Ransomware Explained: Inside the Digital Extortion Attack

Ransomware is one of the most dangerous threats in cybersecurity today. These attacks are brutal, costly, and increasingly common. In this video, we're going to explore what ransomware is, how these attacks typically unfold, and what potential victims can do to reduce their risk. Ransomware attacks are surging year after year, inflicting severe damage on victims entire industries, and critical infrastructures. The ripple effects impact millions of downstream users and cost hundreds of billions of dollars globally. But how do we classify ransomware? The terminology in cybersecurity can be confusing, and it often overlaps. Is ransomware an attack, a method of attack, Or the target. Well, ransomware is a type of attack that employs various methods to extort financial resources from a wide range of targets: individuals, small businesses, large corporations, and even governments. Essentially, any organization perceived to have valuable assets is a potential target. In a ransomware attack, the attacker compromises a victim's systems, aiming for financial extortion. This often involves encrypting critical files, rendering them inaccessible, or stealing sensitive data to create data breach scenarios. The end goal is to pressure the victim into paying a ransom. Today, attackers typically demand payment in cryptocurrency because it allows for fast, secure, and pseudo-anonymous transactions. This has only increased ransomware's appeal among cybercriminals. Given the low cost of entry and enormous financial rewards, ransomware continues to grow as a major threat. In fact, it appeals to a broad spectrum of malicious actors. But who exactly is behind these attacks? Ransomware can be deployed by various threat actor groups, each with distinct motivations, objectives, and tactics. Nation-states may use ransomware to disrupt critical systems, Data thieves may use it to cover their tracks and disgruntled insiders might deploy it out of revenge. However, most ransomware attacks are financially motivated. Cyber criminals, including petty criminals, organized crime groups, and even nation-state proxies are focused on extorting money from their victims. While the nuances of the attackers might not matter to victims, they are crucial for cybersecurity professionals. Understanding the different types of threat actors helps experts prevent or minimize the impacts of these attacks. In this discussion, we will focus on the broader category of cybercriminals driven by financial gain who use ransomware as a tool for digital extortion. We start our discussion on what is hopefully a normal day of productive work prior to any undesired activities by cyber threat actors. Now let's introduce the unwelcome guest to the party, the cyber criminal, specifically those cyber criminals who are bent on conducting ransomware attacks. Now, cybercriminals are generally motivated by personal financial gain, and they have targeted our organization. The cybercriminals have a goal and are looking to gain access to valuables. This often includes sensitive data, uh, critical systems or services that they can manipulate to cause disruption as part of their extortion plan. It can also include access that allows them to directly steal the money they're after, in many cases controlled by the finance department. If perceived as advantageous, they may also seek to gain access to downstream partners and customers to whom they can also victimize. As we see here, we have a number of repositories of valuable data and systems. Sensitive intellectual property in R&D and the data centers. We've got private data in finance, HR, operations, and even on endpoints with executives and even with service partners. So we need to think about where all that data may be. And then there's the critical services to keep the business running. And we look towards operations, again, the data center overseen by the admins, which may also then reside, right, this operational data on those endpoints that may be crucial to keeping the operations running. Also in some of these shared systems, we also have to look at the product and services itself. If those can be compromised, well then you've got a great disruption of services. So overall, the attackers have a lot of potential targets to choose from. And attackers don't like to overwork or overcomplicate situations. Often the easiest path is typically the one that is pointing towards the workers. For ransomware attacks, what we see most often is they are initially focused on these workers. Social engineering attacks, that becomes the name of the game. So if we go to the actual attacks, we see that the attackers move towards the workers. And again, these social engineering attacks can manifest in many different ways, but the easiest target is that wetware. It is those people who then have access to these areas. It's simply far easier to manipulate people than it is to undermine technology. Phishing is a great example, and it is a method which targets workers to gain access, is easy, relatively quick, and doesn't require a high level of technical skills. So we often see the beginning part of ransomware attacks take the form of phishing, just as one example of a popular method. And it can be really simple as an email a text message, some social media interaction, or an enticing webpage to go to. Now, social engineering methods often result in the attacker either obtaining sensitive credentials from those being targeted so that they can gain access to internal systems, or the insertion of malware to these workers' systems, which then basically does the same. With initial access achieved, the attacker can begin to move to other systems, services, and departments with various methods, which may include further social engineering, exploitation of technical vulnerabilities, or simply leveraging the access that was initially gained. Regardless, it allows them to move toward targeted areas. Have more places to hide, set up backdoors and data exfiltration paths, and establish measures making eviction difficult and time-consuming. Once access to the targeted areas is achieved, it's time to execute the big plan. Security controls are disabled, data is encrypted, exfiltrated, backups destroyed, and