Ransomware is a type of malware that comes in several different forms and can affect personal systems as well as the networks of businesses, hospitals, airports and government agencies.

Since first appearing in 1989, ransomware has continued to improve and become more sophisticated. While simple ransomware is non-encrypting, modern ransomware uses cryptography to encrypt files, making them inaccessible. Cryptoransomware may also encrypt a computer's hard drive to completely lock the computer's operating system, making the victim unable to access the computer. The ultimate goal of ransomware is to get the victim to pay a ransom for decryption - usually an untraceable digital currency (such as Bitcoin or other cryptocurrencies). However, the attacker will not necessarily admit to receiving the ransom.

The popularity of ransomware has grown significantly over the past decade (especially in 2017). As Europol reports, it is currently the most prominent malware threat in the world as a financially motivated cyber attack.

How was the victim attacked?

• Phishing: A recurring form of social engineering. When we talk about ransomware, phishing emails are one of the most common ways of spreading. Victims are often infected through compromised email attachments or links pretending to be legitimate. In a computer network, one victim can compromise an entire organization.

• Vulnerability attack software package: a package composed of various malicious tools and written vulnerability exploitation code. These packages are designed to exploit issues and vulnerabilities in applications and operating systems to spread malware (unsecured systems running outdated software are the most common targets).

• Malvertising: Attackers use ad networks to spread ransomware.

How to protect yourself from ransomware attacks?

• Use an external device to back up files regularly so users can restore them after removing potential malware infections;

• Be careful with email attachments and links. Avoid clicking on ads and websites from unknown sources;

• Install trustworthy anti-virus software and keep software applications and computer operating systems updated

• Enable the "Show known file extensions" option in Windows settings so that users can easily check file extensions . Avoid using file extensions such as .exe .vbs and .scr;

• Avoid visiting websites that are not protected by the HTTPS protocol (i.e. URLs starting with “https://”). However, it is worth noting that many malicious websites are gradually using the HTTPS protocol to confuse victims. The protocol alone does not guarantee that the website is legal or safe.

• Visit NoMoreRansom.org, a website created by law enforcement and IT security companies dedicated to disrupting ransomware. The website provides free decryption kits for infected Honghu as well as prevention advice.

Examples of ransomware

GrandCrab (2018)

First appeared in January 2018, ransomware (GrandCrab) infected more than 50,000 victims in less than a month It was later cracked by Romanian authorities, Bitdefender and Europol, a free data recovery toolkit. Distributed via malvertising and phishing emails, GrandCrab is the first ransomware to demand payment in the cryptocurrency DASH. Initial ransom payments ranged from $300 to $1,500.

WannaCry (2017)

A global cyber attack that occurred within four days Infected over 300,000 computers. WannaCry targets Microsoft's Windows operating system (the most affected is Windows 7) and spreads through a vulnerability called EternalBlue. The attack has been blocked thanks to an emergency patch issued by Microsoft. U.S. security experts claimed North Korea was responsible for the attack, although no evidence was provided.

Bad Rabbit (2017)

A type of ransomware downloaded from compromised websites of fake Adobe Flash updates spread. Most of the infected computers are located in Russia, and the infection relies on manual installation of an executable (.exe) file. The decryption price (of the ransomware) was around $280 (0.05 BTC) at the time.

Locky (2016)

Typically spread via email, as an infected attachment within a payment invoice. In 2016, Hollywood Presbyterian Medical Center was infected by Locky and paid a ransom of 40 BTC (approximately $17,000 at the time) to regain access to the hospital's operating system.