By David Bloxberg and Helen C.

There are many types of cyber-attack, but ransomware attacks make-up 10% of all security breaches in 2024.  A ransomware attack can be devastating to a business with the consequences reverberating through businesses for months, even years. In 2023, organisations around the world detected a staggering 317.59 million ransomware attack attempts and the UK had the second highest number of targeted ransomware attacks at over 71 million. With figures like that, it is an important topic to understand and discuss.

What is a ransomware attack?

Ransomware is a type of malware that is used by cyber criminals which prevents the rightful user from being able to access their own data. Kicking the user out by encrypting data, the criminal holds the rightful owner of the data to ransom  to gain access to their data again. Often, the ransom comes with a deadline and the sums of money asked for can be crippling to individuals and businesses alike. This type of attack poses a daunting prospect, and is a threat that should be taken seriously. 

Is this a cyber-threat my business should worry about?

Ransomware, now exacerbated by the advancement of technology using Artificial Intelligence, (AI), stands as a critical threat in the modern digital environment. It impacts individuals, corporations, and governmental bodies globally. This sophisticated malware is engineered to breach computer networks and encrypt files, databases, and even entire systems by denying access to legitimate users. The involvement of AI in ransomware attacks serves to escalate the complexity and efficiency of recovering from this type of breach.

How serious is a ransomware attack?

Some ransomware has become increasingly sophisticated, making them increasingly difficult to prevent and counteract. Using a diverse range of infective malwares including phishing emails and malicious attachments and through the exploitation of security vulnerabilities, ransomware attacks are a brutal breach of your cyber security. The aftermath of a ransomware attack can be catastrophic, leading to critical data breach, substantial financial losses, and severe reputational damage.

As ransomware evolves, it becomes imperative for organizations and individuals to prioritize preventive measures, such as regular data backups, software updates, and comprehensive security training to mitigate the risks of these harmful cyberattacks. Being aware of the process of a ransomware attack is crucial to understanding why prevention is the best option for your business.

Stages of a Ransomware Attack: From Infiltration to Recovery

Understanding the various stages of a ransomware attack is crucial for prevention and effective response.

1: Initial Infiltration Stage: Before encryption, the ransomware must first access the system. This often occurs through phishing emails, by exploiting software vulnerabilities, or malicious downloads. Understanding the initial infiltration stage is crucial as this is the point where you can still stop the attack.

2: Installation Stage: After infiltration, the ransomware installs itself on the system. During this phase, it may also attempt to spread to other connected systems or networks, increasing its impact.

3: Data Harvesting Stage: Some advanced ransomware variants may extract sensitive data from the infected system before encrypting it. This stage adds a layer of complexity as attackers can threaten data leaks and encryption.

4: Lockdown Stage: Post-encryption, some ransomware variants display a ransom note or lock the user’s screen, making it evident that an attack has occurred and providing instructions for payment.

5: Communication Stage: If the victim engages, this stage involves communication between the attacker and victim, usually anonymously, about payment and decryption. This stage is emotionally draining for the victim and leads to a serious dilemma – pay and communicate or don’t.

6: Disclaimer and decision stage: Choosing to pay the ransom offers no data recovery guarantee. In the UK, the National Cyber Security Centre (NCSC) note that law enforcement services do not endorse this choice as it can lead to further attacks, means you are funding cyber-crime and data recovery is not guaranteed. It might encourage further criminal activities, and refusing to pay can lead to permanent data loss or public exposure of sensitive information.

7: Decryption Stage (Conditional): If the ransom is paid and the attacker is willing to provide a decryption key, this stage involves decrypting the locked files. This task alone can be technically challenging, and your computer is likely to still be infected with the malware.

8: Post-Attack Analysis and Recovery Stage: This stage consists of assessing the damage, removing the ransomware, restoring data from backups if available, and implementing measures to prevent future attacks. This stage occurs whether you choose to pay the ransom or not.

