Ransomware is a type of malware that threatens to publish the victim’s data or lock the device until the attacker is paid a ransom, and it has attracted a considerable degree of interest from threat actors in recent years. Ransomware started as simple schemes whose encryption of inexperienced users’ data was easily undone, and has grown into highly complex cyberattacks that require exceptional hacking skills to carry out or prevent. This shows that the threat landscape is constantly evolving. This article discusses ransomware and its development, new trends in how it is used, and mitigation measures against these threats.

This blog explores the early evolution of ransomware and how it has changed over the years.

The early days of ransomware

The first ransomware dates back to 1989: the AIDS Trojan, also known as PC Cyborg. This first variant of ransomware was spread through floppy disks and demanded that payment be made to a post office box in Panama. Its encryption was relatively simple and was easily decrypted, but it laid the ground for further development.

The ransomware developed in the 2000s, for example Gpcode, was more advanced than its predecessors in that it used stronger encryption methods. Yet the first clear instance of ransomware was not detected until 2005, and it was not until Bitcoin arrived in 2009 that ransomware became popular. Bitcoin made it easier and more lucrative for cybercriminals to accept payments from their ransomware, as the payments were anonymous and untraceable.

Modern ransomware

It is important to note that there are more advanced tactics and techniques that can be employed in relation to this strategy.

The last decade has seen attackers develop new techniques for conducting ransomware attacks. Contemporary ransomware groups have applied a number of sophisticated strategies in order to optimise their performance and revenue generation.

Encryption and obfuscation techniques. Today’s ransomware employs strong encryption and encoding techniques, including RSA and AES, to keep victims’ data locked up. This makes it very difficult to get the data back without the decryption key. Ransomware also uses various techniques in its code to prevent it from being detected by anti-malware tools.

Ransomware-as-a-Service (RaaS). RaaS has made it easier for attackers to join the dark side, since the barrier to entry is much lower than before. Ransomware-as-a-Service is a popular business model that has been prevalent on the dark web for quite some time, in which cybercriminals provide ready-to-use ransomware toolkits so that anyone can conduct attacks. The model is based on profit sharing: the developers who created the ransomware take a cut of the payments.

Double extortion. To exert more pressure on victims, ransomware gangs have resorted to double extortion. Besides encrypting data, they steal sensitive information and threaten to leak it if the demanded amount is not paid. This strategy increases the chances of receiving payment and also maximises the harm to the victim’s reputation and finances.

Targeted attacks. While the first ransomware attacks were random, today’s attacks are much more selective. Hackers invest a great deal of time scanning for targets based on organisational value, such as big businesses, hospitals and government establishments. These targets are chosen because of the high likelihood that substantial ransoms will be paid to avoid disruption to operations and the leakage of sensitive information.

Exploiting remote work. The COVID-19 pandemic brought about remote work, which has led to new risks. A majority of attacks involve weak security in remote desktop protocol (RDP) connections and virtual private network (VPN) entry points. Cyber threats have also ramped up, particularly those involving phishing, which has benefited from the growing level of interconnectedness.

Latest ransomware strains

Several ransomware strains have gained notoriety for their sophistication and impact.

• Ryuk. Known for targeting large organisations and demanding multimillion-dollar ransoms, Ryuk has caused significant disruption, particularly in the healthcare sector. It often gains initial access through phishing emails or via the TrickBot or Emotet trojans.
• Sodinokibi (REvil). This RaaS operation has been responsible for numerous high-profile attacks. REvil is notorious for its double extortion tactics and high ransom demands. It typically exploits software vulnerabilities and employs advanced evasion techniques.
• Maze. Maze was one of the pioneers of double extortion. It not only encrypted data but also threatened to publish stolen information. Although the group announced its retirement in 2020, its tactics have been widely adopted by other ransomware operators.

Defending against ransomware

Given these modern ransomware tactics, the world must find ways to adapt and protect itself. It is always unwise to rely on a single layer of security to prevent ransomware attacks, which is why a layered security system is so important.

Employee training and awareness. Phishing has been seen to be the most common method of delivering ransomware. Formal training sessions should be conducted periodically so that employees know not to fall for a phishing email or other social engineering schemes. Awareness can also be strengthened through administrative measures such as mock phishing exercises.

Robust backup strategies. It is also important to back up files regularly and ensure that backup data is secure. Organisations should implement a 3-2-1 backup strategy: data is backed up three times over, on two different types of media, with one of those backups kept in a location separate from the main backup. Regular backups are a way to prevent loss, but they should also be tested so that they are ready for restoration if an attack occurs.

Patch management. Failure to patch bugs exposes systems and software to attackers; patching denies them the chance to exploit such weaknesses. Several measures can make patch management easier: organisational patch management can be used to maintain the timely deployment of patches across the organisation.

Network segmentation. A major strategy in combating ransomware is segmentation, which reduces the damage that ransomware can cause in a network. Using protective measures, an organisation can restrict attackers’ ability to spread through the network and compromise more important data.

Endpoint protection and EDR. In particular, deploying advanced endpoint protection and endpoint detection and response solutions can detect and prevent ransomware. These tools rely on behavioural analysis and artificial intelligence to alert on activity that may indicate an attack is under way.

Incident response planning. It is therefore crucial to develop a flexible incident response plan before such incidents occur. This should include the actions to be taken during a ransomware attack in terms of communication, the roles to be played by the different teams involved, and measures to contain the attack and restore normal operations.

Law enforcement and collaboration between agencies

The prevention and mitigation of ransomware is critical and must be done in concert. Police forces around the world are intensifying collaboration in order to identify and dismantle ransomware gangs. Examples of what international cooperation can achieve include the takedown of large-scale botnets like Emotet and cybercriminal groups like REvil.

Companies should also take part in information sharing and analysis activities such as the Cyber Threat Alliance (CTA) and Information Sharing and Analysis Centers (ISACs). Sharing threat intelligence can help prevent such attacks and strengthen the defensive response against ransomware.

Conclusion

Ransomware is a good example of how hackers are constantly evolving and creating new forms of attack. As threat actors refine their methods, it is vital for an enterprise to remain prepared and proactive. To reduce the risk and consequences of ransomware attacks, organisations should adopt a multi-level security strategy, work with trained employees, and cooperate with other organisations. To sum up, ransomware attacks remain a constant threat, but they can be defeated, especially if security-conscious individuals and organisations draw on the collective experience of cybersecurity professionals and continue the fight.