services are severely disrupted. Often this may be the first moment when the victim realizes something is horribly wrong. And the attacker, again, if possible, they may target financial or other electronic assets directly so that they can be stolen or frozen. And we see all this information and data either get encrypted in place or or, and/or exfiltrated out back to the cyber criminal using those exfiltration channels that they've set up previously. And we've seen attackers harvest tremendous, mind-boggling amounts of data, hundreds of gigabytes that get filtered out of the company and into the hands of the cyber criminal. A message or note is often left for the victim to understand, well, who's in control. They also then state the financial extortion demands for data or system recovery, outline a means of private communication to negotiate, provide further instructions for secure payment, and give assurances that if all demands are met, the victim will become whole again and this nightmare will come to a swift end. Often that's really not the case. But at this point, the cyber criminal is exactly where they want to be. So let's take a look at some of the impacts and best practices to see what we can do to protect the environment and what we should be concerned about when it comes to impacts. Let's start with the workers, because again, the workers tend to be that primary target for the cyber criminal, in this case, the ransomware cyber criminal to actually come into the company. We know if those devices are compromised, we, you know, all the data on them, including potential credentials to the rest of the company get exposed. Whatever those workers are happening to have access to and the work that they're conducting is also, you know, compromised. And their productivity and loss tends to go out the window once they're impacted. So how do we protect them? One of the best ways is to have technical controls that oversee their interaction with external accounts, whether that be web access, right, web filtering for web pages, or email filtering for the email messages that come in. There is a vast amount of phishing and spam out there, and having the technical controls really help at scale to knock that down. And you could expect somewhere in the range of 90, 95% for a good security tool to block those, uh, as attackers try and get in. But what that means is you may have 5%, 1 in 20, that does get through. And that really kind of leads to the next thing. You need to have good behavioral training. Security-savvy workers are good at spotting a lot of those bad communications, those malicious communications. And if they're really good, they will then report them to the email administrator, the web administrator, and those administrators can then filter it out for everybody else, perhaps by people who didn't recognize it as potential potentially dangerous. But again, we need to train our employees and workers from day one that this is a real threat and give them instructions and support on how to act and reward them. This should be something that they should be proud of doing to protect themselves, their work, their group, their company. Now, the other thing that's really important here is if the workers are compromised and their credentials are compromised, 'cause they're gonna be used kind of in that next stage as the attackers start moving laterally. So if we have two-factor authentication or even better, multi-factor authentication, this puts up another serious barrier to attackers being able to move laterally. Yeah, they may have access to that individual worker's PC or laptop, but that's a huge difference compared to access to all the laptops and PCs in the company. Right, so if we do have this additional factors, it creates challenges and dilemmas for the cyber criminal. And for each one of those, it slows them down, it forces them to react, and they may make a mistake or they may be detected trying to get over that next barrier. Again, we want to have this, we want to slow them down, we want to give them opportunities of making mistakes and opportunities for the good guys, the security team, to spot them so that they can pounce and lock it down. So again, that's really around the best practices of the worker. You wanna have good technology tools for automation and scale to help identify and block a lot of these types of attacks. You wanna have good behavioral measures, right? Good training, continual training, and rewarding it, whether it's through gamification or bonuses or however you wanna do it, even just a good pat on the back. Can make a massive difference. Recognizing those people and letting them know it's safe. It is safe to report an issue. Even if they make a mistake, they have to feel comfortable that they're just not gonna be fired or yelled at if they accidentally click on a link. Why? Because if they accidentally click on that link and they realize it, you want them to immediately notify cybersecurity and IT so that they can contain the issue. If they're fearful, they will wait. They'll try and conceal it. Either way, the attacker gets more time and that's not what we want. So again, have the behavioral controls to help in a positive way, help them act good to prevent and quickly respond. And then lastly, we wanna have the process tools in place to make sure that this is consistent. Are workers getting trained before they're given internet access? Is there constant refreshers? Are we doing some type of process to make sure that there is a positive experience for workers who are doing the right thing in reporting things or, you know, avoiding, you know, malicious activities or reporting them? So again, best practices hugely important because if you can stop the attacker at this point, at the workers, you greatly minimize, greatly minimize the impacts. In fact, you could argue and say essentially you've probably avoided almost all of the major impacts if you can stop it at the workers. Now from there, right, because we know attackers are going to try and get into systems where very sensitive data is, we need to look and protect R&D, data centers, operations, places like that. And let's start in R&D. And in R&D, we typically have a lot of intellectual property. So if that gets compromised, then