Malware is typically defined as a program that is inserted into a system, usually covertly, with the intent of compromising the confidentiality, integrity, or availability of the victim’s data, applications, or operating system or of otherwise annoying or disrupting the victim. From spyware and adware to trojans, rootkits, bots and keyloggers, malware is constantly evolving. Emerging strains are becoming more sophisticated, fooling users, security administrators and anti-malware products.
Ransomware is a sophisticated form of a malware attack that is a serious and costly threat to virtually every enterprise organization, regardless of size or vertical. Ransomware attacks can put critical data at risk of theft or destruction while rendering IT systems inoperable. Enterprise malware and ransomware attacks have been increasing in volume and sophistication for years, and detecting them on the network is becoming more difficult.
In 2021, ransomware attacks increased by 13% over the year before – as much as the previous five years combined. According to the annual Verizon Data Breach Investigations Report, ransomware accounted for 25% of all types of breaches in North America.
While most ransomware attacks don’t result in financial losses, the ones that do cause significant damage. In the first six months of 2021, the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN) reported $590 million in losses from ransomware-related activity – nearly 50% more than the $413 million in losses for all of 2020. Beyond the financial impact, ransomware attacks are causing damage to energy supplies (Colonial Pipeline), food production (JBS USA), as well as schools, health services, and municipal government operations from Florida to Oregon to Massachusetts.
Organizations hit by ransomware suffer untold losses in business disruption, being effectively disabled on average for about 19 days. While email-based spear phishing has long been a favorite vector of ransomware attackers, attacks are increasingly occurring on social media accounts, mobile chat, and collaboration applications.
Ultimately, the way we work today puts us at greater risk than ever. From Office 365 email to social media apps like Facebook, collaboration apps such as Microsoft Teams, Slack, and Zoom, and messaging apps like WeChat and Telegram, these apps have quickly become embedded in today’s brands and business relationships. Today, we are all at risk of becoming victims of malware and ransomware attacks.
Malware and ransomware attacks have become a pervasive problem since these threats began 15 years ago.
- Email gateways are becoming overwhelmed from huge, botnet-driven campaigns, polymorphic malware, and URLs escaping attachment detection techniques.
- The growth of the cloud workplace driven by a massive increase in use by enterprises and individuals across the globe, has dramatically expanded the threat surface. There are far more attack vectors today than just a few years ago. Phishing attacks – the main source of ransomware attacks – occur far more than attempts at stealing personal credentials.
- Social media digital defenses are relatively weak compared to the $3 billion email security industry. Today, cybercriminals have a higher probability of success by attacking social media channels rather than email.
- The easy accessibility of technologies to develop malware has lowered the bar to entry. With the cost of building ransomware cheaper than ever, far more cybercriminals are using ransomware for financial gain.
- Encryption technologies have continued to improve. With modern ransomware, once the encryption of a hard drive or a set of files takes place, it can be nearly impossible to perform de-encryption without paying the attacker for the key.
- Organizations are more interconnected than ever before, so a single ransomware trojan can flow like poison through an entire organization in days or even hours.
- With ransomware, victims who do pay are frequently targeted again.
Social media and other workplace channels have become ripe targets for ransomware attackers. Even the tools and solutions designed to enable communication and collaboration in and around organizations have expanded the threat surface.
From malicious payloads delivered through links and personal messages that convince or scare unsuspecting victims into wiring resources into a bogus account, to GIFs that steal sensitive information just by being viewed, ransomware attacks can look like any common email, message, or website. And in most cases, victims don’t realize they’ve been infected until it’s too late.
Some of the most common workplace channels that have experienced malware- and ransomware-related issues include:
The Slack collaboration platform boasts a huge number of individual and business adopters. Because of the proliferation of Slack, attackers have created malware that can easily compromise users of this application. Recently, bad actors have been leveraging Slack’s chat capabilities to trick users into opening malicious payloads and deploying various remote-access trojans (RATs) and info-stealers, according to reports.
For example, the May 2021 ransomware attack on the Colonial Pipeline network was a double-extortion scheme perpetrated by the DarkSide ransomware group. The damage? Nearly 100GB of data stolen, and a closed down pipeline that affected the entire US continent, especially the Mid-Atlantic region. And according to FireEye, the attackers may have exploited Slack API to communicate with the C2 server and carry out the attack.
In addition to its susceptibility to malware, Slack has other vulnerabilities. Securing the platform for business can be a great challenge to companies without the right security and compliance solutions.
Even before Zoom’s meteoric rise in adoption due to the COVID-19 pandemic, the platform has had its share of ransomware incidents. Today, it’s one of the platforms that have continuously allowed people to reconnect with each other, especially during the pandemic lockdowns. Zoom ransomware threats still exist and the need for security measures against them is real.
