What Is Ransomware? Ransomware is a type of malicious software, or malware, that encrypts it (sometimes also stealing it) and holds it for ransom, usually demanded in cryptocurrency. Ransomware attacks most often deny victims access to their data unless the victims pay by a deadline—after which they can lose access to the data permanently. Payment demanded for a decryption key can range from hundreds to millions of dollars.

The History of Ransomware and an Increase in Attacks

Though cybercriminals have been using ransomware attacks for more than 30 years, there has been a significant uptick in recent years. According to the FBI, ransomware attacks started picking up in 2012, and show no sign of slowing.

In the past, ransomware attacks that locked down a user’s computer or files could be easily reversed by a trained professional. But in recent years, ransomware attacks have become more sophisticated and, in many cases, have left the victims with little choice but to pay the ransom or lose their data forever.

A 2020 ThreatLabz report showed an increase of more than 500% in ransomware delivered in encrypted channels between March and September. It is estimated that during the year 2020 alone, ransomware will have inflicted damages of more than $20 billion worldwide.

A recent and notable change in many ransomware family variants is the addition of a data exfiltration feature. This new feature allows cybercriminals to exfiltrate sensitive data from victim organizations before encrypting the data. This exfiltrated data is like an insurance policy for attackers: even if the victims have good backups, they’ll likely pay the ransom to avoid having their data exposed.

The most common targets for ransomware attacks in recent years have been municipal governments and academic institutions, but since the start of the COVID-19 pandemic, hospitals and remote workers have become a new focus for ransomware gangs. Furthermore, in the last year, reports of ransomware delivered through encrypted traffic have increased significantly.

Due to the capacity limitations of legacy security technologies, such as next-generation firewalls, most organizations do not have the ability to inspect all encrypted traffic. Attackers know this, so they are increasingly using encryption to hide their malicious links and attachments.

How Ransomware Works

Ransomware is most commonly spread by phishing emails and ads with infected links or a planted website embedded with malware. Phishing emails often appear as though they have been sent from a legitimate organization or someone known to the victim (in targeted attacks),  tricking the user into clicking on a malicious link or opening a malicious attachment.

In ransomware attacks on an individual, documents, photos, and financial information are most commonly locked and held hostage. While individuals might be an easier target, corporations—especially larger organizations—are far more attractive. If attackers can get just one employee to download the malware, it can then spread from that user’s device onto the network, where the stakes are much higher. Not only can an attack disrupt business, but the threat of data loss or exposure could be devastating and costly in dollars and in company reputation.

While some organizations are investing in cybersecurity insurance to help cover costs in the event of a cyberattack or data breach, the best course of action when it comes to ransomware is prevention.

To protect your organization from ransomware, CISA, the Cybersecurity & Infrastructure Security Agency and the FBI recommend the following:

• Back up computers, so you can restore your system to its previous state using your backups.
• Store backups separately, such as on an external hard drive or in the cloud, so they cannot be accessed from a network.
• Update and patch computers so that vulnerable applications and operating systems don’t become targets.
• Train employees with ongoing, mandatory cybersecurity awareness sessions to ensure they are aware of current threats and security best practices. Be sure they are cautious with email—even from senders they know, verifying the sender’s legitimacy before opening any attachments or clicking links.
• Create a continuity plan in case your organization becomes the victim of a ransomware attack.

Preventing Ransomware Attacks

Modern ransomware defense technology is not only highly effective but also easy to deploy. Sufficient ransomware protection begins with adopting a security posture that’s natively built in the cloud to protect users, applications, and sensitive data from these attacks, regardless of where users connect or what devices they’re using.

To keep up with today’s most common ransomware threats, a prevention strategy must incorporate the following principles and tools to prevent these attacks from exposing your data, disrupting your business, or costing your organization time and money:

• Use an AI-driven sandbox quarantine to hold and inspect suspicious content before allowing it to pass through to the recipient
• Inspect all SSL/TLS-encrypted traffic to ensure there are no hidden threats
• Implement always-on protection for users on and off the network

No company, large or small, is safe from ransomware without a dedicated security defense. Avoid becoming the next victim of ransomware, or the next organization in the news as a result of an attack.

Strengthen Your Ransomware Protection Strategy Today

As research and headlines show, ransomware isn’t going anywhere. Zscaler has already helped thousands of customers prevent ransomware and countless other cyberattacks from reaching their networks with unparalleled scalability and superb user experiences.

Here are some further resources to consider as you refine your overall security strategy:

• Internet Threat Exposure Analysis—free threat exposure analysis tool
• Three Secrets to Stopping Ransomware Cold—on-demand webinar
• Three Secrets to Stopping Ransomware Cold—white paper
• Zscaler Cloud Sandbox
• Zscaler SSL Inspection