Awareness on ‘Ransomware’ Threat

Through this information security advisory, we intend to educate you about the prevailing threat of “Ransomware” and the precautions you need to take in order to prevent / mitigate such threats.

What is Ransomware?

Ransomware is a type of malware that cybercriminals use to deny you access to your computer, programs or files until you pay a ransom. It typically propagates like a conventional computer virus /worm, entering system through, for example downloaded malicious file, malicious email attachment, visiting compromised websites or using network / system vulnerability etc.  The variants of ransomware discovered so far can be categorized into the following two categories:

(i)                  Encrypting Ransomware

(ii)                Non-Encrypting Ransomware

(i)              Encrypting Ransomware: Once unleashed, this type of ransonware encrypts all files (typically document files) on the disk as well as accessible network folders.  Documents so encrypted are unusable unless decrypted with a unique decryption key held by the attackers.  The malware author is the only party that knows about needed private decryption key. It is important to mention here that no other tools / software could be used to recover data encrypted by Ransomware. 

The sample message displayed by one such ransomware variant named Cryptolocker 2.0  is mentioned below:

Note:  Even if malware infection is successfully cleaned from the system for such type of ransomware, the files encrypted by it could not be recovered.   Paying the ransom also doesn’t guarantee successful recovery.

(ii)               Non-encrypting Ransomware : This kind of ransomware are usually less dangerous than the “encrypting ransomware”. Once unleashed, it usually locks the screen / functionality of the system by displaying a ransom note. One of such ransomware family variant named Winlock, restricted access to system by  displaying pornographic images and asked victims to send premium rate service SMS (costing US$10) to receive a code that could be used to unlock their machines.

Other variants used messages from law enforcement agency stating that your computer was found to be involved in illegal online activities and if you want to avoid legal proceedings against you then you will have to pay fine. The fine amount usually ranges from 250 - 1000 USD. The screenshot of one such message is mentioned below:

How money is collected from the victims through Ransomware schemes?

The extortion money is collected using different means by different ransomware variants. The common means include telling victims:

· To send SMS or call premium rate numbers in order get “unlock” code.

· To buy certain amount of Drugs from some online drug store.

· To wire transfer money in some bank account or through western union.

· To buy an online payment voucher from online services such as Ukash and PaysafeCard.

· To pay through digital currency like “Bitcoins”.

How can you protect yourself from Ransomware?

· Be careful with email messages - Be wary and skeptical of unsolicited email that demands immediate action even from well-known and reputable companies or government agencies, including well-designed but counterfeit invoices and failed courier delivery notices or claims of illegal activity.

· Don’t click on links or attachments in email from unfamiliar sources or that seem suspicious—call the source to confirm authenticity.

· Make sure that the corporate anti-malware is installed on your computer and it gets updated regularly.

· Do not download pirated / cracked software and key generators from internet as it may contain malware.

· Disable macros / active x controls in your MS office applications and never enable them unless there is reasonable business justification to do this.

· All important documents and files must be backed up on a regular, ongoing basis. Should ransomware render documents unusable in an unfortunate circumstance, the documents can then be recovered from a pre-infection backup copy. Backup media must be kept offline and it is recommended to keep multiple backup sets.

· We need to make sure that the operating system (OS) and other third party applications running on our computer system get patched / updated automatically against known security vulnerabilities