your IP, your competitive advantage, potentially could go out the window. So can your time to market. If you've been working on something and you've invested time, energy, and effort, and you've got code or designs or whatnot, and those get encrypted and are no longer available to you, you have to start back at square one. So that's a lot of time and resources— research and development time and resources— that then would have to be replaced. So it's not a good situation. It's even worse if your research and development ends up in the hands of unscrupulous competitors who want to leverage that. And even if they're not going to, uh, use it to make a competitive product, they may just want to know where you are in your development cycle, and that may give them enough competitive intelligence to have a major advantage. So we really need to understand that, yes, it's important in R&D. And when we look at best practices, again, we see the same kind of concepts. We do need to have very enhanced cybersecurity training because this is the crucial data of the company. We wanna have multi-factor authentication, and at a very minimum, Second factor authentication. One of my favorites in this area is also to apply zero trust methodologies. And basically that puts a barrier between workers and their machines and the R&D environments that they may not work in, but somehow still have some potential connective access to. Zero trust really kind of locks that down, puts more authentication barriers, inspects that information. It can be great to prevent access, to identify if something is going wrong or something is unusual, and to lock them out if something bad is detected. So Zero Trust is, is a great technique, especially in R&D. And we'll see this actually in data centers and other areas as well, where you've got very sensitive data that can be tampered with, that can be encrypted, that can be stolen. Zero Trust is definitely one of the, the better methodologies out there. And the other thing here, and this is something that everybody says, oh, well, of course, we want to limit access based on only those people who really need it. And often in R&D over time, people are given access and it's just easy and convenient. Just give them access to everything, right? And when they move on to another role, they never revoke that. Well, they may be asked to help. I, you know, go ahead and keep it with them. That's fine. And it's never cleaned up. And eventually you tend to have environments like Swiss cheese, tons of holes in it, especially from workers that no longer need access. So think about that. And again, we need to have the processes in place to vet that. Should every new intern automatically be granted access to all R&D files? Absolutely not. Same thing probably goes for new regular employees. There needs to be a consistent and comprehensive process that vets that, that puts that into place, that oversees it and audits it to make sure that you do not have extra unneeded access into sensitive areas. And so when we go to the data center, we see a lot of the same things. Now again, the data center tends to house your most important data, from research to potentially personal and sensitive information, and also operational information. So again, if there's any type of sensitivity or criticality, it probably is sitting in your data center. So everything we've talked about is at risk. And again, when we look at some of these things, we need to make sure that not only the data center repositories, but the tools that sit in there are also protected. So for example, the email and web security tools are probably sitting in your data center or they're sitting in a third-party data center and you're buying the services from them. Regardless, you need to fortify that email and web security. You need to make sure you've got filters and alerts. You've got, you know, blacklist potentially areas and sites people can't go to, or maybe you make it a, an exclusive access only, or what they call a whitelist, right? Where you can only go to a list of predetermined websites or email addresses. Regardless of what it is, if you don't use those tools properly, you will not be able to protect at scale. And attackers actually love to take over these tools if the tools themselves are not protected properly because these tools have tremendous access over these systems, over the web and email system. So if they can hijack, hijack these tools, they, it's an open door for them. They can attack whatever they want using these tools. Okay. Another important area here is we need to look at anomaly detection and there's many different ways of doing it, but often those security tools reside in the data center. Same thing for your credentials, your Active Directory or your LDAP or whatever it is, whatever is controlling the credentials, the keys, the certificates in your environment and the ones that you use with your partners are probably in the data center and they are prime targets. So take a look at all the tools, the processes, the credentials, audit those, figure out what you need And again, minimum privileges. We really wanna look at, and especially for IT admins, we don't just want second factor. Let's make it super strong. Let's make it multifactor. And for this environment, if you can, zero trust is also a great thing to add in here. Again, given the fact that you need to have in and out data by just about everybody, and it's tough to predict the changes, that a full-scale zero trust deployment may not be viable for your security goals. It may cost too much. It may be too much friction, but it's worth taking a look at and apply what you can because the data center is the repository of almost all the sensitive data and systems that you're gonna manage. Okay, let's take a look at a few more here. When we look at operations, Again, if the attacker can take down your operations because they can encrypt data or services or corrupt things, they've got you where they want you and they can extort money because, well, you need to have your business back up and running. So production downtime is the number one issue when we talk about operations. There's also worker downtime and user access disruption. There's, there's all sorts of different things that are tied