Ransomware Attacks Will Not Stop Anytime Soon

Ransomware, one of the most popular current attack vectors, occurs when an attacker uses malware to encrypt data and then asks for money to decrypt it. This attack type doesn’t seem to be slowing down; in fact, it’s expected to gain more popularity this year, according to PhishMe.

What Makes Ransomware a Flourishing Market?

The FBI said it received more than 2,400 complaints about ransomware last year, costing the victims over $25 million dollars. CryptoWall, TeslaCrypt and Locky are the most popular versions of this malware, and to date, the safest way to get your data back is by paying ransoms.

PhishMe projected more new ransomware in the upcoming weeks since it is a promising and easy market for cybercriminals all over the world. That’s because users are still extremely susceptible to phishing attacks, pop-ups and malicious links, pictures and flash banners. Users are often clicking without paying attention or without knowing the link’s source and destination.

Antivirus Is Not the Answer

Many software companies advertise solutions for ransomware, but the success rate is not totally satisfying. These solutions often work by maintaining a huge database of digital signatures of known viruses. When a scanned file matches a known malware, it will be quarantined and deleted.

This approach can protect your computer against well-known malware but won’t help when a virus is too new to be stored in the digital signatures database. Not only that, but some ransomware encrypt their own source code or modify it constantly, making detection much harder for antivirus software.

The Good News

The good news is that most types of ransomware are not self-propagating on a network, meaning that even if you got infected by clicking the wrong link or downloading the wrong file, it will only infect your computer and won’t spread to others connected to the network.

To avoid infection, here are actionable ideas to start with:

Make sure to back up your data now before it’s too late! Act fast — don’t wait for something to happen.
Always be aware of threats and think twice before clicking on a suspicious link.
Make sure your antivirus solution is up to date.

Download the complete Ransomware Response Guide

Ayoub Bahar

Security Expert & Client Technical Professional, IBM

Strela Stealer: Today’s invoice is tomorrow’s phish

12 min read - As of November 2024, IBM X-Force has tracked ongoing Hive0145 campaigns delivering Strela Stealer malware to victims throughout Europe - primarily Spain, Germany and Ukraine. The phishing emails used in these campaigns are real invoice notifications, which have been stolen through previously exfiltrated email credentials. Strela Stealer is designed to extract user credentials stored in Microsoft Outlook and Mozilla Thunderbird. During the past 18 months, the group tested various techniques to enhance its operation's effectiveness. Hive0145 is likely to be…

Hive0147 serving juicy Picanha with a side of Mekotio

17 min read - IBM X-Force tracks multiple threat actors operating within the flourishing Latin American (LATAM) threat landscape. X-Force has observed Hive0147 to be one of the most active threat groups operating in the region, targeting employee inboxes at scale, with a primary focus on phishing and malware distribution. After a 3-month break, Hive0147 returned in July with even larger campaign volumes, and the debut of a new malicious downloader X-Force named "Picanha,” likely under continued development, deploying the Mekotio banking trojan. Hive0147…

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed ITG05…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

What Makes Ransomware a Flourishing Market?

Antivirus Is Not the Answer

The Good News

More from Malware

Strela Stealer: Today’s invoice is tomorrow’s phish

Hive0147 serving juicy Picanha with a side of Mekotio

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

Topic updates