Ransomware 101

By

Justin Quintero-Franco and Alexa Senott, Intern Analysts

By

Access Point Consulting

Ransomware is a type of malware that blocks access to data until a ransom payment is made. It is distributed through malicious code that users unwittingly download and execute. Ransomware typically encrypts a user’s files, deletes backup copies, and disables security defenses. Its unfortunate victims typically receive a ransom note demanding payment in the form of cryptocurrency along with threats for non-compliance with their demands.

How Do Ransomware Attacks Occur?

Phishing: Ransomware is often delivered through phishing emails containing links or attachments. Attackers use social engineering techniques to convince users to click on malicious links and attachments to download and execute malware.

Compromised Websites / Advertisement Downloads: Downloads from illegitimate websites contain fake software or application updates that carry ransomware. Advertisements on legitimate sites can redirect users to these malicious websites.

Unsuspecting Employees: Employees may unintentionally download ransomware from phishing emails or illegitimate websites.

Outdated Software: Attackers can exploit vulnerabilities in outdated software, devices, and applications to push ransomware to victims.

Risks to Organizations

Financial Impact: Ransomware impacts organizations financially through the substantial costs of restoring systems and files, hiring cybersecurity experts, or paying the ransom.

Reputational Damage: Data breaches compromise an organization’s reputation. Customers lose trust in companies that fail to protect their sensitive information.

Business Operation Disruptions: Ransomware can disrupt normal business operations and cause significant downtime by locking access to critical business systems and data.

Data Loss: Permanent loss of critical information can occur if an organization does not maintain proper backups of it or those backups cannot be restored.

Legal Consequences: Legal repercussions and penalties may accrue if data protected under privacy laws is leaked.

How Organizations Should Respond to Ransomware Incidents

Isolate the Infected Systems: Infected devices should be disconnected and isolated from the rest of the organization’s systems to prevent the spread of the ransomware.

Assess the Damage: Systems, devices, and files potentially affected by the ransomware should be examined and the damage evaluated.

Do Not Pay the Ransom: It is best to avoid paying ransom as it doesn’t guarantee file recovery. Attackers may leave backdoors to strike again and may use the ransom payment to fund other criminal activities.

Report to the Authorities and Seek Professional Help: Report the incident to law authorities. Consider bringing in cybersecurity professionals to provide a recovery strategy and guidance on how to secure your business operations.

Restore Systems: If data backups are available, use them to restore encrypted files once the ransomware has been removed.

Strengthen Security Posture: Assess your organization’s current security posture by identifying and prioritizing any vulnerabilities in your systems. Implement the highest value updates to safeguard your business going forward.

Ransomware Detection and Prevention

Incident Response Plans: Organizations should implement a clear incident response plan that pairs with their business continuity and post-incident recovery plans.

Training: Implementing employee training on ransomware can help safeguard the organization. Ensuring employees are cautious and aware when online gives you an extra layer of protection.

Monitor Logs: Keep a lookout for anything abnormal in your logs. Time is crucial; the sooner you identify a problem, the faster you can respond.

Security Measures: Install the patches needed to protect your organization’s systems. This includes ensuring all operating systems, software, and applications are up-to-date with their latest security fixes.

Data Backups and Recovery: Regularly back up your systems and test restoration to ensure that you can successfully recover a malware-free version of your data. Backups should be encrypted to protect against potential data theft.

Resources

CyberWatch

February 5, 2025

Helen Patton (Cisco) | Crafting an effective cybersecurity strategy

Cybersecurity is often seen as a reactive field, constantly responding to threats as they emerge. But Helen Patton, Cybersecurity Executive Advisor at Cisco, argues that a well-defined cybersecurity strategy can shift the focus to a proactive approach—one that aligns security efforts with broader business objectives.

Find out more
January 29, 2025

Ricoh Danielson (Vitrix Health) | Building a security culture and embracing AI

Being a CISO has never been easy, and 2025 doesn't promise to make it any easier. What you need to know to begin and to succeed in the job. Today we're talking with Ricoh Danielson. Ricoh is the CISO at Virtix Health. He has a wealth of experience as a CISO, as a cybersecurity expert, and as someone in demand for his knowledge of risk and cybersecurity around the world. We talked to him about what the job of CISO is in 2025, what you need to know if you're moving into the role and, most important, what you need to know to succeed as a CISO this year and for the coming years.

Find out more
November 22, 2024

Patch Updates, New Malware Threats, and the Ongoing Supply Chain Battle

On this episode of the CyberWatch podcast, there are updates to software across the application and OS spectrum. New malicious campaigns are threatening victims of all sizes, and researchers have performed dissections on malware to give defenders new clues about just what it is they're fighting. All this today, in CyberWatch.

Find out more