into this., but ultimately it comes down to the availability of your product or service that you need to, to have to get money or run your business. When we look at the best practices, again, let's limit those access based on the roles of the people and keep that updated. Zero trust, a great place to put zero trust is in the operations. Weave that through, section things off, microsegment, um, you know, have checks throughout the process of people trying to access or exfiltrate data. This is just a great place to apply zero trust methodologies. And again, you're gonna have to find the right balance for your environment, but take a look at that. And again, where you can, multifactor, especially in operations. If this is so crucial to your business, then protect it with the best type of authentication you can have for your users, the multifactor authentication. And that may be a combination of password and hardware token, right? That's a great combination that creates a tremendous barrier to attackers. If the attacker is able to compromise your worker and get their username and password, but they don't have the hardware token, it's not the— it doesn't completely stop all attackers, but it definitely stops many of them and it'll slow down even the most pervasive, highly skilled attackers out there. It is something that you want to think about however you want to implement these types of authorization controls. And again, in this space, whoever's doing your operations, they should be very tied in with security. They should be able to raise the alarms. They should understand what the most typical type of attacks will look like in their environment. Because they're there every day and they have the expertise in how things should be operating. Therefore, if something is amiss, they're gonna catch wind of it first, and they should be alerting the cybersecurity team. So extra training for them, one, not to make the mistakes themselves, but two, to help detect and report any issues within their environment— hugely important. Okay, couple of other areas here. When we look at third parties, and again, there's so many different things that you can use a third party for. You may be using them for your payroll. You may be using them to cut checks, you know, to vendors or suppliers. And again, if those get compromised, well, they could just, you know, the attacker could just cut themselves checks. They can commit fraud. Your email system might be going through them. You may actually have your own data center out up into the cloud. And again, all of these things, everything applies because depending on what sensitive data or services or systems they have, you have to protect them. So everything we've talked about is absolutely true, but we're gonna add a few more. One, you wanna make sure that you've got a good business continuity and disaster recovery plan. And we wanna be able to audit and test that on a regular basis because yes, Everywhere you've got a critical area, whether it's operations, data center, third-party services, whatnot, you want to know that if it does go down, that you can bring it back up quick— quickly. And if you have limited access, let's say your email or your telephones or things like that are unavailable, you have workarounds already in place that you can still maneuver quickly to get yourself back up and running, your operations restored, the critical data that you need back in place and that you can move forward. And that's something that the cyber criminal, the ransomware cyber criminal, does not want you to be able to do. In fact, they will go out of their way to try and destroy your backups. So again, you need to be auditing that. You need to be able to understand, okay, what happens if they delete last week's backups? Can I actually get to the weeks before? What happens if my vendor goes down? Do I have a backup vendor? There's tons of things, but you need to have a good plan. Now let's jump over here to finance, and we touched on it a little bit when we talked about kind of accounts payable and things of that sort. Your finance has direct control over financial assets. So if the attackers can shortcut this whole process and directly get access to those assets, they're definitely going to try. They, if they can cut themselves a check or do a financial transfer, they're going to. Now, with most traditional money transfer and banking controls, there is a natural delay, but you have to be able to identify something happened and then notify the banks, notify the financial centers so they can stop payment. On those kinds of, of transfers. And in most cases, it can work very well. When we have now the introduction of cryptocurrency and decentralized finance, a lot of those transactions can happen without those third parties that oversee it. And so there's no one really to report it to. Those transactions happen almost instantaneously. So you could automatically lose a tremendous amount of money if you are using those types of solutions. They have their pros, but this is one of the cons that that speed and reliability, well, that can work for the attacker. So yes, you can use, you can lose financial assets. You can get data that's compromised. And again, you may have sensitive data, how much your employees or executives make, what you're paying on contracts, things of that sort that you don't want exposed. And paying your bills on time is really important. So if the attacker compromises this data and locks it all up, you won't know who to pay, how to pay, or how much to pay. And you may not even have access to the systems to do the payments or receive payments. What are our best practices here? Again, we wanna make sure that we've got backups, we've got plans and crisis plans to be able to initiate those, test those, audit those. We do want to encrypt sensitive data if we can. Not all data in finance or HR is, which is another good example. Do you need access all the time, every single day? Some of the data you only need once a month, right? Or maybe even once every few years. You may just be required to keep data for 7 or 10 years for tax purposes, but you're not actually accessing it. You should be encrypting that data. Right? You don't want the attackers to be able to go in there, grab that, and