What is Ransomware?
Ransomware is a type of malware that prevents or limits users from accessing their system, either by locking the system’s screen or by locking the users’ files (TrendMicro, 2022). It encrypts files on a device, rendering any files and the systems that rely on them unusable. The attackers demand a ransom payment in order to decrypt the files and restore access (CISA, 2022).
Ransomware typically spreads through phishing emails containing malicious attachments or links. If the user opens the attachment or clicks the link, the ransomware installer is downloaded onto their system. It then encrypts files and displays a ransom payment demand. The ransom note often includes instructions for paying the ransom and sometimes a deadline, after which the ransom amount increases or files may be deleted permanently (Checkpoint, 2022).
The purpose of ransomware is to extort money from victims by blocking access to their own data. Attackers request payment in cryptocurrency, such as Bitcoin, which is difficult to trace. Paying the ransom does not guarantee files will be recovered.
Activation Timeframes
Ransomware can activate immediately upon infection, or it may lay dormant for a period of time before activating. The timeframe depends on the goals and techniques of the attackers.
Immediate activation is more likely if the attackers’ main objective is a quick payoff. Ransomware like Ryuk and Conti often activate within minutes to hours of infection to encrypt files and demand ransom payment 1. Immediate activation maximizes damage and limits opportunity for detection.
Delayed activation is more strategic. Attackers may lurk in the victim’s network unseen for weeks or months to learn the environment, infiltrate backups, and maximize damage potential 2. The dormancy period also allows them to infect other connected networks before activating the ransomware simultaneously across all victims.
Typical activation periods can range from under an hour to several months after initial infection. But most ransomware activates within 1-3 days according to security firms 3. The longer attackers lurk, the more damage they can inflict.
Immediate Activation
Some types of ransomware are designed to activate and start encrypting files before they can be detected. This makes them extremely dangerous, as it severely limits the victim’s ability to stop the encryption process once it has begun (Short Incident Response Playbook for Ransomware).
With immediate activation ransomware, the malicious code begins encrypting files and folders on the infected system right away, often within seconds or minutes of the infection occurring. There is no delay or wait time before the damaging encryption starts (Ransomware Recovery: The Only Guide You Will Need).
Because immediate activation ransomware starts encrypting immediately, it spreads incredibly quickly. Large networks can be heavily encrypted in under an hour. This gives victims very little chance to detect the attack and stop it before major damage is done (How Ransomware Attacks Work: Impact, Examples, and Prevention).
While extremely dangerous, immediate activation ransomware is less common than delayed activation variants. Still, the speed at which immediate activation ransomware encrypts makes it one of the most destructive forms of malware today.
Delayed Activation
Many modern ransomware variants utilize a delayed activation method, where the malicious software lies dormant before deploying its payload across the infected system (1). This delayed activation serves multiple strategic purposes for the attackers behind ransomware campaigns:
First, it gives more time for the ransomware to spread within a target network before being detected. With immediate activation, the ransomware may be spotted and contained quickly after the initial infection. But with a built-in delay, the ransomware has an opportunity to propagate further through shared drives and networks, expanding its potential damage. According to research, delays ranging from hours to even months are being coded into recent ransomware variants (2).
Second, the delay allows companies time to complete backups of data before encryption kicks in. Backups are critical for recovering encrypted files after a ransomware attack. So by waiting to activate, the ransomware increases pressure on the victim company to pay up in order to restore access to crucial data. Recent examples like Ryuk, Maze, and Sodinokibi have leveraged these delayed ransom techniques (3).
In general, delayed activation has become a more common technique in modern ransomware. The delayed strike increases the likelihood of ransom payment, while also making defending against these threats more challenging.
Activation Triggers
Ransomware attackers often control the timing of when the malware activates to maximize damage and likelihood of payment. Many ransomware variants have built-in triggers that determine when encryption starts.
Common activation triggers include:
- After a system reboot – The malware waits until the next reboot to activate, allowing time for infection to spread.
- On a schedule – Activation might be set for a specific date and time. This ensures many devices are infected before the ransomware encrypts files.
- When a certain number of files are accessed – The ransomware tracks file access, activating when enough files have been touched to make the attack impactful.
