Threat: Ransomware
1. Threat: Ransomware
Let’s begin by examining and defining ransomware threats. Ransomware is a very prominent content-related threat targeting enterprise networks today. It’s a type of malicious software exploit that threatens to publish the victim's data or perpetually block access to their data unless a ransom is paid. Recent Google research shows cyber thieves have made at least 25 million dollars from ransomware in the last two years and this figure is expected to grow. Ransomware commonly uses a technique called “cryptoviral extortion” which encrypts the victim's data, making the data inaccessible without the encryption key. The perpetrator will then demand a ransom payment before they will agree to decrypt the files. Digital currencies, such as a cryptocurrency, are used for the ransoms, making tracing and prosecuting the perpetrators very difficult. This diagram summarizes the typical ransomware attack sequence. Ransomware attacks can start as mass campaigns looking for potential vulnerabilities or as directed campaigns. A directed campaign starts with identification and reconnaissance, where an attacker determines which organizations are vulnerable and what attack vector to use. There are many ransomware attack vectors. The most common are phishing emails with malicious URLs or exploiting an exposed software vulnerability. This software vulnerability can be in the software that your organization uses, or a vulnerability that exists in your software supply chain. Ransomware attackers target organizations, their supply chain, and their customers. When the initial attack is successful, the ransomware installs itself and contacts the command and control server to retrieve the encryption keys. As ransomware spreads throughout the network, it can infect resources, encrypt data using the keys that it retrieved, and exfiltrate data. Attackers demand a ransom, typically in cryptocoins, from the organization so that they can get the decryption key.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.