Evolution of Ransomware: Growing Threat To The Organizations

1. Evolution of Ransomware & Growing Threat To The Organizations Ransomware is known to businesses of all kinds, small to medium to large and to individuals as the “prominent threat” since the mid-2000s. Back in 2017, the Crime Internet Complaint Center (IC3) of the FBI had received 1783 complaints on ransomware attacks that had extorted the victims and forced them to pay a ransom of over $2.3 million. Considering these complaints, it is just those cases of ransomware attacks that had been reported. Similarly, there would be so many of the malware attacks that have never been reported. Thus, the actual number of ransomware threats is not easy to state; neither the total cost of the individuals and the businesses could be calculated. An estimated 184 million ransomware attacks have been calculated in the last year itself, and it has been found that only those individuals or companies have been targeted who would bend before these attacks. In this article we will talk through some of the necessary information on ransomware, how do the attacks work, the first-ever ransomware attack, the gradual evolution of the ransomware attacks, the most significant ransomware attacks and the most prominent ones, what the future of ransomware looks like and some other related essential information. What Is Ransomware? Ransomware can be defined as malicious software, also known as malware that gains access to any computer systems or its files and blocks the users’ access on them. As ransomware blocks, the files, folders or the entire system, the cyber attackers held these blocked things, WWW.DARKWEBLINK.COM

2. hostages, using a unique form of coding termed as “encryption” until and unless the victim pays out the demanded ransom in exchange of a decryption key mainly meant for the system of its files and folders. The decryption key retrieved from the evil hacker is then used to decrypt or gain access to the already encrypted system or its contents. The name itself says a lot about what exactly a ransomware is. Simply stated, it is a method of extortion where the main motive is to extract hefty amounts from the victims in return of a decryption key which otherwise anyone would not be able to obtain. Ransomware is currently believed to be one of the most significant threats that the businesses and the individuals are fighting today. It has been seen that cyberattacks involving the ransomware payments are increasingly becoming sophisticated. This is making the situation more challenging to prevent and causing more damage to the victims than expected. How Do The Ransomware Attacks Work? Ransomware payments can only be extracted from the victims if the ransomware or the malware software can hold the systems or its contents hostage. The access of the systems or its files and folders can only happen through attack vectors or via infecting the system. There are a couple of methods in which by which any system can be corrupted and ransomed subsequently. Here are some of the attack vectors discussed briefly: Email Attachments -The most common method of malware distribution is via email attachments. The hackers send malware loaded email attachments disguised as legit company-oriented emails mentioning “urgent” or“important”. This triggers the employees to open the attachment or download them without further thinking. As soon as the attachment is opened or downloaded, the system gets infected, and the files get locked. Messages -Another technique that the cybercriminals utilize is by sending messages on the phone or other social media platforms like Facebook. In the case of the text messages, probably a link is forwarded that might intrigue the user to open it and as it is done, voila! The device gets infected. In case of the social media platforms, most significantly Facebook, the hacker creates the current “friends” list of the victim that mimics the actual friend list of the victim, and those mimicked accounts are then utilized to send file attachments via messenger. Once opened, the ransomware gets into the system and locks down the other connected networks. Pop-Ups - One of the oldest ransomware vectors is the “pop-ups” or the pop-up messages that mimic the currently-used software. This would make the users feel more comfortable and trust the messages and follow the prompts. WWW.DARKWEBLINK.COM

3. Which Is The First Ransomware Attack In The History Of Ransomware? Ransomware had gained maximum popularity as a malware threat since 2005, but the first instance of it was spotted back in 1989. The first ransomware attack was on the medical industry, like the Becker’s Hospital Review states. Following this, after 28 years, the medical or the healthcare industry remains the topmost target for the ransomware attacks. Surprisingly, the first known ransomware attack had taken place back in 1989 by an AIDS researcher (PhD) named Joseph Popp, who distributed 20,000 floppy disks in over 90 countries. He claimed that the disk contained a program that had analyzed the risk of acquiring AIDS of an individual via the use of a questionnaire. The disks also contained ransomware that got activated after the systems were restarted for the 90th time. A message was displayed to the victims that demanded $189 as ransom and another $378 against a software lease. This ransomware attack became famous by the term AIDS Trojan (also known as PC Cyborg). Ransomware Evolution & Its Future: The evolution of ransomware has been fascinating. The earlier ransomware contained flaws and other glitches that had paved the way for the new generation, modern and sophisticated attacks. It has been learnt that the early hackers used to write down the encryption code while the contemporary hackers place their interest on the off the shelf libraries, which are much harder to crack. They leverage specific sophisticated methods of delivery, such as spear-phishing campaigns in place of the traditional email blasts. WWW.DARKWEBLINK.COM

4. Some of the other contemporary attackers in the course of ransomware evolution are busy developing toolkits that the less knowledgeable attackers can download and deploy. Some of the most advanced attackers are also monetizing ransomware by providing ransomware-as-a- service programs. These had led to the rise in well-known ransomware such as Locky, TeslaCrypt, CryptoWall and CryptoLocker. By 2015, several other variants of ransomware had been identified such as Scatter, Mor, Shade, Aura, TorrentLocker, Lortok, Fury, and Cryakl. Talking about the future of ransomware in the process of evolution of ransomware, it can be predicted that the ransomware attacks will get more complicated and prove its potential at the maximum. They will get more and more creative, and the encryption will be strong enough, giving really tough times for the decryption tools to exist. In future, the ransomware will have a stronghold in the mobile devices as well. Thus, to protect against such damaging cyber attacks, the organizations and as well as the individuals need to maintain strong cybersecurity measures like conducting frequent tested backups, involving in structured a and regular updates, applying sensible restrictions on employees and contractors, investing in a proper credential tracking system and some related measures. Also read: Should Organizations Pay Ransom Following A Ransomware Attack? WWW.DARKWEBLINK.COM