How Ransomware Works and Why It's a Hacker Favorite

If it seems like ransomware attacks are making headlines more these days than ever before, you may be surprised to know it’s not just in your head.

Ransomware attacks really are increasing exponentially. Unfortunately, several factors in recent years have worked together to make ransomware attacks more prevalent than ever. The three main factors? The pandemic, the rise in cryptocurrencies—and simply because ransomware attacks are so successful.

What Is Ransomware?

Let’s start with the basics. We asked a few members of our ThreatOps team to help us define ransomware:

Ransomware is a type of malware that encrypts data—often critical business data—thereby preventing access. Victims are then forced to pay attackers for a decryption key to regain access to their files.

Look no further than recent news headlines for examples of recent ransomware attacks.

For example, you may recall hearing about the Colonial Pipeline attack back in May 2021. With just one set of credentials, the cybercriminal group DarkSide was able to unleash a ransomware attack, demanding $4.4M in Bitcoin—which Colonial Pipeline ultimately paid to get their operations back up and running.

This attack was eye-opening because it meshed the cyber world and the real world together, proving that just a few skillful clicks and taps can lead to complete societal disruption. In this case, that disruption was public panic and a shortage of gas along the East Coast of the United States.

How Cybercriminals Coordinate Ransomware Attacks

One of the most prominent ways that cybercriminals prepare to launch ransomware attacks is through phishing.

Phishing, much like its homonym fishing, is all about using the right bait to lure your prey. For instance, an attacker may pose as a trusted business and send a legitimate-looking email to try to convince someone to download an attachment—which contains malicious code, unbeknownst to the victim. If the victim downloads the file and runs it, the threat actor could gain the ability to access their data—or even encrypt it as part of a ransomware attack.

The scary truth about phishing is it just takes one victim to bring down a network. If one person in your environment clicks a phishing link or downloads a malicious attachment, your whole network may be compromised. Cybersecurity education is the key to ensuring that the folks in your organization understand how to spot—and avoid—phishing attacks.

Want to learn more about how phishing attacks can enable ransomware attacks? Watch our on-demand webinar with Vade.

Other ways that attackers prime their victims for a ransomware attack include exploiting vulnerabilities, drive-by downloads and purchasing access to environments on the dark web.

The Perfect Storm

Earlier, we alluded to the three main factors that have helped ransomware attacks become more popular. Let’s dive into those.

1. The pandemic

First up is the pandemic. Suddenly, everyone working from the safe “castle walls” that corporate networks provide shifted to working remotely. As people began working from their own devices and networks, the doors swung open for eager threat actors to make their move and attack unsecured environments. 

2. Cryptocurrencies

The second factor: cryptocurrencies. Cryptocurrency is inherently the perfect getaway car for hackers. It’s as anonymous as it is permanent—meaning you can’t get funds back unless the recipient allows you to. And finally, it lacks oversight from banks and governments, making it that much more appealing to perform shady activity with this form of currency.

3. Effectiveness

And the last factor that explains the recent increase in ransomware attacks is perhaps the most obvious: because they work.

The primary goal that a threat actor has when deploying a ransomware attack is to make money. They encrypt your data and hold a decryption key hostage until you pay the amount they demand. Some cybercriminals may even export your data in a move known as data exfiltration, threatening to release your data to the public unless you pay up. This attack is known as double extortion.

Of course, the FBI recommends never paying a ransom. Paying a ransom only rewards bad behavior. But here’s the thing—that advice makes logical sense until it’s your business that’s fallen victim. When it’s your business and your customers’ sensitive data up for grabs, the lines between how to and not to react become blurred. As a result, many people end up paying the ransom.

And that’s what hackers are banking on.

They’ve watched from the sidelines as organizations have dished out millions of dollars in whichever cryptocurrency was demanded of them to get their data back safely. Seeing these scenarios have encouraged other bad actors to launch their own ransomware attacks. And—unfortunately—the cycle continues.

How to Prevent Ransomware Attacks

Cybersecurity education and taking preventive measures are two of the main ways that you can stay vigilant against ransomware attacks. The Cybersecurity and Infrastructure Security Agency (CISA) also has a few recommendations.

1. Update and patch your computer frequently. Attackers are always ready to exploit vulnerabilities that exist. Keeping your computer updated and patched can help protect against these attacks.

2. Adopt a Zero Trust mindset. Reverse yesterday’s mindset of “trust, then verify” by getting on offense and verifying first. Always double-check attachments and links before clicking on them.

3. Always check to make sure your connections to websites are secure. In the URL bar of your browser, always look for the s in https. That will ensure that any data you submit to the website is encrypted when you hit enter.

4. Stay up-to-date on cybersecurity best practices. Knowledge is power in cybersecurity. Follow the advice of security experts—and be willing to evolve and adapt with the threat landscape.

Want to take a more in-depth look at ransomware? Check out our comprehensive ransomware guide.