Ransomware is one type of malicious software or commonly called malware. Malware is software designed in such a way as to cause damage to a computer, server or computer network, whether in the form of a virus, spyware or something else. The term malware is very broad to include viruses, spyware, adware and ransomware. As long as software is intended to damage and disrupt a system, it includes malware.
Ransomware is a specific type of malware designed to demand a financial ransom from a victim by retaining assets or personal data. Ransomware spreading activities are carried out by attackers or Threat Actors with the main goal being financial. Therefore, Threat Actors make personal data a threat.
However, ransomware is also not always included in the virus. A malware is called a virus if it has the ability to spread itself from one file to another or from one computer to another without the knowledge of the computer user.
What Is Ransomware?
Ransomware is a name for a class of malware consisting of two words, namely ransom (ransom) and malware. Ransomware aims to demand payment for stolen personal data or information, or encrypted data. Currently malware has diversified (business gain) by extorting money from victims. Everyone can argue that ransomware is a form of simple extortion used for mass extortion, spread to many users and made more efficient by leveraging Cryptocurrencies for the anonymity of transactions.
Ransomware has emerged as a global epidemic why? As it continues to claim heavy casualties around the world, it’s forcing companies to decide between trying to recover data from backups (and potentially losing important data since the last backup) and paying some ransom money to hackers.
Examples of Ransomware Attack Cases
Here are some cases of ransomware attacks that shocked the world:
1. TeslaCrypt
TeslaCrypt targets additional files related to video games, maps, downloadable content and the like. For some video game users, these files are an important part of a video game. In 2016, 48 percent of the world’s ransomware attacks were TeslaCrypt.
2. SimpleLocker
SimpleLocker is the first android based attack to encrypt files and make them inaccessible to its users without the help of Scammers. In late 2015 to early 2016, Android ransomware infections of this type increased up to 4 times.
3. WannaCry
The WannaCry attack made ransomware and malware known to everyone. Within four days, the spread of WannaCry crippled more than 200,000 computers in 150 countries. Occurring in several hospitals, WannaCry encrypts the entire device, including medical equipment. Even some factories were forced to stop production activities.
Indonesia itself has also received ransomware attacks. In 2017, Dharmais Cancer Hospital and Harapan Kita Hospital, Jakarta were hit by the WannaCry ransomware which resulted in inaccessibility of several patient databases on computers. The malware has locked the system and patient data by demanding a ransom of IDR 4 million.
Types of Ransomware
In general, there are two types of ransomware:
1. Locker Ransomware
Locker Ransomware is ransomware that locks user access to a system or device. So, this locker ransomware performs a locking action on a file or computer device, then demands a ransom to open the lock. Sometimes what is locked is a file or software. However, sometimes hardware functions are locked, such as the non-functioning of some or all of the keyboard and mouse buttons.
This ransomware is the least intrusive type because it is easier to deal with by deleting the script or other means, so the threat level of this locker ransomware is low and the ransoms that enter are fewer.
2. Crypto Ransomware
Crypto Ransomware is ransomware that blocks users from accessing files or data, either by file encryption or other methods. This type of ransomware is designed to find valuable data from a computer, then make that data inaccessible. With the level of loss and annoyance they cause, this type of ransomware is becoming more and more important and the greater the risk.
Therefore, more ransomware developers spread this type of ransomware. The higher the threat, the greater the ransom paid and the greater the benefits obtained.
Ransomware Threat Handling
In handling ransomware threats, it is necessary to investigate the causes of malware that result in user data being locked. Following are the activities for tracking ransomware threats:
- The preparation stage is where policies, procedures, technology, and human resources must be carefully prepared, which will be used in the process of handling ransomware threats.
- The identification and analysis phase is carried out on the affected system in order to get to the root causes of the incidents that occurred.
- The containment stage aims to prevent the spread of the ransomware.
- The removal phase is where several different techniques are used to analyze the malware and remove the malware from the infected system.
- The recovery phase is the stage of returning the affected system to its normal state as before.
- Follow-up is the phase where all the documentation of activities carried out is recorded as a reference for the future.
Ransomware Threat Prevention
One of the most effective ways to deal with ransomware threats is to back up your data regularly. However, the latest ransomware is rumored to not only encrypt files, but also encrypt Windows system restore points.
Therefore, it is best to store data backups or restore points on a separate system that is not accessible by the network so that it can effectively restore data if it is attacked by a ransomware threat.
Other ways to prevent ransomware attacks are as follows:
- Educating employees about the basics of computer security, especially about malware, how it spreads, and how to prevent it.
- Tighten the limits on the system. By limiting access to data and applications, specifying roles and passwords, the execution of the ransomware code can be inhibited from spreading to the system.
- Reduce the number of users who have the administrator role and limit their access. Some ransomware is designed to attack administrator accounts in carrying out their actions. By inhibiting the administrator’s rate of spread, it will reduce the system infected with ransomware.
- Maintenance and periodic software updates. Software that is up-to-date will have more immunity and a better level of security in the face of interference with malware.
With an explanation of ransomware, companies need the best cloud solutions to avoid ransomware threats. Microsoft Azure is the best company solution because it has various services and tools to ensure the security of company data in the cloud. One of the services provided by Microsoft Azure is the Azure Security Center capability which you can leverage to verify that anti-malware, and other important security controls, are properly configured for all of your Azure virtual machines and are up and running.
In this case, Helios comes with Microsoft Azure that can help you improve your performance efficiency. For more information about Microsoft Azure, please visit us on our website or contact us via info@helios.id..
