Defending against ransomware

Ransomware is a growing cybersecurity threat affecting a large share of organizations, with significant financial impact and a troubling rate of victims paying ransoms. It creates business harm through a combination of prevention costs, potential data loss, and productivity disruption. Because the damage is typically already done once users see a ransom note, the strongest stance is to prioritize prevention and layered defense rather than relying on recovery alone, and to avoid paying ransoms that perpetuate the broader cybercrime cycle.

Three main ransomware varieties are described. Scareware uses alarming pop-ups that claim infection and pressure users into paying for “tech support” through a phone number or link. Screenlockers deny access to the system, sometimes by imitating a “Blue Screen of Death.” Encrypting ransomware is the most severe, as it encrypts user data files and is described as nearly impossible to decrypt afterward; even providing payment details does not ensure systems or data will be restored.

Common delivery pathways include phishing emails carrying malicious attachments or links to infected sites, Office document macros, and drive-by downloads including malvertising (infected ads). Recommended defenses emphasize user security training (including third-party anti-phishing training), disabling Office macros by default (locally and in Office 365) with strict enablement guidance, and edge network filtering via appliances or proxies that scan web/email traffic, strip malicious attachments, and block access to dangerous sites and ads, supported by real-time threat intelligence updates. Endpoint security should move beyond signature-based antivirus toward behavioral/heuristic detection, least-privilege enforcement, application whitelisting, and rapid automated patching. Finally, robust backups must include endpoints (not just servers), and organizations should maintain automated “sterilize and restore” procedures to rapidly reimage systems and restore applications and user data.

• Over 61% of organizations were hit with ransomware attacks last year.
• One-third of ransomware victims paid the ransom.
• Ransomware cost businesses over $1 billion in 2016.
• Ransomware has three major varieties: scareware, screenlockers, and encrypting ransomware.
• Scareware commonly uses pop-ups that claim infection and direct victims to paid “tech support” via a phone number or link.
• Screenlockers can deny access to the entire operating system.
• A common screenlocker variant emulates the “Blue Screen of Death.”
• Encrypting ransomware encrypts user data files and is described as nearly impossible to decrypt afterward.
• Ransomware is commonly delivered through phishing attachments, phishing links, Office macros, and drive-by downloads including malvertising.
• Paying with a credit card does not guarantee restoration of access to files and systems.

• “Defense is the best option.”
• “Once users see the ransom notes, the damage has usually been done.”
• “Signature-based anti-virus has become largely ineffective, with polymorphic malware able to change the characteristics of malicious payloads to evade detection.”
• “Enterprises are usually very good at backing up server-based repositories, but sometimes miss data on desktops and laptops.”
• “Reduce the attack surface by ensuring that vulnerabilities within OSes and applications are mitigated as quickly as possible with rapid and automatic patching.”
• “Implement endpoint security packages that use heuristic/behavioral analysis techniques to look for and quarantine suspicious code, e.g. code that calls encryption libraries.”
• “Enforce least privilege for users and deny malware access to advanced OS functions.”
• “Prevent malware from using common desktop applications to perform Just-in-Time malware assembly and encryption.”
• “To decrease downtime in cases where ransomware attacks have succeeded, have automated procedures available to quickly flatten and reload operating systems and users’ applications, as well as user data.”