What is ransomware? Everything you need to know and how to reduce your risk

Ransomware is one of the biggest cybersecurity problems on the internet and one of the biggest forms of cybercrime that organizations face today. Ransomware is a form of malicious software -- malware -- that encrypts files and documents on anything from a single PC all the way up to an entire network, including servers. 

While ransomware has exploded in recent years, it's not a new phenomenon: the first instance of what we now know as ransomware appeared as early as 1989.

Ransomware is always evolving, with new variants continually appearing and posing new threats to businesses. However, certain types of ransomware have been much more successful than others.

• North Korea's WannaCry was utilized in one of the biggest ransomware attacks to date. In 2017, the ransomware caused chaos across the globe, with more than 300,000 victims in over 150 countries falling victim. 
• Locky was once the most notorious form of ransomware, creating havoc within organizations worldwide throughout 2016, spread via phishing emails. 
• One of the most prolific families of ransomware during 2021 was REvil, responsible for encrypting the networks of a large number of high-profile organizations.
  
• Conti, like REvil, combines encrypting networks with threats to publish data in order to extort ransom payments. The US Cybersecurity and Infrastructure Security Agency (CISA) is among those that have issued warnings about prolific Conti ransomware attacks, which are ongoing and have even claimed healthcare services and hospitals among their victims.
  
• Cerber was once popular as one of the first 'Ransomware-as-a-Service' (RaaS) models, allowing users without technical know-how to conduct attacks in exchange for some of the profits going back to the original authors. 
  

Ransomware comes in many variations, but at its heart, ransomware is designed to lock you out of your system and revoke access to files. Some ransomware will be able to move laterally across networks, encrypt data -- or destroy it -- and may also include surveillance modules. 

• Dish Network: A February attack against broadcast giant Dish Network led to service outages and the exposure of data belonging to roughly 300,000 people. The company reportedly may have paid out a ransom, as a letter sent to impacted individuals revealed the company "received confirmation that the extracted data has been deleted."
• Royal Mail: The UK's Royal Mail delivery service received an $80 million ransom demand following an attack in January that severely disrupted deliveries, nationally and abroad. Company officials refused to pay. 
• Caesars: Casino operator Caesars suffered a ransomware attack and data breach, including the theft of customer data. Reports suggest that the firm paid out roughly half of a $30 million ransomware demand. 
• MGM Resorts: The attackers behind a chaotic ransomware attack against MGM Resorts -- which forced many services offline, including point-of-sale systems -- claimed they managed to obtain the credentials necessary to perform the assault with only a phone call. Everything from casino slot machines to hotel room cards stopped functioning. 

Obviously, the most immediate cost associated with becoming infected with ransomware -- if it's paid -- is the ransom demand, which can depend on the type of ransomware or the size of your organization.

Ransomware attacks can vary in size but it's becoming increasingly common for hacking gangs to demand millions of dollars to restore access to the network. And the reason hacking gangs can demand this much money is, put simply, because many victims will pay.

That's especially the case if a network being locked with ransomware means the organization can't do business -- it could lose large amounts of revenue for each day, perhaps each hour, the network is unavailable. This downtime can quickly add up to millions of dollars in losses.

Also: Faced with likelihood of ransomware attacks, businesses still choosing to pay up

If an organization chooses not to pay the ransom, not only will it lose revenue for a period of time that could last weeks, perhaps months, but it will also have to pay a large sum for a security company to come in and restore access to the network, and there may also be costly legal repercussions. 

Whichever way the organization deals with a ransomware attack, the incident also will have a financial impact going forward, because to protect against falling victim again, the organization will need to invest in its security infrastructure and handle legal costs, potential class action lawsuits, and regulatory fines.

On top of all of this, there's also the risk of customers losing trust in the organization because of poor cybersecurity, with clients taking their business elsewhere.

Paying the ransom is discouraged by cybersecurity and law enforcement because it encourages cyber criminals to continue to launch ransomware campaigns. There are even instances where a victim has paid a ransom, only for the same attackers to return with another attack and demand another ransom payment.

