Ransomware is a form of malicious software that encrypts a victim’s files and demands payment to decrypt them. There are several common vectors through which ransomware typically enters an organization’s network.
Email Attachments
One of the most prevalent vectors for ransomware infection is via email attachments. Cybercriminals will send emails with malicious attachments disguised as legitimate files. If the recipient opens the attachment, the ransomware payload is activated.
Common techniques used in ransomware campaigns include:
- Embedding the malicious payload in document files like Word, Excel, Powerpoint or PDFs.
- Disguising the malware as an invoice, receipt or shipping notice.
- Spoofing the sender address so the email appears to come from a trusted source.
- Using social engineering tactics in the message body to persuade the recipient to enable macros or content.
Users may be asked to “enable editing” or “enable macros” which activates the ransomware encryption process. Email attachments remain one of the most high-risk vectors for infection.
Malicious Links
Ransomware operators also rely heavily on malicious links to deliver their payloads. The email body itself may not contain malware, but the links inside redirect victims to download the malicious software.
Some common practices around malicious links include:
- Linking to fake login pages to harvest credentials.
- Linking to realistic but fraudulent sites to download infected programs.
- Using URL shorteners to hide the true destination of the link.
- Compromising legitimate websites and adding malware download pages.
Users directed to these sites may be prompted to install bogus software updates that infect systems with ransomware. Cybercriminals have become adept at creating convincing phishing pages and emails.
Exploiting Vulnerabilities
Hackers will identify and target vulnerabilities in public-facing applications and network devices to gain access and deploy ransomware. Some examples include:
- Unpatched software vulnerabilities – Failure to patch known software flaws enables hackers to exploit these to distribute malware payloads.
- Weak passwords – Using guessable passwords on external services provides an opening for attackers to compromise accounts.
- Exposed RDP access – Unsecured remote desktop protocol (RDP) connections are favorites of ransomware gangs to infiltrate networks.
- VPN vulnerabilities – Flaws in virtual private network (VPN) software can potentially be leveraged to spread infections.
Outdated and misconfigured systems provide easy inroads for adversaries to gain initial access and then move laterally across the network.
Compromised Websites
Increasingly, ransomware groups are hacking into existing websites to plant their malware payloads. Visitors to these compromised sites who have out-of-date plugins or software can end up downloading ransomware onto their devices automatically.
Tactics used to infect websites include:
- Exploiting vulnerabilities in content management systems (CMS) like WordPress or Drupal.
- Uploading malicious scripts into forums and message boards.
- Distributing malware through advertisement networks on legitimate sites.
- Injecting iframes that redirect to malicious domains.
With thousands of websites being built on vulnerable platforms daily, hackers have plenty of opportunities to compromise them as launch pads for ransomware campaigns.
Malvertising
Malvertising refers to the use of online advertising networks as vehicles to spread malware. By paying to insert malicious ads containing ransomware download links or code into ad platforms, hackers can reach millions of website visitors.
Some common malvertising tactics used to vector ransomware include:
- Buying ad inventory on reputable sites through legitimate ad exchanges.
- Redirecting users to phishing pages that host malware downloads.
- Loading ads laced with malicious JavaScript code.
- Targeting vulnerabilities in ad tech ecosystems to insert malicious ads.
Malvertising provides an avenue to launch ransomware campaigns on a massive scale through trusted online ad networks.
Infected Software Installers
Another method ransomware groups employ is hijacking the installers of everyday software applications and bundling malware into them. Users downloading infected installers from untrustworthy sources risk infecting themselves with ransomware.
Examples include:
- Infecting cracked software installers commonly distributed on torrent sites.
- Inserting malware into keygen tools used to activate pirated software.
- Poisoning installers hosted on download sites with poor reputation.
- Bundling malware with installers for popular applications obtained from unofficial mirrors.
Downloading from unverified sources and using pirated software exposes users to potentially compromised files that can deliver ransomware payloads.
Network Drive-By Infections
Ransomware code installed on compromised media or devices can also lead to “drive-by” infections on networked systems. When the infected drive is opened, the ransomware automatically spreads to other computers connected to the same network.
This can occur through:
- Infected USB flash drives connected to the network.
- Network file shares containing dormant ransomware.
- Online cloud drives synced with malware-laden files.
- Cloned virtual machine (VM) images with infected binaries.
Network drive-by attacks allow ransomware to proliferate quickly across systems sharing local network resources.
