Ransomware

Description

Ransomware is a type of malware that encrypts files or locks systems, demanding payment (ransom) for decryption. It's one of the most damaging cyber threats, affecting individuals, businesses, and critical infrastructure.

Types of Ransomware

1. Encrypting Ransomware

• Crypto ransomware - Encrypts files
• Uses strong encryption (AES, RSA)
• Demands payment for decryption key

2. Locker Ransomware

• Locks user out of system
• Doesn't encrypt files
• Shows fake law enforcement notices

3. Doxware (Leakware)

• Threatens to publish stolen data
• Double-extortion tactics
• Data breach + encryption

Detection Methods

Behavioral Indicators

• Rapid file modifications
• Mass file renaming
• Suspicious processes
• Network connections to TOR/C2

Detection Scripts

• Ransomware Behavior - Behavioral analysis
• File Monitor - Real-time file change detection

Prevention Strategies

Technical Controls

1. Regular Backups - 3-2-1 backup strategy
2. Application Whitelisting - Only approved software
3. Email Filtering - Block malicious attachments
4. Patch Management - Keep systems updated
5. Network Segmentation - Limit lateral movement

Prevention Scripts

• Backup System - Automated backup solution
• App Whitelisting - Application control

Attack Flow

flowchart TD

    A["📧 Phishing Email"] --> B["🖱️ User Clicks Malicious Link or Attachment"]
    B --> C["⬇️ Malware Drops Payload"]
    C --> D["🔐 Encryption Begins"]
    D --> E["📝 Files Renamed: .locked or .encrypted"]
    E --> F["📄 Ransom Note Created"]
    F --> G["💰 Payment Demand Displayed"]

    %% Styling
    classDef initial fill:#1f77b4,color:#ffffff,stroke:#0d3b66,stroke-width:2px;
    classDef action fill:#ff7f0e,color:#ffffff,stroke:#8c2f00,stroke-width:2px;
    classDef impact fill:#d62728,color:#ffffff,stroke:#7f0000,stroke-width:2px;

    class A,B initial;
    class C,D,E action;
    class F,G impact;

Ransomware Indicators

File System Changes

• Files renamed with new extensions (.encrypted, .locked)
• Ransom notes (README.txt, HOW_TO_DECRYPT.html)
• Desktop wallpaper changed
• Shadow copies deleted

Process Behavior

• Volume Shadow Copy deletion
• Windows Backup removal
• Encrypting processes
• TOR network connections

Best Practices

3-2-1 Backup Strategy

flowchart TD

    A[💾 3 Copies of Data] --> B[📀 2 Different Media Types]
    B --> C[☁️ 1 Copy Offsite]

    %% Sub-details
    A --> A1[Primary Data]
    A --> A2[Local Backup]
    A --> A3[Secondary Backup]

    B --> B1[External HDD / NAS]
    B --> B2[Cloud Storage / Tape]

    C --> C1[Cloud Provider]
    C --> C2[Remote Location]

    %% Styling for clarity
    classDef main fill:#1f4e79,color:#ffffff,stroke:#0b2e4a,stroke-width:3px;
    classDef detail fill:#d9eaf7,color:#000000,stroke:#1f4e79,stroke-width:1.5px;

    class A,B,C main;
    class A1,A2,A3,B1,B2,C1,C2 detail;

Incident Response

# 1. Isolate infected system
# 2. Preserve evidence
# 3. Identify ransomware family
# 4. Check for decryptors
# 5. Restore from backups
# 6. NEVER pay the ransom

Ransomware Families

---

Critical Warning

🚫 NEVER PAY THE RANSOM

• ❌ No guarantee files will be restored
• 💰 Funds criminal activities
• 📈 Encourages more attacks
• 🎯 May mark you as a repeat target

---

References

• No More Ransom
• Ransomware Tracker
• CISA Ransomware Guide