July 13, 2017 By Archana Chimankar 2 min read

We all remember the devastating WannaCry ransomware attack that struck organizations around the world in May 2017. The attack spread at a rate of almost 3,600 computers per hour, or about one per second. When all was said and done, the ransomware infected more than 300,000 devices.

Many victims simply paid the ransom to retrieve their locked files. This only encourages the threat actors and does not guarantee safe return of the stolen data. A better strategy is to avoid attacks such as WannaCry in the first place by applying patches and keeping all software and operating systems up to date. Of course, security leaders should also implore users to create strong and complex passwords, use multifactor authentication, back up critical data and avoid clicking suspicious links received via email, SMS or social media.

These security best practices can help limit the threat of ransomware, but what if there were a one-stop solution that could enable analysts to discover the root cause of an attack?

The Bitcoin Buck Stops Here

The key is bitcoin. Most ransomware operators demand payment in the digital currency. WannaCry, for example, collected more than $93,000 worth of bitcoin. Due to the anonymous nature of bitcoin, transactions are largely outside the jurisdiction of security teams and law enforcement agencies.

There is another side of the proverbial coin, however. Bitcoin conversions are processed on a decentralized register called a blockchain, which is transparent and traceable. Since all operations performed and records stored are visible to everyone, security analysts can use blockchain technology to track bitcoin transactions back to the root cause and threat actors behind a ransomware attack.

Blockchain also creates hurdles for cybercriminals. To use extorted bitcoins, fraudsters must transfer them to a third-party address, possibly a bitcoin register or wallet, where service providers process a flat currency exchange. These suppliers can identify bitcoin addresses associated with ransomware campaigns and quickly notify cybersecurity specialists.

Blockchain Is Worth the Investment

Of course, cybercriminals will likely develop programs to make it harder for analysts to trace bitcoin transactions, but increased investment in blockchain technology can help organizations stay one step ahead.

In the event of a widespread ransomware attack such as WannaCry, the financial burden of tracing the blockchain is inversely proportional to the damage inflicted upon individual victims and affected organizations. So what are you waiting for? Start using the transparency of blockchain technology to identify ransomware threats today.

Watch the IBM Think Academy video to learn more about blockchain

More from Fraud Protection

Unveiling the latest banking trojan threats in LATAM

9 min read - This post was made possible through the research contributions of Amir Gendler.In our most recent research in the Latin American (LATAM) region, we at IBM Security Lab have observed a surge in campaigns linked with malicious Chrome extensions. These campaigns primarily target Latin America, with a particular emphasis on its financial institutions.In this blog post, we’ll shed light on the group responsible for disseminating this campaign. We’ll delve into the method of web injects and Man in the Browser, and…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today