Just a few weeks ago, an American college paid a record amount of $28,000 (about £22,500) to get their files back after a ransomware attack.
With this kind of money on the line, ransomware attackers won’t discriminate who it targets, with businesses big and small, hospitals, police departments and schools all being targeted daily.
Cyber criminals are getting smarter
Since the first ransomware outbreaks were reported, the type and style of attacks have spiralled. Today, there is no guarantee that once data is hostage the cyber criminal will return the files upon receipt of payment.
2016 was a pivotal year in the evolution of ransomware, as it highlighted to the cyber security industry the breadth and increasingly sophisticated attack techniques cyber criminals are using.
>See also: How to minimise the impact of ransomware
As well as cyber criminals inventing more sophisticated attacks, it is also becoming simpler for amateur cyber criminals to jump on board the ransomware bandwagon.
Access to ready-made ‘malware as a service’ (MaaS) is incredibly simple for a hacker to obtain, making it easy for an amateur cyber criminal to stage, execute, and reap the rewards of an attack.
Likewise, skilful social engineering has taken over, meaning the previously easily noticeable misspelling, incorrect business logos or poor grammar that once gave away a malicious email is no longer a norm – making these attacks far harder for a user to identify.
Industries can therefore expect more people, businesses and organisations to fall victim to ransomware attacks than ever before.
Ransomware in action
Last year, a small UK-based building consultancy was hit by ransomware – the type of attack was a variant called DMA Locker. The infection was eventually traced back to an email attachment opened in Outlook.
This simple act of an employee, who was probably expecting an invoice and opened up an attachment, completely froze the small business, causing massive disruption.
As with most SMEs, the firm did not have a dedicated security team, which made locating backups of files a nightmare, and the attack affected the company for months.
This SME won’t be the only business to make this error as ransomware continues to rise. New strains and samples are found almost daily by the Sophos Labs team – and it’s not going anywhere anytime soon.
More users are going to be recognising the risks of ransomware attack via emails, so cyber criminals are looking to explore other methods of infection. Some are experimenting with malware that hits later, long after a ransom is paid, and some are starting to use built-in tools and no executable malware at all to avoid detection by endpoint protection code that focuses on executable files.
Some variants have even offered to decrypt the files after the ransomware is shared with two friends, who pay up to retrieve their files.
What’s more concerning is the pace at which ransomware has transformed. It is only a question of time before IT departments see things beyond data being ransomed.
It is perhaps a while off before we have a sufficient mass of internet-enabled cars or homes, but this still begs the question: how long before the first car or house is held for ransom by a cyber criminal?
Here are some top tips to ensure a business is as safe as can be from the ransomware rise:
1. Backup regularly and keep a recent backup copy off-line and off-site
There are dozens of ways other than ransomware that files can suddenly vanish, such as fire, flood, theft, a dropped laptop or even an accidental delete.
Encrypt backups and then an organisation won’t have to worry about the backup device falling into the wrong hands.
2. Enable file extensions
The default Windows setting is to have file extensions disabled, meaning you have to rely on the file thumbnail to identify it.
3. Don’t enable macros in document attachments received via email
Microsoft deliberately turned off auto-execution of macros by default as a security measure. A lot of infections rely on persuading you to turn macros back on – don’t fall for this.
4. Be cautious about unsolicited attachments
The crooks are relying on the dilemma that you shouldn’t open a document until you are sure it’s one you want, but you can’t tell if it’s one you want until you open it. If in doubt leave it out.
5. Patch early, patch often
Malware that doesn’t come in via a document often relies on security bugs in popular applications, including Microsoft Office, your browser, Flash and more.
The sooner you patch, the fewer holes there are to be exploited.
6. Stay up-to-date with new security features in your business applications
For example Office 2016 now includes a control called “Block macros from running in Office files from the internet”, which helps protect against external malicious content without stopping you using macros internally.
7. Explore anti-ransomware technology
Some modern security vendors have implemented advanced anti-ransomware technology into their products, providing an extra layer of security and offering peace of mind.
Sourced by Marty Ward, VP products at Sophos