Search SenseOn.io
Ransomware is a type of malware (i.e., malicious software) that locks a victim’s device or encrypts their data until they pay a ransom. To regain access or decrypt data, victims require a private key known as a decryptor that is usually only known to the attacker.
Many modern ransomware variants can also exfiltrate data from victims at the same time as denying them access. This capability is known as “double extortion.” It allows cybercriminals to threaten victims with the release of sensitive stolen data unless they pay up. Some cybercrooks may go even further, contacting and blackmailing a victim’s clients or customers with data exposure (i.e., “triple extortion”).
In the past, ransomware posed a threat only to individual devices. Modern ransomware creates risks for entire companies. Commonly used ransomware strains can spread throughout victims’ networks to shared servers, connected devices, drives, and other accessible systems.
Ransomware attacks have crippled health services, shut down local governments, and devastated thousands of companies in sectors ranging from finance to utilities to retail. When faced with a ransom, most businesses pay up. In 2021, 82% of UK business ransomware victims paid a ransom.
Every company that relies on IT systems to function or processes customer and client data is a potential target for a ransomware attack. Avoiding ransomware is virtually impossible, no matter how well protected you think you are.
Following best practices on how to avoid a ransomware infection is not enough to mitigate ransomware risk in 2022. Human-operated ransomware strains can persist in an infected device for weeks or even months. It can be impossible to detect and stop a ransomware threat without powerful telemetry based tools like SenseOn’s automated detection and response platform in place.
The ransomware kill chain consists of five stages:
Ransomware-as-a-Service (RaaS) is a subscription-based business model where ransomware operators rent out already-developed ransomware tools to affiliates. Affiliates usually pay a one-time licensing fee, a flat monthly subscription fee, or share a percentage of their profits with RaaS operators.
Described by the New York Times as a “tightly organised, highly compartmentalised business,” RaaS distributors generally give affiliates 24/7 customer support, feature updates, and access to communities. Some RaaS distributors even provide customers with detailed instructions on how to launch an attack.
Examples of RaaS attacks include the Colonial Pipeline attack (attributed to the RaaS group DarkSide) and the Kaseya ransomware attack (accredited to the REvil RaaS operation).
Also known as human-operated ransomware or hands-on keyboard attacks, targeted ransomware does not spread automatically. Rather, these types of attacks are executed and controlled by skilled cybercriminals.
In a hands-on keyboard attack, threat actors gain access to a business’s IT environment through exploiting network vulnerabilities and use compromised administrator accounts to disable security controls and deploy ransomware.
DoppelPaymer and Ryuk are two commonly encountered strains of human-operated ransomware.
Popular types of ransomware include:
Ransomware is not a new technology. The first-ever case of ransomware was documented in 1989. Back then, the biologist Joseph Popp spread the Trojan AIDS/PC Cyborg virus via 20,000 infected discs titled “AIDS Information Introductory Diskette.”
The ransomware, sent to scientists and researchers in 90 countries, counted how many times a computer was booted, encrypting files in the C:directory when it hit 90. Victims were then told to make a payment to a PO box in Panama.
Up until the early 2010s, ransomware attackers focused on individual devices or users. However, as ransomware technology developed and digital currency made large, anonymous ransom payments possible, ransomware groups began to target corporate networks.
Ransomware’s rise is the result of several developments:
Today, every business, organisation, or public sector body is at risk from ransomware. Size and industry do not matter. That being said, although every organisation is vulnerable, some are still more vulnerable than others.
Here is a shortlist of what makes an organisation most likely to be a target and victim of a ransomware attack:
The consequences of a ransomware attack on a business can be devastating and may include:
Operational downtime. Business disruption from a ransomware attack can result in huge productivity losses, inability to operate critical services, and downstream impacts. After a ransomware attack, more than three-quarters of employees report losing access to networks and systems. A further 26% say they can’t do their job for at least a week.