9: Reporting and Legal Follow-Up Stage: In cases where people are put at high risk there is a regulatory requirement to report the attack to the Information Commissioners Office (ICO).  The NCSC should also be informed as they will be able to provide support and incident response to help mitigate the impacts, while also learning cyber security lessons to help other businesses in the future.

The Financial Impact of Ransomware

The financial repercussions of ransomware in 2023 were profound and widespread, significantly impacting businesses and economies. With 59% of businesses affected by ransomware globally and the cost of a ransomware attack increasing by 500%  from $400,000 to $2 million this year alone, a ransomware attack can financially cripple a business.

This substantial increase in incidents signifies a growing boldness and sophistication amongst the cybercriminals orchestrating these attacks. Cyber security has never been so important. The need for adequate ransomware protection is critical for all businesses, not just large organizations. Ransomware poses a significant threat to small and medium-sized enterprises (SMEs).

Specific industries have been disproportionately affected by ransomware, with the healthcare sector being a notable example. This critical industry has suffered losses exceeding $7.8 billion due to operational downtime caused by ransomware attacks. Such figures underscore the sector’s vulnerability and the severe consequences that ransomware can have on essential services and patient care.

Case Study: The impact of ransomware on the NHS

In May 2017, WannaCry ransomware, a type of ransomware known as cryptoworm, infected computers running the Microsoft Windows Operating System. Spreading autonomously between computers, encrypting data and demanding Bitcoin ransoms, this attack exploited a vulnerability called Eternal Blue, impacting over 200,00 computers across 150 countries.

The NHS was severely affected with more than a third of trusts impacted and at least 6,900 appointments cancelled. It is the largest cyber-attack of it’s kind against the NHS to date, but a National Audit Office Report found the attack was preventable. WannaCry’s massive reach highlighted the importance of timely software updates and raised global awareness about the dangers of ransomware.

How to Protect Against Ransomware

Protecting against ransomware, a pervasive and evolving cyber threat, requires a multi-layered security approach. This sophisticated malware, designed to encrypt files and demand a ransom for their release, can cause significant damage to individuals and organizations alike. Here are key steps you can take to strengthen your defences against ransomware attacks:

1. Security Software: Install and regularly update reputable antivirus and anti-malware software with ransomware detection capabilities. These tools offer ransomware protection and stop ransomware from infecting your system in the first place.

1. Regular Backups: Maintain regular backups of all critical data and store them offline or in a separate network. This ensures that in the event of a ransomware attack, you can restore data without paying a ransom.

1. Endpoint Security Protection: Utilize advanced endpoint security solutions to monitor and protect all endpoints on your network, including workstations, servers, and mobile devices. These systems use behaviour-based analysis to detect unusual activities, potentially stopping malware before it can execute or spread. Adequate endpoint protection helps seal potential gaps where malware might infiltrate, offering another critical layer of defence against ransomware attacks.

1. Access Controls: Implement strict access controls and use the principle of least privilege. Users should only have access to the data and resources necessary for their roles. This limits the spread of ransomware if an attack occurs.

1. Software Updates: Keep all software, including operating systems and applications, up to date. Cybercriminals exploit software vulnerabilities to launch ransomware attacks, and regular patching minimizes these vulnerabilities.

1. Email Vigilance: Be cautious of unsolicited emails, especially those containing links or attachments. Phishing emails are a common threat vector for ransomware. Educate users to recognize and report suspicious emails.

1. Security Awareness Training: Regularly train employees on cybersecurity best practices, including recognizing phishing attempts, proper internet usage, and the importance of regular software updates.

By adopting these proactive measures, individuals and organizations can significantly reduce their vulnerability to ransomware attacks, mitigating potential damage and ensuring the continuity of operations. This kind of security breach is not easily fixed and the damage it causes to businesses reverberates through the operations for a long time after the initial attack, data loss and ransom request.

If you would like more guidance on this subject or if you need ransomware protection, why not contact us to find out how the team here at Cirrus can help to defend your business against the threat of ransomware.