Ransomware Attacks: What It Is, How It Works & Prevention Strategies

Ransomware Attacks: What It Is, How It Works & Prevention Strategies

Ransomware attack is a grave cybercrime threat in the UK and reports of data security breaches including the aforementioned experienced by various organizations are duly maintained by the Information Commissioner’s Office (ICO). According to The National Cyber Security Centre, ransomware is a financially motivated crime, largely committed by cyber criminals. In fact, the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) treat ransomware as a risk to the UK's National security. Financial inducement is what propels ransomware attacks and with more organizations storing valuable data, the latter easily becomes a prime target for extortion.

Table of Content

• What is Ransomware
• How does Ransomware work
• Impact of Ransomware on Cyber Safety
• Instances of Real-World Ransomware Attacks
• How to Prevent Ransomware Attacks

What Is Ransomware?

Ransomware is a type of malicious software (“i.e. malware”) that infects the computer systems of victims. According to the Home office, “It can prevent the victim from accessing the system or data, impair the use of the system or data and or facilitate theft of data held on the victim’s networked systems or devices”. Furthermore, a ransom is demanded and payment is generally effected via cryptocurrency by the victim in order to regain access to the system so that data can be restored or to prevent it from being published/leaked on any website controlled by the cybercriminal(s).

Ransomware can also be used to attack individuals using their home computers and other personal devices. Systems and networks of major companies and public bodies are not left out. According to Chainalysis, in 2023 ransomware criminals received more than $1 billion from their victims globally. Home office also reported ”In 2023 incidents of ransomware attacks reported to the Information Commissioner’s Office reached their highest level since 2019, and private sector reporting to the National Crime Agency indicates that the number of UK victims appearing on ransomware data leak sites has doubled since 2022. Home Office polling shows that nearly three-quarters (74%) of the public are aware and concerned about the threat of ransomware occurring in the UK.”

How Does Ransomware Work?

Ransomware does not work in isolation, it needs access to your network in order to be effective and that’s why cyber criminals carry out whatever means necessary to gain access to the same. Once that has been done, they establish control and plant malicious software that is encrypted. Then comes activation of the malware, which automatically locks devices and causes the data across the network to be encrypted, meaning you can no longer access it.

Panic mode is activated from your end and of course a demand is then made. You’ll receive an on-screen notification from the cybercriminal, explaining what the ransom issue is, how much you need to pay and how to make payment before you can regain access to your data or for your computer to be unlocked. Payment is usually effected in cryptocurrency and to prevent future re-occurrence of a ransomware attack, it is important to first decipher how the cybercriminal gained access to your network and then take the necessary safety precautions.

Effect of Ransomware On Cyber Safety

The effect of a ransomware attack can erode the confidence individuals and businesses have in conducting activities online. According to a research by RUSI “interviews with victims and incident reporters have highlighted the wide range of the damage caused by ransomware attacks, including physical, financial, reputational, psychological, and social harms”. Disruption of services, and even outright closure of the business evidenced in cancellation of services and appointments through-out the period the issue exists alongside the financial cost of battling to resolve the issue can be overwhelming.

Post resolution of the issue can see a hike in cost of products and services. Apart from making financial gains from the ransom that has been paid, criminals can sell the data on an online marketplace or use the same for nefarious activities such as carrying out identity theft, creating false accounts, and even breaking a password or username recovery process all in a bid to take control of your bank account.

Instances of Real-World Ransomware Attacks

NHS WannaCry Attack (2017)

In May 2017, the WannaCry ransomware infected approximately 200,000 computers across 150 countries, with more than 60 trusts in the United Kingdom’s National Health Service (NHS) taking a big hit. This cyberattack ended up costing the UK £92 million and £6 billion on a global scale. Roger Collier in his article NHS ransomware attack spreads worldwide stated “Although the NHS does not appear to have been specifically targeted by whoever is behind the WannaCry ransomware, it was vulnerable to attack because some of its Windows operating systems are more than 15 years old and were no longer updated or supported by Microsoft…the party behind the WannaCry virus demanded US$300 in bitcoin to unlock each affected computer, with a doubling of the charge after three days, and the threat of all data being lost if payment was not received within a week.”

