Ransomware - How It Spreads and How to Stop It

About 2 min read

Ransomware is a type of malware that encrypts the files on an infected computer to render them unusable and demands a ransom in exchange for their recovery. It targets a wide range of victims, from individuals to large enterprises, medical institutions, and government agencies, and the damage can halt operations themselves. Since the 2020s, double-extortion attacks (which, in addition to encrypting data, threaten to publish stolen data) have been the dominant form, and the difficulty is that the pressure of having data exposed remains even when the files can be restored from backups.

Historical Background

The first ransomware is considered to be the 1989 "AIDS Trojan," which was distributed on floppy disks. However, it became a serious threat only from CryptoLocker in 2013 onward. The spread of cryptocurrencies such as Bitcoin made it easy to receive ransoms anonymously, which drove a sharp rise in attacks. The 2017 WannaCry attack spread across many parts of the world almost simultaneously and made the ransomware threat widely known to the general public. In the 2020s, a business model called RaaS (Ransomware as a Service) has taken hold, creating a situation in which even criminals without technical skills can carry out ransomware attacks.

Infection Vectors

The most common infection vector is attachments or links in phishing emails. Macro-enabled Office documents and executable files disguised as legitimate software are used. Intrusions that exploit vulnerabilities in the Remote Desktop Protocol (RDP) are also frequent. Infections via exploit kits that abuse software vulnerabilities and via supply-chain attacks have also been reported.

Real-World Use Cases

Ransomware tends to be detected at night or on weekends, when the people who can make decisions are not all available. The first action is to disconnect the suspected device from the network: unplug the wired LAN and turn off wireless. If shared folders or cloud storage are syncing, the encrypted files will overwrite the healthy copies, so stop the sync at the same time. Whether to power the machine off depends on the recovery plan, so avoid wiping or rebooting on your own judgment and first record what you can see (the ransom message on the screen, the changed file extensions, the time you noticed it). The only backups usable for recovery are the ones that were disconnected from the network, so knowing in advance how far back the disconnected copies reach lets you judge immediately whether recovery is possible.

Infection Flow

Practical Prevention and Countermeasures

The basics of prevention are keeping the OS and software always up to date, not opening suspicious email attachments, and making regular backups. It is important to store backups on offline storage that is disconnected from the network. A common pitfall is the expectation that "if you pay the ransom, your data will come back," but there are many reported cases in which data was not recovered even after payment, or in which the victim was attacked again. By protecting RDP and cloud service accounts with strong random passwords and enabling two-factor authentication, you can greatly reduce the risk of initial intrusion.