Ransomware is Harder to Block

Posted by Trevagh Stankard on Tue, Feb 9th, 2021

Most cyber-attacks are financially motivated, which makes ransomware a valuable tool for attackers. Ransomware authors continually change code and create new variants that mutate according to the latest anti-malware trends. A ransomware’s ability to avoid detection is one of the most important components of successful authors, which means that it’s getting harder to block attacks and stop the malware from infecting desktops and servers.

Attackers Now Targeting VPNs

Virtual private networks (VPNs) are meant to allow users to stay anonymous, but any compromise can be used to manipulate traffic and data to either intercept it or send users to a malicious website. For ransomware attackers, a compromised VPN can be used in a phishing attack. The user can be redirected to an official-looking website where a user will be tricked into submitting information or downloading malware.

In a malware attack, users redirected to an attacker-controlled server might think that they are opening an official page, but instead it’s a page meant to trick users into downloading malware. Users think the page is a trustworthy business, but it’s a phishing page. For large VPN services, this could give attackers access to thousands of potential victims that connect to the virtual private network.

Phishing and ransomware often go together, but recent research has shown that most ransomware authors are going for a more targeted approach to finding victims. This means that spear-phishing attacks are more popular. Although these attacks take much more time and reconnaissance to collect data on a potential target, the payout can be much bigger when the attacker can inject malware on a targeted business network. In a business-level attack, the ransomware can scan several resources and hold them ransom for a high payout.

Ransomware as a Service (RaaS)

Most people are familiar with the man “as a service” offerings in the cloud, but ransomware has its own service. Ransomware-as-a-Service (RaaS) allows anyone to rent a central dashboard where attackers can automate emails, review currently ransomed files, and send information to targeted users.

The RaaS servers available for rent are another way for malware authors to monetize their software. Instead of directly attacking targeted businesses, ransomware authors can lease their work to attackers who will pay a monthly fee to have ransomware and several automation tools at their fingertips.

Many of the initial components in a ransomware attack are tedious. The attacker must collect data and determine the right email recipients. Many of these tasks can be automated so that a collection of email recipients and messages can be less time consuming. This leaves the attacker available to manage ransom fees and collection of currently infected targets.

With the right RaaS, attackers can also target bigger businesses. Ransomware began as a cyber-criminal anonymous method to blackmail individuals into paying several hundred dollars to an attacker in exchange for the private key to decrypt their files. Individuals usually don’t have backups or the cyber-defenses to stop ransomware from scanning the network and encrypting files.

Instead of targeting several individuals for small amounts, ransomware attackers have turned to bigger payouts but targeting businesses. It’s harder to run ransomware on a business network as many businesses have enterprise-level anti-malware defenses along with employee training to detect phishing, but encrypting files on a vulnerable business network has far more revenue potential than individuals. For large businesses, a ransomware attacker might ask for six figure payouts in exchange for the private keys to decrypt files.

Attackers also take much more time researching targeted businesses to ensure that they can get the right payout. The goal is to ask for a ransom high enough to make it worth the effort but low enough so that the business can afford it. If the business cannot afford the ransom, then the attacker wastes their time. It’s important for targeted attacks that the ransom matches the targeted business’ ability to pay it. See what could happen if a company pays a ransomware fee.

Anti-Phishing Protection is More Important Than Ever

The first step in most ransomware attacks is a phishing email. This means that businesses should take the necessary steps to protect their infrastructure. Using email cybersecurity, the business stops these malicious messages from reaching the target recipient. Whether the attacker uses general phishing attacks or targets users with spear-phishing, the business must have the right cybersecurity on their email servers to protect recipients.

As ransomware authors find new ways to spread malware, phishing remains the primary method for tricking users into installing the malware. With the right email cybersecurity, no matter the new ransomware variant, cyber-criminals will not be able to inbox their malicious messages.

SpamTitan is a multi-award-winning email protection, spam filtering, and email filtering solution. Start your free trial for SpamTitan today to discover how we can prevent malware attacks. Start Free Trial