Ransomware - Trojan in Disguise

 

You log into the computer, and it boots up. But instead of seeing the welcome screen, you get a dialog box. 

"Your data has been encrypted. To recover, pay $$ of Bitcoin."

The message also has a countdown timer, which indicates a payment deadline. 

Passwords, credit card details, personal videos/pictures all have been compromised. The hacker even threatens to leak everything online.

What happened......

Ransomware is a type of malware that encrypts personal data and blocks access to a computer/network.

To regain control, a ransom needs to be paid. Usually this is through Bitcoin, or other crypto currencies.

On payment, a key is given, which decrypts everything, and returns access to the system. 

However, you could be placed in a "Sucker's list" which is sold in the dark web. This can attract more ransomware attacks, in future.

History....

Originating in the 90s, the attacks were first recorded in Russia. Since then, it has crossed into Europe and North America. The hackers also transitioned from a lone wolf setup to organized crime cartels.

Modus Operandi

The attack transpires in five different stages

1. Redirected to a malicious website via adware, or email attachments. The virus gains access when a link is clicked, or a trojan software installed. Infected USB drives, or external hard disc is another mode of entry.

2. Once inside, the malware tunnels deep into the operating system. Here the payload is detonated.

3. The virus attacks as many files as possible. It also downloads other malwares, to facilitate its progress.

4. Targets the Master Boot Record present in primary storage device. This is a piece of software that loads the Operating System. It gets overwritten by malicious code. 

5. To get full control, a restart is prompted. Once done, the malware has complete control of the system.

Prevention

1. Ransomware targets weak system points, known as Zero Day Exploits. Regularly update the operating system. 

2. When visiting websites, refrain from clicking unknown links. Type the site address manually. This reduces getting directed to malicious ones.

3. On connecting any USB drives or external hard disc, pass it through a USB Key Sanitizer. This removes any malicious files, present in the same.

4. Invest in an antivirus software, preferably a paid one. This guarantees better service and regular updates.

Additional Information

https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/