What is Ransomware?

Ransomware is a type of malware (malicious software) used by cybercriminals to exploit weaknesses in cyber security to penetrate computer systems and restrict the victim’s data by encrypting it and then demanding a ransom payment in exchange for restoring access to the encrypted files. This costly cybercrime has seen a significant uptick in recent years, particularly with the increased use of cryptocurrencies and the massive migration of employees from offices to work-from-home environments.

This kind of cyberattack is particularly devastating because while it takes only a short while for a cybercriminal to access a system, it often takes much longer for a company or organization to realize they’ve been breached.

Ransomware typically propagates as an attachment in spam emails or zipped folders sent as email attachments that exploit known computer vulnerabilities and then encrypts the data stored on the computer. The victim then receives a message demanding a ransom payment in exchange for removing the encryption and restoring access to their data. Some ransomware types use a countdown timer, giving the victim a short period of time to pay the ransom before the price increases or the files are permanently encrypted or leaked. In some cases, it may be manually installed by exploiting security holes in programs downloaded from cybercrime websites.

Based on information from the U.S. Cybersecurity & Infrastructure Security Agency (CISA), Cisco and antivirus software maker Norton, some common ways cybercriminals can breach networks and deploy ransomware infections include:

Most ransomware operations are opportunistic in nature, meaning cybercriminals cast a wide net, knowing only a small percentage of the campaign will bring a payout. However, sometimes cybercriminals target certain types of businesses. Hospitals and school systems have become rich targets of opportunity because they:

Ransomware is a harmful form of malware that encrypts data on the target’s machine or network, rendering it inaccessible by encrypting it with strong cryptography and hiding it behind a key that can only be unlocked with a decryption tool. Once the criminals are inside your system, there’s not much you can do.

Common targets for this type of attack are small to medium-sized businesses (SMBs) with 500 or fewer employees. According to Norton, small businesses are not likely to have the same anti-malware protection or IT staffing capabilities as their larger counterparts and may also be more likely to pay the ransom because they lack the time or resources to invest in costly IT security measures or tolerate the downtime in production.

In a March 2021 news conference, Department of Homeland Security secretary Alejandro Mayorkas said small businesses comprise one-half to three-quarters of the victims of ransomware, and that ransomware attacks had increased by 300% in the past year. In its mid-year summary of small business cyber security statistics for 2022, Firewall Times reported small businesses are more frequently targeted by cyberattacks, with 43% of all data breaches targeting SMBs in 2019.

There are no guarantees that victimized companies will get their files back after paying the ransom or that authorities will catch the criminal. It creates a lose-lose scenario for the victims, forcing them to comply if they want to regain access to their data, systems and networks.

Ransomware is a threat to businesses everywhere, regardless of size. World cybersecurity leaders at a recent International Counter-Ransomware Initiative event held at the White House have called ransomware, “...an escalating global security threat with serious economic and security consequences.”

Ransomware attacks carried out on a global scale have inflicted widespread damages and interrupted critical operations at dozens of public and private institutions. Here are a few examples:

The WannaCry ransomware attack of 2017 infected computers in at least 150 countries with economic losses reaching up to $4 billion. European countries, including Russia were the worst affected in what European police agency Europol called an unprecedented cyberattack. The attack had a particularly damaging effect on healthcare organizations, such as the U.K.’s National Health Service. This was attributed to that system’s use of outdated and unpatched software on Windows devices.

In August 2018, a new variant of WannaCry forced Taiwan Semiconductor Manufacturing Company to temporarily shut down several of its chip manufacturing facilities after the virus spread to 10,000 of its machines.

Another noteworthy ransomware attack that occurred in 2017 was named Bad Rabbit. According to BBC News, this attack was reported by computer users in Russia and Ukraine and followed a similar pattern to the WannaCry and Petya cyberattacks, affecting the news agency Interfax, Russian media websites, Ukraine’s Odesa International Airport and an underground railway in its capital city, Kiev. Similar attacks were confirmed in Turkey and Germany.

Experts believed the ransomware used in this attack was related to the Petya malware, which was first discovered in March 2016 in Ukraine, due to similarities in the appearance of the ransom notes and their shared method of propagation across computer networks.

REvil, shorthand for Ransomware Evil, was a Russian-based private ransomware-as-a-service (RaaS) operation. REvil carried out a high-profile May 2021 ransomware attack of the meat packing company JBS, which temporarily shut down or disrupted operations at the company’s plants in the United States. It was learned that JBS paid $11 million in ransom in Bitcoin to REvil.

In July 2021, REvil websites and other infrastructure disappeared from the internet. Politico reported that U.S. government officials were unclear as to why this happened, but it’s also reported that the disappearance of the group occurred shortly after a phone call in which U.S. President Joe Biden told Russian President Vladimir Putin that he expected him to take action toward putting cyberthreats that originated on Russian soil to an end, whether or not they were working independently of the state. In January 2022, the Russian Federal Security Service said they had dismantled REvil and charged several members after being provided information by the United States.

A nasty form of ransomware with a global reach, Ryuk first appeared in 2018 and is known for targeting large, public-entity Microsoft Windows cyber systems. It is believed to be used by criminal groups  who target organizations rather than individuals. The CISA website provides detailed information on how Ryuk infiltrates computer networks.

According to the FBI, more than $61 million in ransom was paid due to Ryuk attacks in 2018-2019.

In 2017, a new variant of ransomware called NotPetya (named for its resemblance to an earlier ransom malware called Petya), was used in a global cyberattack that forced its way onto users’ computers, permanently encrypting data as it went.

It affected business across the globe, including Merck, FedEx subsidiary TNT Express and food producer Mondelēz, among others. 

When it comes to ransomware protection, it's about proactivity, early detection, prompt response and resilient recovery. You can learn how to defend yourself or your organization from ransomware attacks by implementing basic cyber security techniques recommended by the CISA, including:

CISA recommends that you follow these steps in response to a ransomware attack:

You don't have to be a cybersecurity officer to follow standard cybersecurity protocols, prevent ransomware attacks and keep your data safe. These tips will help you protect your data and prevent it from being ransomed: