What is Ransomware?

If you’ve heard of ransomware attacks in the news, you’ll know they can result in big losses for big businesses. But the fact is that organisations of any size can fall victim to an attack, and often the smaller your business is, the more severe the impact.

Ransomware can be carried out easily via phishing techniques, and hackers view it as a lucrative source of income. In this blog, we give you a quick start overview of ransomware, accompanied by some fun and fresh videos from one of our security experts on how it works, the potential risks to business and how to stop it in its tracks.

How does ransomware work?

• Threat actors will use an attack method such as phishing which relies on users downloading and opening a link or attachment. Plugging in malware infected devices or visiting websites that execute drive by downloads can also introduce ransomware to a system.
• Ransomware is a type of malware that unlike those used in stealth attacks, makes itself known by spreading rapidly throughout the network, encrypting endpoint user access, and bringing business activities to a halt.
• Users will be notified via the ransomware itself which displays a message on the screen informing users that their data has been encrypted and demanding payment in return for a decryption key needed to restore files.
• If the user decides to pay the ransomware to recover their data, they should be provided with a decryption key for unlocking their files. However, they may not receive the key even after payment, or their data may be sold or stolen by attackers to demand further payments.

Types of ransomware

Most ransomware works by encrypting files and locking users out of systems, but sometimes hackers may bluff an attack with scareware, which flags up warning signs that a system has been hacked and tries to sell fake security software to fix non-existent problems. Another way hackers deploy ransomware is by stealing confidential business files and information and threatening to leak them on the dark web, known as doxing. Doxware also encrypts files and can lead to double or triple extortion attacks where hackers demand multiple payments to keep stolen data from being leaked in the future.

Ransomware attacks

Ransomware often gains notoriety for proliferating throughout networks and infecting multiple businesses. Some notable attacks include WannaCry, an attack which infected thousands of computers worldwide in 2017, and more recently the MOVEit attack of 2023, which used an existing vulnerability in widely used software to launch a zero-day attack against over 600 businesses, including high profile companies Shell, British Airways, and the US Department of Energy.