Damaged reputation. Many customers don’t trust organisations that experienced a data breach. In fact, nearly half of customers say they would stop using a service following a cyber attack.
Financial burden. Between ransom payments, remediation, involuntary downtime, and reputation rebuilding costs, ransomware can have significant financial implications for affected organisations.
Talent loss. Ransomware attacks are sometimes followed by staff layoffs. Almost one-third of organisations are forced to eliminate jobs after an attack. A similar number also lose C-level leadership after a ransomware attack, either due to resignation or dismissal.
Regulatory sanctions. In some jurisdictions, a ransomware victim may also have to pay steep penalties for being hacked. This is one of the reasons why cybercriminals prefer to target companies in the EU. According to one ransomware attacker, organisations in the EU “pay quickly and quietly” to avoid fines under the GDPR.
Intellectual property and customer data loss. A ransomware attack creates a substantial risk that sensitive data, including customer information and intellectual property, will be leaked. Not only can exposure of this data damage the company, but it can also benefit its competitors, who can gain unauthorised access to confidential information, like product designs, strategic plans, and more.
Business closure. Not all organisations hit with ransomware survive being attacked. Research shows that three-quarters of small to mid-sized businesses would have to close shop in the event of a ransomware attack.
New ransomware families and variants emerge all the time. Here are some of the more notable ransomware variants used by threat actors today and in the past.
In May 2017, computers around the world fell victim to Wannacry ransomware. This ransomware exploited vulnerabilities within a retired Microsoft Windows operating system to infect over 230,000 computers worldwide.
Wannacry was spread through EternalBlue; an exploit allegedly developed by the US National Security Agency (NSA), later disclosed by a hacker group called The Shadow Brokers.
Although Microsoft released a patch against the exploit before May 2017, Wannacry was able to hack organisations that did not update their operating systems. Today, updated versions of Wannacry are still a threat — attacks have increased by over 53% since 2021.
Released in 2013, Cryptolocker ransomware targeted business professionals and individuals using Windows computers.
It spread through phishing emails and the Gameover ZeuS botnet. Cryptolocker phishing emails were made to look like customer complaints against the victim’s organisation or a problem with clearing a cheque.
The botnet was taken down in 2014 by a consortium of law enforcement agencies, security software firms, and universities.
First noted “in the wild” in 2018, Ryuk ransomware is one of today’s best-known and most dangerous ransomware variants.
Described by Microsoft as a human-operated ransomware campaign, the Ryuk group uses manual hacking techniques to gain entry and move across the network before encrypting files. The group goes exclusively after large organisations that have the means to pay steep ransoms.
With Ryuk, only critical files are encrypted, making detection more challenging. Ryuk ransomware is usually distributed through Trickbot or Emotet malware.
Currently out of use, the infamous Locky ransomware strain was released in 2016. It was delivered primarily through phishing emails masquerading as invoices that needed to be paid. Locky has been linked to the hacking group Dridex.
This ransomware variant favoured hospitals as its targets. For example, one of its earliest victims was the Hollywood Presbyterian Medical Centre. The centre paid 40 Bitcoin (around £21,000 at the time) for its computer systems to be released.
REvil, aka “Ransomware Evil,” or Sodinokibi, is a notorious RaaS operation. It is known for hacking the world’s largest beef producer JBS Foods as well as the IT service company Kaseya and threatening Apple with the release of stolen product blueprints.
REvil encrypts files and steals data. If a victim refuses to pay a ransom, REvil publishes the stolen information on their leak site “Happy Blog.”
In January 2022, Russian authorities said they dismantled REvil, arresting 14 of its members. However, Bleeping Computer has since reported that REvil’s leak site redirects to a new site that details new victims.
Targeting Microsoft Windows-based systems, Petya is a family of related malware that can encrypt a victim’s entire hard drive, preventing the device from booting. Variants of Petya initially spread through malicious email attachments in 2016.