To date, the largest ransomware payout to date was made by CNA Financial, one of the top US insurance providers. The organization reportedly paid out $40 million after falling victim to a ransomware attack.

To put it simply: Ransomware can destroy your business. Being locked out of your own files by malware for even just a day will impact your revenue. But given that ransomware takes most victims offline for at least a week, or sometimes months, the losses can be significant. Systems can remain offline for so long, not simply because ransomware locks the system, but because of all the time and effort required to clean up and restore networks.

And it isn't just the immediate financial hit of ransomware that will damage a business; consumers become wary of giving their data to companies they believe to be insecure.

Also: Ransomware and phishing attacks continue to plague these businesses

Cybercriminals have learned that not only just businesses make lucrative targets for ransomware attacks, but important infrastructures like hospitals and industrial facilities are being disrupted by ransomware. And such disruptions can have big consequences for people. 

The education sector also has become an increasingly popular target for ransomware campaigns. Schools and universities became reliant on remote learning due to the coronavirus pandemic -- and cybercriminals noticed. These education networks are used by potentially thousands of people, many using their personal devices, and all it might take for a malicious hacker to gain access to the network is one successful phishing email or cracking the password of one account.

Small and medium-sized businesses are a popular target because they tend to have poorer cybersecurity than large organizations. Despite that, many SMBs falsely believe they're too small to be targeted --but even a modest ransom of a few hundred dollars is still highly profitable for cybercriminals.

Smaller businesses, and low-hanging fruit, can also make tempting targets because supply chain attacks can provide access to a larger, more lucrative target. 

There's one key reason why ransomware has boomed: because it works. All it takes for ransomware to gain entry to your network is for one user to slip up and launch a malicious email attachment, a weak password to be cracked, or a business leaving vulnerable software unpatched. 

If organizations weren't giving in to ransom demands, criminals would move on to something else. 

Also: Microsoft: We are tracking these 100 active ransomware gangs using 50 types of malware

Meanwhile, for criminals, it's an easy way to make money. Why spend time and effort developing complex code or generating fake credit cards from stolen bank details if ransomware can result in instant payments with little chance of prosecution afterward?

Cyber insurance is a policy designed to help protect organizations from the fallout of cyberattacks. 

Some cyber insurance policies will cover paying the ransom itself -- leading some cybersecurity experts to warn that cyber-insurance payouts covering the cost of paying ransoms are adding to the problem, because cyber criminals know that if they hit the right target, they'll get paid. 

In the first half of 2023, Coalition found that cyber-insurance claim increases were driven by ransomware, with a 12% year-on-year increase. 

Also: SMBs don't see need for cyber insurance since they won't experience security incidents

However, an increase in claims -- and the potentially high cost of paying out -- has prompted some cyber-insurance providers to exclude ransomware attacks from policies.  

The rise of cryptocurrencies like Bitcoin has made it easy for cybercriminals to receive payments with less risk of the authorities being able to identify and trace the perpetrators.

Digital wallets are used to store cryptocurrency and -- while not untraceable -- this makes it more difficult to track and seize illegal funds -- especially if the crypto funds are mixed and filtered out through multiple wallets and cryptocurrency exchanges. 

Because large numbers of ransomware attacks start with hackers exploiting insecure internet-facing ports and remote desktop protocols, one of the key things an organization can do to prevent itself from falling victim is to ensure that ports aren't exposed to the internet when they don't need to be.

When remote ports are necessary, organizations should ensure that login credentials are complex. Applying multi-factor authentication to these accounts also can act as a barrier to attacks, as there will be an alert if any attempt is made at unauthorized access.

Networks should be patched with the latest security updates because many forms of ransomware – and other malware – are spread via the use of common, known vulnerabilities.

When it comes to stopping attacks via email, managers should provide employees with training on how to spot suspicious emails. Employees noticing unusual details -- say, an email with sloppy formatting, or a message purporting to be from 'Microsoft Security' sent from an obscure address that doesn't even contain the word Microsoft -- might save networks from infection. 