Microsoft’s suite of technology solutions include Office 365 and Teams, and both come with vulnerabilities. In 2016, a ransomware exploiting Office 365, called Cerber, affected millions of the platform's users. Then in 2021, the train operations company Merseyrail experienced a Lockbit ransomware attack resulting from a compromise in their Microsoft Office 365 account.
With the growing adoption of Microsoft Teams in enterprises and business, bad actors have found opportunities to deploy malware that targets Teams. Case in point: the FakeUpdates malware campaign that infected Teams accounts in 2020. If businesses want to protect themselves from ransomware that infects their Microsoft instances, they should leverage enhanced enterprise visibility and security solutions.
As the largest professional online network, LinkedIn has experienced its fair share of cyberattacks and data breaches. Malware, ransomware, and phishing campaigns have infected LinkedIn users and remain active today.
Case in point: in April 2021, attackers launched a phishing campaign in an attempt to trick professionals into opening a .zip file with malware that downloads a backdoor into the users’ computer, allowing attackers access and the ability to install malicious software. Earlier in the year, malicious actors used the platform’s contact request functionality to install ZeuS, a data theft malware, onto their victims’ computers.
Ransomware on Facebook and Messenger is becoming much more common; some of the most used search queries on Google are “how to fix malware on Facebook” or “how to remove malware on my Facebook account.”
Recently, another Facebook Messenger malware has been spreading rapidly. Dubbed the Messenger Virus, the most recent iteration of this malware contains a profile picture, the name of the recipient, an active link, and emojis, and often comes with subjects like “Is this you?” or “XXX video”; anything that might capture the account owners’ attention. Facebook’s help desk offers a number of actions suggesting how to deal with a Facebook ransomware attack.
Boasting over 500 million monthly, more than 50 million daily users, and massive engagement rates, Telegram can host large groups (up to 200,000 users) and large file sizes (up to 1.5 GB). Its messenger security is viewed as a cut above the rest, earning its title as one of the most secure messaging apps in the world.
Still, hackers have found a way to embed Telegram’s code inside a remote-access trojan (RAT) called ToxicEye that enables bad actors to control infected computers through a hacker-operated Telegram messaging account. Companies planning to secure Telegram for business use should deploy a robust cybersecurity system that protects their systems from this threat.
WhatsApp is the most popular global mobile messenger app worldwide with approximately two billion monthly active users. Recently, the Triada malware, first spotted in 2016, has resurfaced inside an advertising component of a modified version of WhatsApp called FM WhatsApp. This malware acts as a payload downloader, injecting up to six additional trojan applications onto Android phones that can do a number of malicious actions.
There are three main vectors that can deliver malware and ransomware inside a device or system. These include:
Email Phishing.Most ransomware attacks in recent history started with phishing emails. These emails trick users into opening a malicious attachment or clicking a malicious URL that activates the ransomware, which then proceeds to infect the recipient’s computer or device and potentially spreads throughout the entire IT infrastructure.
Emails and software updates are the most common deployment systems for malware today. Malicious emails are highly effective, especially when they appear to be from legitimate contacts and parties the recipient trusts. Part of the scammer’s sophisticated approach is to craft convincing emails that contain authentic-looking email addresses, logos, and other elements like specific text types and tone of the message.
176% year-on-year growth in phishing URLs, many of which contained ransomware.
Social media ransomware attacks mimic their email counterpart: bad actors send malicious links via direct message. Usually, these links spoof a real login page and steal credentials. Phishing links sent via direct message tend to be opened even more than those sent over email, as people are generally wiser to email threats, but tend to open messages without thinking.
Exploit Kits.Exploit kits are automated programs used by attackers to exploit known vulnerabilities within systems or applications. A user will visit a certain website or and/or use a certain piece of software, and the exploit kit will silently download ransomware onto the user’s device and execute it. Certain types of software, such as Adobe Flash and Oracle Java, are known to contain vulnerabilities. The CVE Program, which identifies, defines, and catalogs publicly disclosed cybersecurity vulnerabilities, contains more than 177,000 listings in its database, and the number of vulnerabilities continues to climb.
For example, WannaCry ransomware in 2017 infected an estimated 230,000 computers across 150 countries in just hours, taking advantage of the Eternal Blue exploit. One of the most devastating examples of ransomware in history, WannaCry used a Microsoft exploit stolen from the National Security Agency (NSA).
You might wonder which type of device is the top target for malware and ransomware incidents. The answer? All of them.
