ABSTRACT Ransomware attacks are evolving and becoming more and more complicated. This guide will review the current state of ransomware to help you understand how companies are profiled for attacks, what you RANSOMWARE can do to prevent an attack, and what to do if you become a victim. Limit the Risk Table of Contents About Peters & Associates ........................................................................................................................ 2 Who we are ............................................................................................................................................. 2 About the Author ...................................................................................................................................... 2 Contact Us ................................................................................................................................................. 2 Introduction ................................................................................................................................................. 3 What is Ransomware? ................................................................................................................................ 4 How is Ransomware Spread? ................................................................................................................ 4 Characteristics of Ransomware ............................................................................................................. 6 Features of Ransomware ....................................................................................................................... 6 Top Known Types of Ransomware and What They Do3 ........................................................................ 7 Payments for Ransomware ........................................................................................................................ 9 Should you pay the ransom? ................................................................................................................ 9 What are the benefits of paying? ......................................................................................................... 9 What are the risks? ................................................................................................................................. 9 Didn’t have a good restore copy and have to pay the ransom? ...................................................... 9 What Do Hackers Want from Me? ......................................................................................................... 10 The Evolution of Cybercrimes ............................................................................................................. 11 Ransom Negotiation ............................................................................................................................ 11 The Focus ............................................................................................................................................... 11 New Targets and Threats ..................................................................................................................... 11 Latest Ransomware – March 2017 ..................................................................................................... 13 Prevention .................................................................................................................................................. 15 Infected with Ransomware – Next Steps ............................................................................................... 19 Don’t have a good backup file? .......................................................................................................... 19 Testimonials about our Support Services .......................................................................................... 21 Not sure where to start? ...................................................................................................................... 22 References ................................................................................................................................................. 23 Peters.com Ransomware Guide – Limit the Risk 1 | Page About Peters & Associates Who we are The key to solving problems is to listen closely and ask the right questions. At Peters & Associates, we listen first. We’ve been successfully partnering with our clients this way for over three decades - solving challenges and building bridges to a better future with secure, scalable IT solutions aligned with your business needs and goals. Our resources are skilled and certified in network, systems, and cloud services, including: CompTIA A+/Network/Server, VMWare Certified (VCP), Apple (ACTS), MCP, MCPD, MCSE, MCSA, MCTS, ACCP, CCNA, CCDA, CIOSSS, CQFS, CVPNS, CCP, CCNP, CCA, MCDBA, MCTTP- DBA, NTSP, NSA, CISM, CISA, CRISC, ITIL, and NIST. About the Author Galaxia Martin is the Director of Support Services responsible for support and security services operations within the support desk. Galaxia has worked in the IT industry for over 15 years in financial, accounting, and software development businesses. She has designed and led organizational innovations as well as optimized and increased growth within support operations. She understands the complexity of business operations and has experience with aligning business initiatives with cost reduction solutions. As an Information Technology expert, Galaxia continues to research and study the latest technology, cyber risks, and industry trends to help educate her clients. Galaxia has a Master’s degree in Information Systems with additional studies in marketing and arts. Contact Us Peters & Associates 1801 S. Meyers Rd., Suite 120 Oakbrook Terrace, IL 60181 630.832.0075 Ι www.peters.com For more information: [email protected] Peters.com Ransomware Guide – Limit the Risk 2 | Page Introduction Ransomware is not going away and, in fact, is changing day by day, hour by hour, and minute by minute. What can you do to avoid the risk? There are several methods, actions, and opinions on proactive measures you can take, but the reality is that it is not if you will be affected, but when. Imagine that you live in an area where natural disasters are common; there are specific activities you would do to prepare for that specific type of disaster, right? It’s the same when we (as good cybercrime fighters) tell you the types of risks out there and what methods can help you reduce your risk. It’s all about being prepared. You have something valuable to cybercriminals - we all do. Cybercrime is no longer just about putting skimmers on ATMs or trying to steal your mail from your mailbox. It has literally gone “pro,” meaning cybercriminals are using more sophisticated technology to get your data. The internet has gone wild in terms of cybercrime, so we all must take responsibility to protect ourselves against it on a regular basis. This Ransomware Guide will help you understand what ransomware is, how to protect yourself, and the trends that are occurring. Remember this is a guide - not an end-all-be-all to ending ransomware. The fact is that ransomware will evolve and so will our methods to prevent it. So, let’s get started on learning more about the present state of ransomware and how we can help you become a rock star cybercriminal fighter! Peters.com Ransomware Guide – Limit the Risk 3 | Page What is Ransomware? Ransomware is a form of cyberattack used to obtain your data and gain payment. There are a few more common types or families that we will share with you in this guide. Ransomware predominantly uses the AES algorithm to encrypt files, though some use alternative methods as well. The standard ransomware rate is $500 per incident, but that is expected to double or triple as many organizations keep paying the demands. How is Ransomware Spread? Ransomware is spread through the distribution of malicious files. Typically, this is done through social engineering, and studies have shown that about 42.6% is done through email. Most people assume that hackers are specifically targeting their company’s data for something like WikiLeaks. This is NOT the focus for most hackers - the main reason they want access to your environment is to lock down your data and have you pay them ransom money. 1 Peters.com Ransomware Guide – Limit the Risk 4 | Page The most common ways a hacker can access your network are the following:2 1. Phishing – good old social engineering at its best The most common way to access your network is through your employees, and hackers are getting smarter about how to target them. Some are using common tools like LinkedIn to connect and then send them hyperlinks to malicious websites, while others are still using standard phishing emails. The new trend for these attacks is encrypted emails. Cybercriminals can send an encrypted message that appears to be from a legitimate contact (they do their research) and when your employee unencrypts it the malicious activity begins. 2. Buffer Overflow Another way to access your network is through your website forms. Yes, they can basically hack your website forms to steal data, cause damage, or access your network. 3. Password Hacking Still using default passwords for your computer, modem, or Wi-Fi router? Well, sorry to tell you the hackers can get them. Most of the default passwords for any hardware are available to even the most amateur of hackers. So make sure you change your default passwords