Also: 6 simple cybersecurity rules you can apply now

There's also something to be said for enabling employees to learn from making mistakes while within a safe environment and through phishing training exercises. 

On a technical level, stopping employees from being able to enable macros is a big step toward ensuring that they can't unwittingly run a ransomware file. Endpoint protection, alongside firewalls and behavioral anomaly detection solutions, also can help.

At the very least, employers should invest in antivirus software and keep it up to date, so that it can warn users about potentially malicious files. Backing up important files and making sure those files can't be compromised during an attack is also key because that makes it possible to recover the network without paying a ransom.

But even if attacks are already inside the network, it isn't too late – if information security teams can spot unusual or suspicious activity before the ransomware attack is launched, it's possible to reduce the scope of the attack or prevent it altogether.

Simply put, ransomware can cripple a whole organization --an encrypted network is more or less useless and not much can be done until systems are restored.

If a business has backups in place, systems can be back online in the time it takes the network to be restored to functionality, although depending on the size of the company, that could range from a few hours to days.

However, while it's possible to regain functionality in the short term, it can sometimes take months for organizations to get all their systems back up and running.

Also: The top cloud storage services

Outside of the immediate impact ransomware can have on a network, the incident can result in an ongoing financial hit. Any period of time offline is bad for a business as it ultimately means the organization can't provide the service it sets out to, and can't make money. But the longer the system is offline, the bigger that hit can be.

And that's assuming your customers want to continue doing business with you: In some sectors, the fact that you've fallen victim to a cyberattack could drive customers away.

The 'No More Ransom' initiative -- launched in July 2016 by Europol and the Dutch National Police in collaboration with a number of cybersecurity companies -- offers free decryption tools for ransomware variants to help victims retrieve their encrypted data without succumbing to the will of cyber extortionists. 

Available in dozens of languages, and now offering numerous ransomware decryption tools, the program is regularly adding more tools for new ransomware variants. 

Also: Cybersecurity 101: Everything on how to protect your privacy and stay safe online

Individual security companies also regularly release decryption tools to counter the ongoing evolution of ransomware – many of these will post updates about these tools on their company blogs as soon as they've cracked the code.

Another way of working around a ransomware infection is to ensure your organization regularly backs up data offline. It might take some time to transfer the backup files onto a new machine, but if a computer is infected and you have backups, it's possible to isolate that unit and then get on with your business. Just make sure that cybercriminals aren't able to encrypt your backups, too.

There are those who advise victims to simply pay the ransom, citing it to be the quickest and easiest way to retrieve their encrypted data. And many organizations do pay, even if law enforcement agencies warn against it.

But be warned: If word gets out that your organization is an easy target for cybercriminals because it paid a ransom, you could find yourself the target of other cybercriminals looking to take advantage of your weak security. And remember that you're dealing with criminals here and their very nature means they may not keep their word: There's no guarantee you'll ever get the decryption key, even if they have it. Decryption isn't even always possible.

Absolutely. Ransomware attacks against Android devices have increased massively, as cybercriminals realize that many people aren't aware that smartphones can be attacked and the contents (often more personal than the stuff we keep on PCs) can be encrypted for ransom by malicious code. Various forms of Android ransomware have emerged to plague mobile users.

In fact, any internet-connected device is a potential target for ransomware.

The Internet of Things already has a poor reputation for security. As more and more of these connected devices make their way onto the market, they're going to provide billions of new attack vectors for cybercriminals, potentially allowing hackers to hold your connected home or connected car hostage. An encrypted file is one thing, but what about finding a ransom note displayed on your smart refrigerator or your car's dashboard?

Also: The best smart home devices, tested and reviewed

There's even the potential that hackers could infect medical devices, putting lives directly at risk.

As ransomware continues to evolve, it's crucial your employees understand the threat it poses, and that organizations do everything possible to avoid infection, because ransomware can be crippling and decryption is not always an option.