Exploiting Remote Management Tools
Tools like Remote Desktop Protocol (RDP) and screen-sharing apps provide ripe targets for ransomware attackers. By brute forcing access credentials or using exploits, hackers can gain control of these tools and use them as conduits for deploying malware across systems.
Common methods include:
- Guessing weak RDP passwords to hijack sessions.
- Cracking TeamViewer and VNC credentials offline.
- Using Shodan to find public-facing management tools.
- Scanning for PSexec and WMIC vulnerabilities.
Remote management software often has vulnerabilities that can enable lateral movement across networks, making them ideal platforms for largescale ransomware attacks.
Spam Email Campaigns
Spam email blasts to wide distribution lists remain a traditional vector for ransomware. Although not as targeted as spearphishing emails, spam campaigns generate sufficient infections within large enough populations.
Typical methods include:
- Sending waves of emails with malware attachments from botnets.
- Using snowshoe spam from multiple IPs to bypass filters.
- Leveraging open relays and unsecured mail servers.
- Buying compromised email lists on the dark web.
By spraying high volumes of malicious emails to broad distribution lists, adversaries can infect many recipients with ransomware despite low response rates.
Man-in-the-Middle WiFi Attacks
Captive WiFi portals in cafes, airports and other public places are ripe for man-in-the-middle attacks. Attackers can manipulate infected portals or set up evil twin access points to spread malware.
Tactics include:
- Deploying fake hotspots masquerading as legitimate networks.
- Exploiting vulnerabilities in WiFi access point firmware.
- Poisoning DNS and routing traffic through malicious servers.
- Downgrading encryption protocols to decrypt traffic.
Public WiFi networks present opportunities for hackers to inject malware into unwitting users’ connections and compromise devices with ransomware.
Supply Chain Attacks
By compromising third-party suppliers, MSPs and contractors within corporate supply chains, ransomware groups can access victim environments indirectly. Poor vendor security provides openings for supply chain attacks.
Examples include:
- Infiltrating vendor networks via phishing to use as pivot points.
- Exploiting contractor TeamViewer and RDP access.
- Hiding malware in software updates or install packages.
- Compromising credentials stored in GitHub and similar repositories.
When ransomware compromises one supplier in the supply chain, it threatens every downstream partner and customer. Supply chain attacks provide attackers greater reach than targeting victims individually.
Watering Hole Attacks
Watering hole attacks target websites specific communities and industries visit regularly, infecting them for future ransomware campaigns. Hackers undermine carefully selected sites to ensnare visitors.
Methods include:
- Exploiting vulnerabilities in CMS platforms like Drupal and WordPress.
- Compromising official sites of professional organizations and charities.
- Injecting iframes to redirect users to malicious sites.
- Installing downloaders for malware disguised as legitimate software.
Watering hole schemes rely on poisoning websites where desired targets congregate, allowing ransomware gangs to infiltrate organizations through their employees’ browsing.
Social Engineering
While technology provides avenues for distributing ransomware, social engineering remains key to its success. Manipulating users via psychological tricks and emotions bypasses technical controls.
Common techniques include:
- Pretexting to persuade victims to enable macros or provide credentials.
- Spoofing identities of senior executives or IT teams.
- Threatening actions like account suspension to coerce actions.
- Offering too-good-to-be-true opportunities in exchange for cooperation.
As the weak link in security, compromising the human element through social engineering remains the simplest way to distribute ransomware within organizations.
Brute Forcing Credentials
Another vector for ransomware is brute forcing access credentials through password guessing, password spraying and credential stuffing attacks. Weak passwords provide easy targets.
Examples include:
- Cracking RDP and VPN passwords via password spraying.
- Exploiting default and commonly reused credentials.
- Automated credential stuffing attacks against web logins.
- Offline password cracking after database breaches.
Obtaining credentials through brute force allows attackers to gain initial footholds in systems and networks to deploy ransomware.
Conclusion
Ransomware operators employ numerous vectors to infiltrate target networks, with email, web and social engineering attacks being among the most prevalent. However, any vulnerability in an organization’s attack surface can potentially be exploited to deliver ransomware. Some key takeaways include:
- Ensure software patches and security updates are applied promptly.
- Use least privilege access and role-based restrictions for users.
- Enable strong spam filters and prompt scanning of attachments.
- Train staff to identify social engineering and phishing attempts.
- Regularly back up critical data offline.
- Segment network zones to limit lateral movement.
Ransomware groups continuously innovating their tactics, techniques and procedures (TTPs). By keeping employee awareness high, hardening infrastructure and maintaining robust backups, organizations can build resilience against the evolving threat landscape.