In 2017, a new variant known as NotPetya led to a global cyber attack. Ukrainian organisations, including newspapers, banks, and electricity firms, were among the first to be hacked but infections were also soon reported in the UK, US, France, Germany, Poland, and Italy.
According to a White House assessment, the attack caused $10 billion (approximately £8 billion) in damages.
Conti is one of the biggest and most prolific ransomware groups, also operating as RaaS. The group behind Ryuk ransomware, Wizard Spider, is also behind Conti.
Like most modern ransomware groups, Conti steals data and encrypts it, threatening victims to publish stolen information on their leak site if a ransom isn’t paid. It also sells access to some of the organisations it has penetrated.
Following Conti’s declaration of support for Russia in the Russia-Ukraine war, the group’s internal chat logs were leaked, giving security professionals an insight into how it operates. Despite the leak, the group is still active.
Based on our experience in helping companies avoid cyber threats, the tips below can reduce your organisation’s exposure to the threat of ransomware.
Phishing emails are among the most common ransomware infection vectors. Unfortunately, employee awareness of social engineering attacks seems to be decreasing. Many workers assume that their organisation automatically filters out all suspicious or dangerous emails.
In response, companies need to train their employees to spot phishing campaigns and use phishing tests to imitate real-life threats.
Businesses should also teach employees how to recognise a ransomware attack in progress and establish a line of communication when an attack is happening.
To restrict ransomware’s ability to spread through the network, companies should give users, accounts, and applications the least amount of network access permissions they need.
Secure, up to date backups are vital for mitigating ransomware risk.
According to a LockBit 2.0 ransomware representative, “the victims who are paying are the ones who do not make backups and poorly protect sensitive information, regardless of the industry.”
Because ransomware attackers will attempt to encrypt backups, too, organisations must keep backups isolated from normal network traffic.
Cybercriminals use weak or stolen credentials to override security controls. Strong authentication can make it harder for attackers to take advantage of compromised passwords.
Most of the vulnerabilities exploited by cybercriminals have been around for years and have vendor patches available. But 71% of security IT professionals think that patching is too time-consuming and complex.
Businesses need to invest in patch management. It’s vital to patch systems as soon as patches become available to minimise potential vulnerabilities. Critical software, like antivirus software and other anti-malware solutions, should be updated regularly on all devices (this includes mobile devices).
According to security researcher Kevin Beaumont, around 25% of ransomware enters through macros. Organisations should therefore ensure staff can’t enable macros.
The longer it takes for organisations to notice suspicious behaviour, the more time malicious actors have to explore corporate networks, steal data, and launch ransomware.
When multiple siloed security tools slow down threat investigation, it’s challenging, if not impossible, for security teams to detect ransomware fast enough.
Technologies like SenseOn that automate detection and response short circuit delays in threat investigation and remediation. By allowing security professionals to prioritise genuine alerts quickly, SenseOn makes it possible to stop ransomware threats before deployment happens.
Security teams that notice suspicious behaviour before ransomware is launched can minimise the effects of the attack — or even stop it altogether.
Automated threat detection and response tools like SenseOn can automatically identify unusual activity in an infected system, issue high-priority alerts in real-time, and even take containment measures against forms of malware like ransomware. SenseOn can do this without human input.
Ransomware victims should first check if they can avail of free decryption tools from “No More Ransom,” a joint initiative between Europol, the cybercrime unit of the Dutch police, and multiple cyber security providers.
Launched in 2016, the project claims to have since saved users about £855 million. It provides 100+ decryptor tools for 150+ ransomware variants.
Through the project’s website, organisations can upload ransom notes and encrypted files to understand the attack better and see if there is a decryptor.
Law enforcement agencies like the Federal Bureau of Investigation (FBI) in the United States and the National Crime Agency (NCA) advise victim’s not to pay a ransom. Giving in to ransom demands encourages future criminal activity and provides cyber crooks with funds for additional attacks.