Malware and ransomware attacks have most frequently affected desktops and laptops because they’re often delivered through email channels. But, as bad actors have adapted to the boom in social media and with the proliferation of mobile chat and digital communication channels, every device is now susceptible - including smartphones, tablets, and even smart watches.
All forms of ransomware attacks restrict access to files or data that are valuable to the user, and then demand payment in order for the user to recover access. But the question remains: how many types of ransomware are there? In general, there are seven broad categories of ransomware.
The most popular form of ransomware, and extremely damaging, crypto-malware gets inside a system and encrypts all the files and data contained within. Access is impossible without the malefactor’s decryption key.
Once executed, scareware automatically locks a user’s computer and displays a message claiming that it has detected a virus or an error. The scareware instructs the victim to pay a specific amount to “fix” the issue. Some forms of scareware don’t technically encrypt files, but flood the screen with pop-up messages that make using the system impossible.
Rather than encrypting select files, lockers lock victims out of their systems completely, preventing them from accessing anything. Locker-based attacks include a screen display that tells the victim the ransom demand, and often includes a countdown timer, intended to induce panic and force victims to pay without attempting to find another solution.
This type of ransomware claims and encrypts a certain sort of data. It then threatens to release victims’ personal (in the case of an individual) or sensitive (in the case of a business) data to specific parties or the general public. Victims of doxware/leakware are driven to pay the ransom for fear of highly private data being exposed.
For parties that want to initiate ransomware attacks but don’t have the time, the tools, and/or the expertise, the cybercriminal market has a solution. People can reach out to a professional hacker to do the job for them. This hacker will carry out the attack and receive a portion of the ransom reward in exchange for their services. These hackers, often referred to as “affiliates”, allow ransomware developers to focus on their weapons while they concentrate on infecting more people and generating more revenue.
In order for the affiliate model to work, developers generate specific code within the ransomware with a unique identifier embedded within. This code splits the ransom payout between the developer with the unique ID and the affiliate that infected the victim.
For most ransomware attackers, extortion is now “big business”. According to Recorded Future, attackers and their affiliates carry out extortion by threatening to release exfiltrated files unless a victim pays a ransom. This is partly due to the fact that extortion cases garner media attention, something many cybercriminals crave.
Publicity aids the sales of these Ransomware-as-a-Service (RaaS) offerings, but what’s more enticing to these criminals is the seemingly lucrative payout. In fact, in Russia, the average payout per infected host is about $300 against 30 ransomware payouts a month. One ransomware group called DarkSide has an affiliate program where payouts to affiliates can range from 75-90% of the total ransom, depending on how successful the attack was.
This is a targeted, complex, low-volume, high-return form of ransomware attack. The attacker gains entry, makes lateral movements to observe the network, then gains access to exfiltrate files and deploy the ransomware. Big game hunters are patient. It typically takes days for an attacker to understand the network, gain the proper access, and deploy.
Spear-phishing techniques deployed in the cloud workplace are similar in nature and involve an element of social engineering to enable the initial compromise to succeed. The attacker can often perform their target recon on the app itself (e.g. LinkedIn) and then simply make a connection request to the target to begin establishing the trust relationship. In fact, the more connections the attacker makes within the organization, the greater the sense of trust that is established.
At this point, the attacker is in an excellent position to launch the attack by sending a malware-laced attachment or link to the targeted victim, under the pretext of a legitimate purpose. For example, cybercriminals might adopt the guise of a recruiter, and will send a malware-laced file link under the cover of a job description. Once the victim clicks through on the document, the host device can be compromised with a first-stage malware payload.
In an enterprise attack, this step is typically only the first stage and would be unlikely to contain ransomware. Longer-term, the objective is to drive lateral movement within the enterprise for long-term persistence and to establish command and control for data exfiltration and, ultimately, ransomware deployment.
Given the nature of these “Big Game Hunting” scenarios where ransomware is often delivered as part of a multi-stage attack process, and may occur on any one of several attack surfaces, it is important to coordinate defensive counter-measures across all of these vectors. For example, detecting a malware attack on a social media app could also be an indication of a broader attack front across multiple attack surfaces such as email and remote access management tools.
Malware and ransomware attacks are frighteningly successful. The techniques used to deliver malware are constantly evolving, and once encryption takes place it can be tough to reverse. In practice, most enterprises pay up when affected with a sophisticated ransomware attack.
For this reason, the absolute best course of action against ransomware is to mount proactive defenses combined with constant data backup. Some best practices on how to mitigate malware and ransomware include:
Test Backup and Recovery Procedures.The most important part of a ransomware security strategy is the use of regular data backups. Enterprises should perform these as often as possible, and they should be combined with backup and restore drills. Both processes are important, but recovery drills are the only way to know for certain if a backup plan is a good one. If a team can recover from a very recent backup, they might not need to pay to get their data back.
