These steps are a of course good security practices in general, so following them improves your defenses from all sorts of attacks: There are a number of defensive steps you can take to prevent ransomware infection. Law firms and other organizations with sensitive data may be willing to pay to keep news of a compromise quiet - and these organizations may be uniquely sensitive to leakware attacks.īut don't feel like you're safe if you don't fit these categories: as we noted, some ransomware spreads automatically and indiscriminately across the internet.

For instance, government agencies or medical facilities often need immediate access to their files. On the other hand, some organizations are tempting targets because they seem more likely to pay a ransom quickly. Sometimes it's a matter of opportunity: for instance, attackers might target universities because they tend to have smaller security teams and a disparate user base that does a lot of file sharing, making it easier to penetrate their defenses. There are several different ways attackers choose the organizations they target with ransomware. But because finding and extracting such information is a very tricky proposition for attackers, encryption ransomware is by far the most common type.

There is also a variation, called leakware or doxware, in which the attacker threatens to publicize sensitive data on the victim's hard drive unless a ransom is paid.

But most attacks don't bother with this pretense. In some forms of malware, the attacker might claim to be a law enforcement agency shutting down the victim's computer due to the presence of pornography or pirated software on it, and demanding the payment of a 'fine,' perhaps to make victims less likely to report the attack to authorities. The user is presented with a message explaining that their files are now are now inaccessible and will only be decrypted if the victim sends an untraceable Bitcoin payment to the attacker. But the most important thing to know is that at the end of the process, the files cannot be decrypted without a mathematical key known only by the attacker.

If you want the technical details, the Infosec Institute has a great in-depth look at how several flavors of ransomware encrypt files. There are several things the malware might do once it’s taken over the victim's computer, but by far the most common action is to encrypt some or all of the user's files.

Crypto locker virus