Nevertheless, many organisations choose to pay a ransom for fear that not doing so would threaten the business’ survival. To some companies, paying a ransom may also make more financial sense than restoring systems from scratch.
But paying a ransom doesn’t guarantee data recovery. Only a tiny fraction of companies that pay a ransom get all of their data back. Most organisations admit that some or all of the retrieved data is corrupted.
Moreover, the vast majority of businesses that pay criminals to regain access to their systems are hacked later, often by the same attackers. This is because once an organisation pays a ransom, cybercriminals see them as a good investment and often leave backdoors into their systems for future use.
Paying a ransom also doesn’t mean that attackers won’t publish stolen data. There have been numerous instances where a business paid a ransom to have their data deleted, only for it to be leaked anyway. In its 2021/2022 report, Group-IB reported a 935% rise in the number of organisations that had their data published on a leak site.
Unlike a decryption key, which can’t be taken away once it’s shared with a company, with stolen data, blackmail never has to end. Often, organisations may not see a second extort attempt coming. The Conti gang shared fake files with victims to prove that they deleted stolen data but later published this data or re-extorted their victims.
SenseOn Reflex offers around-the-clock ransomware protection for organisations ranging from SMBs to enterprises.
Unique on the market, SenseOn integrates security tools like:
By combining security information from an organisation’s entire IT suite into a single platform, SenseOn gives security teams deep visibility into their entire digital estate.
Using a blend of detection methods (“Detections-in-Depth”) — including rules and signatures, supervised and unsupervised machine learning, user and entity behaviour analysts, and detection and deception techniques for threats — SenseOn detects and correlates suspicious behaviour, only issuing alerts when it spots a genuine threat. This dramatically reduces the burden of false positives.
A market leader in stopping ransomware attacks, SenseOn’s automated remediation means that ransomware can be stopped without security personnel’s input. SenseOn can immediately isolate affected devices to ensure that ransomware has no way of spreading across the network.
With SenseOn in place, organisations don’t have to worry about missing signs of ransomware until it’s too late.
Learn why hundreds of organisations choose SenseOn.
“We just put SenseOn in and let it flow. There was minimal time for implementation. Nothing we’ve ever put in has shown value so quickly. We have gone from not having a security team, to having a security team as a result of SenseOn.”
Matt Blee
Cyber Security Manager, Yeo Valley
Read case study
“SenseOn was the toolset we'd been missing. As a small business, we need to have the same level of protection against threats as the big players, but we don't have the budget to employ dedicated security specialists and this is where SenseOn comes in."
Andrew Walles
IT Solutions Architect, Harbottle and Lewis
Read case study
“SenseOn is our most valuable security tool due to its ease of use and ability to detect across the estate. The speed of customer service is a huge benefit – I can use the intercom and within minutes, I have a response and someone helping me build a query or general support where I have a knowledge gap.”
Jim Newman
Senior VP of Information Security, KidsLoop
“We were keen to utilise new and innovative technology to defend our organisation. We spent a lot of time looking at more conventional solutions, but only SenseOn offered the functionality we wanted at a sensible price point.”
Adrian Moore
IT Director, bpha
"SenseOn is what you look for in a partner. They have been amazing to work with and dedicated to the success of Advantage and protecting our business."
Steven Young
VP Information Security
SenseOn was founded on the belief that the cybersecurity industry is broken. Designed by security professionals who have felt the pain of traditional tools, SenseOn’s vision is to remove the burden of mundane, repetitive work so security and IT professionals can enjoy more fulfilling careers by enabling an autonomous, intelligent and secure digital world.
Read moreExplore our collection of eBooks, webinars, articles, and more to help you maximize your understanding of emerging threats, adversary techniques and how to detect cyber attacks.
Visit resource hub
Find out how you can protect your entire organization at the click of a button with our rapidly deployed, lightweight software solution.
Arrange a demo