have that data that they can then extort and say, if you don't pay us money, we're gonna make this public. Right? So keep the data encrypted if you can, and make sure that you have the ability to be able to go in and restore those systems in a timely manner to get back up and running from a business perspective. The last area I wanna talk about, there's other things that we can look at too. We can look at sales and marketing. Yes, sales and marketing data actually gets taken and compromised and encrypted. Same thing with customer service, CEO, uh, and board and executive leadership. A dirty little secret here is when cyber criminals get in and get access to the email system, one of the first things that they do is they go in and they harvest all the emails from the executives, and they want to understand, are there juicy or embarrassing emails that would motivate an executive simply to pay the extortion to keep their dirty laundry out of the public. And they may also look for communications about future mergers or acquisitions or business deals or contracts negotiations. Again, all of that, it's normally kept confidential within the business realm for competitive reasons or even contractual reasons. And if they can get a hold of that and threaten to expose that, that is a big motivator. So again, all the things that we've talked about before, right? We want to be able to have good training by the executive leadership. We want to be able to fortify their systems and their training and their knowledge. We want to have a good ransomware risk plan with them because they are key. If ransomware hits, they are very important. And if there's no plan, there's no crisis team, often the executives who don't know much about response, cyber attack response, they tend to jump in and start making rash decisions. So again, have a good plan so that they don't have to do it. Have a good team that's trained, even if it's an external vendor, right? They will do drills, they will be trained, they will keep contact information up to date. Very, very important. Uh, the other thing that you may want to consider is to buy cyber insurance. Now, I don't advocate this to cover everything, and that way you don't have to have any security and you don't have to have any crisis team. No, that's not what cyber insurance is for. Insurance is for those extraordinarily rare events that hopefully never happen, like a car accident or a flood or an earthquake or your house burning down. The same thing with cyber insurance. We're not insuring the common things, and cyber attacks are very, very, very common. We don't insure, you know, the fact that ransomware attack may happen again. That's very common. We want to ensure the instances where our up-leveled security controls, our prevention, our detection, our response, all of that works well, but for some reason doesn't prevent all the loss in those rare instances, and therefore we need to fall back on cyber insurance. But it is an option, you know, take a look at that. The executives really need to make that decision. Okay, one, one last thing here. One of the other areas cybercriminals sometimes pursue is to go after your products and go after the customers that are using your products. And this is really part of a supply chain attack. And we can see this even with ransomware. A company that's providing a product or service gets hit. The cybercriminals then compromise the product or service and go downstream to attack those customers, right? And this is very embarrassing, obviously, for the initial company that's attacked. It impacts your reputation, it impacts your product, it impacts your service. You lose customers, market share, valuation. It's just horrible. So when we see things like this, we want to make sure that whatever that product or service infrastructure is, there is a failsafe architecture in place and that there is a plan to fail, to recover, to restore, to be able to get things back into proper working order in case an attacker comes in and disrupts that product or that service. And in many cases, it's really around updating or patches. So we advocate that, yes, you need to have a full-blown strategy and a technical and business process architectures to support proper updates, proper patches, which means you have to be aware that there are vulnerabilities. You have to be engaging the industry and the security researchers to help figure out what those are. If they apply to you, then you have to have the time and effort to be able to, to validate that it is relevant and develop fixes so that you can close that vulnerability. And if ever an exploit is created, then you need to figure out how do I clean up if a victim is exploited. Once you have the patch or the cleanup, you have to figure out, okay, how do I get it deployed out to end users without disrupting them or overly disrupting them? And in many cases, that requires you working with them. So all of these impacts and best practices, very important to understand. Um, I would advocate that you go out to this website. I'll put the website in the very bottom link here so you can go out and click and play around and see see how these happen. But at the end of the day, we need to understand ransomware is a vicious attack, especially when it's successful. It causes all sorts of harm. The impacts are off the charts. And risk management really needs to be in-depth, seeking to prevent that initial access, right? If we can do that, that is the very, very best thing. If we can stop them from getting to the workers, which is the number one kind of attack, that really helps. We need to then limit or disrupt their ability for lateral movement and exfiltration while also enabling rapid recovery without the need to pay the extortion. A strong understanding of how this ransomware attacks, how these attacks occur, can help improve your security planning, operations, and crisis management. Thanks for watching. Again, thanks to VizTech for their use of this interactive site. I'll put a link in the description so you can visit and explore this interactive tool for ransomware attacks. If you enjoyed this discussion, please like and consider subscribing to the Cybersecurity Insights channel for more content. I'm Matthew Rosenquist. Be safe and secure.