver malicious payloads. By encrypting file names, CryptoWall increases the pressure on victims, who consequently pay the ransom to get their data back.

Learn more in our detailed guide to wastedlocker.

Locky

Locky ransomware encrypts important files on an infected computer, holding them hostage, delivering a ransom note that demands payment in exchange for the encrypted files. It typically arrived as an email including a Word doc attachment containing the code. Locky was discovered in 2016 and became a significant threat. While Locky is currently out of commission, other variants have emerged.

Learn more in our detailed guide to ragnar locker.

Cerber

Cerber is delivered as RaaS providing attacker licenses that split the ransom between the developer and affiliates. Cerber affiliates can deliver Cerber ransomware to various targets in return for providing the author with 40% of the ransom. The author creates the ransomware in this exchange, and affiliates find targets to distribute it.

Learn more in our detailed guide to lockbit ransomware analysis.

9 Ransomware Prevention Tips

Here are several ways you can prevent ransomware from striking your organization.

1. Actively manage access – restrict access to known users and known legitimate traffic to safeguard your data and applications from encryption. Strong passwords and multi-factor authentication provide added security to prevent bad actors from accessing your systems.
2. Centralized management – to deal with the complete range of ransomware threats, organizations must use centralized management procedures and systems. Sensitive information should be categorized, assessed, and properly secured wherever it resides.
3. Use anti-malware solutions – block suspicious executable files, and leverage email security solutions to monitor email traffic for malicious messages and block phishing attacks. To address unknown and zero-day malware, including zero-day ransomware, use advanced security technology such as signatureless behavioral analysis.
4. Implement centralized patch management – patch all endpoints when vulnerabilities are identified, including operating systems, mobile devices, applications, cloud resources, software, and IoT.
5. Protect backup repositories – implement the 3-2-1 rule by keeping three copies of your information, storing it on two distinct media types, and keeping one of these media off-site. It is also important to periodically test backups to ensure they are functional and maintain data integrity.
6. Educate users – Help your end users by providing them with the practice and education they need to protect against ransomware attacks. Consistent communication and awareness training will let everyone in your organization know the threat of ransomware and gain familiarity with security approaches. Ensure that your employees know how to report suspicious behavior and understand the importance of timely reporting.
7. Establish a disaster recovery plan – to ensure they can completely recover data and applications in case of disaster, organizations must create, test, and uphold practices, tools, and procedures for business continuity and disaster recovery (BCDR).
8. Conduct a risk assessment – categorize types of ransomware disasters and create priorities for business continuity and recovery.
9. Create an incident response plan – the plan should clarify what to do in the case of a ransomware attack, including determining data sensitivity and disconnecting affected systems from the network to contain the attack.

Related content: Read our guide to linux ransomware.

Learn More About Ransomware Protection

Ransomware Removal: Recovering Your Files and Cleaning Up Infected Systems

Ransomware Prevention: 4-Step Plan to Stop Ransomware Attacks in their Tracks

FTCode Ransomware: Distribution, Anatomy and Protection

Ransomware Detection: Common Signs and 3 Detection Techniques