In fact, Microsoft had prior to the attack issued a security bulletin, declaring that patches had been released for all existing windows versions at that time. The Department of Health had even been warned about the risks of cyber-attacks on the NHS a year before the attack. According to the NHS access to certain networks had to be closed to protect their network which led to the disabling of ambulance handover process and screens, unavailability of patient transport service booking portal, inability to transfer CT/MR scans and transfer Chemo orders to their provider. Furthermore, automated transfer of blood results failed and certain GPs couldn’t access their case load. Marcus Hutchins was credited for halting the ransomware attack when he accidentally triggered a kill switch.

What lessons were learnt from this attack? It unveiled the importance of carrying out timely security patching, the need for network segmentation in the healthcare environment, the value of always having offline backup systems and of course the Importance of having a plan to respond to incidence relating to essential services.

Colonial Pipeline Attack (2021)

Colonial Pipeline in the United States was one of the largest and crucial oil pipelines spanning more than 5,500 miles delivering refined oil for gasoline, jet fuel and oil for home heating. The hackers known as Dark Side, first stole 100 gigabytes of data before proceeding to infect the Colonial Pipeline IT network with ransomware. The result? Many of its computer systems were affected. Dark Side had gained access through a compromised VPN password that lacked multi-factor authentication. It led to the shutting down of pipeline operations for six days as a precautionary measure, which triggered an increase in fuel price, panic buying across the Eastern part of the United States due to fuel shortage with some flights being cancelled.

Colonial Pipeline paid 75bitcoin worth $4.4 million in cryptocurrency ransom (although 63.7 bitcoin, that’s an estimated $2.3 million, was later recovered by the Department of Justice). What lessons can be learnt? Simply, that multi-factor authentication is still important for all remote access points, you shouldn’t undermine the importance of isolating operational technology from corporate networks and the need to have detailed plans to protect very important infrastructure.

How to Prevent Ransomware Attacks

These are the strategies you can adopt whether as an individual or company to prevent ransomware attacks: Firstly, back up data using the 3-2-1 rule, i.e. have three copies of data that are important to you, then use two different storage media (e.g., local drive and cloud storage) and lastly have one copy stored offline. Deploy best back up practices by scheduling automated daily backup of critical systems and data, store backups on separate networks or air-gapped systems, frequently test backup restoration procedures to ensure they work, implement versioning to maintain multiple backup copies over time, use cloud backup services with ransomware protection features and keep offline backups disconnected from your network.

Secondly, conduct training programs for your employees which should include how to Identify suspicious e-mails via the use of urgent language, unknown attachments and unknown senders. They must learn how to confirm the authenticity of the sender through alternative communication channels and immediately report suspicious emails to the IT department.

Thirdly, engage in safe practices such as not downloading software from untrusted sources, avoid clicking on suspicious links or pop-up advertisements, use strong, unique passwords with multi-factor authentication, and immediately report anything strange happening on the system. Security updates should be carried out and escalation procedures for security incidents when they occur should be provided.

Fourthly, ensure regular software updates are carried out since cybercriminals frequently exploit known vulnerabilities in outdated software. So, keep all software applications current with latest versions, remove unused or outdated software that could present vulnerabilities, use enterprise patch management tools for large organizations and maintain updated antivirus and anti-malware solutions. Also carry out operating system updates by enabling automatic security updates for all devices, maintain an inventory of all systems and their patch status, prioritize critical security patches within 48 hours of release, and test patches in a controlled environment before fully deploying. Additionally, regularly update firmware on routers, firewalls, and network devices, monitor vendor security advisories for critical updates and Implement vulnerability scanning to identify potential weaknesses.

Fifthly, use Multi-Factor Authentication (MFA) for all user accounts, especially administrative access, use authenticator apps or hardware tokens rather than SMS when possible and require MFA for remote access and cloud services. Also segment Network by separating critical systems from general network traffic, Isolate backup systems from production networks, Implement zero-trust network architecture principles and monitor network traffic for unusual patterns. In all, ransomware attacks are disruptive, financially gulping and a threat to not just individuals, businesses but even to National security. Businesses and individuals can take preventative steps to protect data from ransomware attacks. At Titans Careers, we provide a comprehensive Cyber Security course led by our expert tutor that will empower you with the knowledge to prevent and deal with cyber threats in the course of carrying out personal or company’s activities.