Enhance Powers of Detection.Malicious links and attachments that are the main source of ransomware attacks can arrive through multiple workplace channels – not only through email, but via social media messages, collaboration tools, and many other communication channels. Effective digital risk protection tools can proactively monitor all digital communications and immediately detect and quarantine potentially problematic links, attachments, and URLs. Traditional antivirus software doesn’t provide enough protection; enterprises need next-gen solutions leveraging machine learning to detect both known and unknown forms of ransomware.
Educate Employees on Cybersecurity Best Practices.A study by Kaspersky revealed that almost half of employees don't know how to respond to ransomware attacks. All employees should gain a basic understanding of what ransomware is, how it usually arrives, and what the warning signs are. They should know who to report suspicions to, and what to do in the event that their actions trigger the execution of ransomware.
Constantly Update and Patch Operating Systems and Software.Attackers work relentlessly to discover vulnerabilities that can be exploited. Avoiding malware and ransomware requires IT professionals to be equally rigorous in return. Common vulnerabilities and exposures are always being patched, but updating systems and patching software from legitimate sources, can help significantly reduce exposure to vulnerabilities.
Incorporate Digital Risk Protection Into the Core of Cybersecurity Efforts.To keep up with the growing and ever-changing threat of ransomware, enterprises need to invest in digital risk protection tools that provide full threat intelligence. With this approach, IT teams can automatically identify, assess, and proactively respond to threats, and stop any ransomware spread before it begins.
Monitor Endpoints for IOAs (Indicators of Attack).A dedicated set of cybersecurity solutions offer endpoint detection and response (EDR). These solutions can closely monitor activities across all endpoints, and capture raw events deemed suspicious. These solutions can deliver unhindered environment visibility for proactive threat recognition and response at the endpoint level.
When it comes to malware and ransomware, avoiding becoming a victim is better than the cure. While reducing the risk of incidents is a priority for many businesses, but if an organization does fall prey to ransomware, the following steps should be followed:
Remove the Device from the Network.Malware or ransomware on one device is bad, but if attacks proliferate through a network of devices it can be catastrophic. Employees should be trained to immediately disconnect their device from the network if they see a ransomware demand displayed on their screen. They should also do the same if they observe unusual behavior, such as an inability to access their own files. Employees must not attempt to restart the device; it should be sent immediately to the IT department.
Notify Law Enforcement.Ransomware is a crime. Theft and extortion rolled into one make it a law enforcement concern. Organizations should immediately contact the FBI, CISA, or the U.S. Secret Service if they fall victim to a ransomware attack.
Use Digital Risk Protection to Establish the Scope of Attack.In the wake of a ransomware attack, security teams need to gather as much intelligence as they can, as fast as they can. This will help both internal IT teams and law enforcement agencies formulate a response. Enterprises should strive to figure out the nature of the attack: who is behind it, what tools they used, who they targeted, and why. Answering such questions can help your IT managers and network administrators determine the extent of the attack and protect networks from future attacks.
Consult with Stakeholders to Develop the Proper Response.Enterprises suffering a ransomware attack need to answer a host of questions: Can they afford to lose access to the targeted files, either because they have been backed up, or because they are not of the highest priority? Can the organization afford the ransom? Is there any room for negotiation? All stakeholders, from shareholders to legal counsel, should be consulted.
Get the Post-Mortem Right.The best way to resist a ransomware threat is to have learned from the last one. After an attack, enterprises should task their IT technicians, network administrators, and cybersecurity teams with a thorough review of the breach. A meticulous assessment of an organization's infrastructure, practices, and processes is required to discover flaws in security, and reinforce an enterprise against existing and future threats.
The threat of ransomware continues to grow and attacks are becoming more costly. The average ransomware payment increased by 78% to $541,010 in 2021, according to the Ransomware Threat Report from Palo Alto Networks, and the average ransom demand increased by 144% to $2.2 million.
Moving forward, more companies should proactively secure their data by following the best practices mentioned above and continue to resist being strong-armed by ransomware attackers. When cyber extortion loses its profitability, organizations win.
With proper digital risk protection, organizations can detect and nullify ransomware threats before they become an issue. The SafeGuard Cyber platform can keep pace with the scale and velocity of modern digital communications, and detect phishing links and other indicators of malware and ransomware attacks across the full suite of cloud platforms. Threats are instantly flagged and quarantined before an unsuspecting human target clicks on anything dangerous.