Attackers might also manually activate the ransomware when they feel enough time has passed for maximum infection. According to the National Cyber Security Centre (https://www.ncsc.gov.uk/ransomware/home), this delayed activation “maximizes the number of infected devices and thus potential ransom payments.”
Minimizing Damage
\n3 Steps to Stop Ransomware From Spreading – Eliminate unnecessary connections and use visibility tools to detect and stop fast-acting strains of ransomware before they can spread and do major damage.
Having regular backup systems and a recovery plan in place is crucial for minimizing damage from a ransomware attack. Backups allow you to restore your files and systems without paying the ransom. Ensure backups are offline and inaccessible to the ransomware. Test your backup and recovery procedures regularly.
Other methods like keeping systems patched and updated, restricting administrative privileges, and using endpoint detection and response tools can help stop fast-moving ransomware as well.
Prevention
There are several key steps individuals and organizations can take to help prevent ransomware attacks and minimize the damage if infected (Cisecurity.org, 2023):
- Maintain backups – Regularly back up critical data and systems, store backups offline and encrypted, and test recovery procedures. This allows you to restore data without paying the ransom if infected.
- Develop response plans – Have an incident response plan laying out steps to take if ransomware is detected, including who to notify and how to isolate the infection.
- Limit user permissions – Only provide users the least privileges needed to do their jobs to limit damage from infections.
- Patch promptly – Keep all software updated and patched to close security holes ransomware exploits.
- Use antivirus – Run reputable antivirus/antimalware software to detect and block known ransomware variants.
- Restrict file execution – Configure systems to block unauthorized applications and scripts from running.
- Filter email attachments – Block dangerous file types like .exe in emails to prevent infection through phishing.
Following security best practices makes it much harder for ransomware to infiltrate systems and encrypt data. However, since threats are always evolving, continued vigilance is key (Kaspersky.com, 2023).
Dealing with Activation
If your system becomes infected with ransomware, it’s important to act quickly to isolate the damage and prevent further spread. According to the National Cyber Security Centre, the first step is to disconnect infected devices from networks and external drives to contain the malware.
For decryption, first check if the ransomware strain has known flaws or decryption tools available. Security researchers sometimes crack ransomware strains and release free decryption utilities, like those available from NoMoreRansom.org. Otherwise, decryption may not be possible without the attacker’s private key.
Whether to pay the ransom is a difficult decision. Law enforcement agencies advise against paying, as it incentivizes and funds criminal activity. Paying also doesn’t guarantee the criminals will provide working decryption tools. However, for high-value or irreplaceable data, some opt to pay as a last resort if all other options are exhausted.
Recovery
Recovery from a ransomware attack typically involves restoring data from backups. Most organizations maintain regular backups of critical data, either through physical media like tapes or in cloud backup services. These backups can be used to restore files and systems after an attack (https://www.rubrik.com/insights/how-to-recover-from-ransomware).
The time and cost to fully recover depends on several factors, including the scope of the infection, frequency of backups, and complexity of the IT environment. According to experts, ransomware recovery can take anywhere from a few days to over a week for large organizations (https://www.crowdstrike.com/cybersecurity-101/ransomware/ransomware-recovery/). Recovery is a labor-intensive process of restoring data, reimaging infected systems, and reimplementing impacted applications and services. Additional costs may include outside consultants and legal fees.
To minimize downtime and costs, organizations should test and verify their backup systems regularly. They should also implement comprehensive incident response plans to streamline recovery efforts in the event of an attack.
Conclusion
To summarize, the activation timeframe of ransomware can vary greatly. Some strains activate immediately upon infection to encrypt files and data. However, many sneakier strains have built-in delays that allow time for infection to spread before activating. The exact trigger for delayed activation also differs, whether it’s based on a timer, number of files accessed, or external command.
Regardless of when ransomware activates, prevention and recovery are key. Maintaining backups offline is critical for recovering encrypted data without payment. Anti-virus, firewalls, employee education, and limiting user permissions can prevent infection in the first place. Staying vigilant and keeping systems patched and updated is important too.
With proper diligence, companies can minimize both the risk of ransomware attacks as well as the impact if they do occur. Understanding the various activation behaviors can help inform defensive strategies as well.
