Ransomware attacks have become increasingly common in recent years. They involve malicious software that encrypts an organization’s files and demands payment in order to decrypt them. Understanding the common indicators of a ransomware attack can help organizations detect and respond to incidents more effectively.
Unexpected Increase in Support Tickets
One early sign of a potential ransomware attack is a sudden uptick in support tickets from users who cannot access files or applications. This influx of tickets complaining of system issues, freezing screens, error messages, or inability to open files may be the first red flag.
For example, if a company normally receives 10-15 tickets per day but suddenly gets 50+ tickets all related to accessibility issues, it may point to a ransomware attack underway. The attack is actively encrypting files and blocking access across the organization’s systems.
Inability to Access Critical Data or Applications
Another telltale indicator is when employees start reporting that they cannot access important data, servers, or applications. Ransomware often targets file servers, databases, shared drives, and other locations that contain critical business information.
If users abruptly lose access to key data or systems without an obvious cause like a power outage or downed server, ransomware could be at play. The loss of access happens when the ransomware encrypts those files or systems and blocks entry.
Ransomware Note Appears on Screens
Perhaps the most overt sign of a ransomware attack is the appearance of a ransom demand message on employee computer screens. These notes typically inform the victim that files have been encrypted and provide payment instructions to receive a decryption key.
The notes may display a countdown timer, threatening permanent data loss if the ransom is not paid in time. The ransom demand often asks for payment in cryptocurrency, such as Bitcoin, to protect attacker anonymity.
Unusual Hard Drive Activity
Some ransomware variants can be detected by looking for unusual hard drive activity before files become encrypted. Ransomware has to scan and encrypt each drive connected to an infected system.
This process can cause unusually high disk input/output usage detectable by monitoring tools. If disk activity spikes without explanation, it may signify ransomware systematically encrypting files.
Can’t Boot Systems Normally
Another potential indicator is an inability to boot systems or devices. Some ransomware targets the master boot record (MBR) or locks down the boot process to prevent normal system start up.
If organizations suddenly cannot start servers, computers, or other systems as expected, ransomware could be interfering with the boot sequence. This forces victims to pay the ransom to regain normal boot functionality.
Antivirus Alarms
Quality antivirus and anti-malware tools may detect ransomware based on known signatures or suspicious behaviors. The software can raise alarms signaling that ransomware is actively running in the environment.
However, ransomware authors constantly modify their code to evade detection. Without updated ransomware definitions, antivirus may miss newer strains. Yet antivirus alerts can still provide a clue of potential ransomware activity.
Forensic Investigation
IT forensics can also uncover indicators of a ransomware attack. Traces like registry key changes, file creation timestamps, or code artifacts may reveal ransomware presence.
For example, some ransomware creates registry keys like “HELP DECRYPT” as part of the encryption process. Forensic tools can detect these artifacts left behind by malicious software.
Ransomware Prevention Tips
Organizations can lower ransomware risks by following best practices:
- Train employees to recognize phishing emails and avoid clicking links/attachments
- Keep all software up-to-date with the latest patches
- Use strong security tools like antivirus, firewalls, and email filtering
- Create and test backups of critical data
- Control access with principle of least privilege
- Segment networks to limit spread of malware
Responding to a Ransomware Attack
If ransomware is detected, quick response can help minimize damage:
- Isolate and power off infected systems to prevent spreading
- Notify incident response teams
- Determine the variant for insight into decryption options
- Check for and remove indications of a breach
- Restore data from clean backups if available
Organizations should also report incidents to law enforcement and check regulations regarding paying ransoms. With proper precautions and planning, businesses can bolster resilience against ransomware attempts.
The Costs of Ransomware Attacks
Ransomware attacks can have major financial consequences for victim organizations. Costs may include:
- Ransom payments – The direct ransom demands can range from a few hundred to millions of dollars. Cybersecurity firm Emsisoft estimates global ransomware losses at $20+ billion in 2021.
- Lost revenue – With systems disabled, organizations cannot conduct business as usual, resulting in lost sales and productivity.
- Remediation expenses – Substantial costs arise from investigating the incident, restoring data from backups, hardened systems against future attack.
- Legal and regulatory fines – Government fines as well as lawsuits from customers or partners impacted by breached data.
- Reputational damage – Poor security perceptions among customers can harm brand reputation and loyalty.
Indirect costs like business disruption and lost opportunities can multiply the direct ransomware damages. Yet many victims feel compelled to pay the ransom to regain access to systems essential for operations.
Most Common Ransomware Variants
While many ransomware strains exist, several stand out as the most prevalent and impactful:
Locky
First observed in 2016, Locky became known for distribution via spam emails containing malicious Microsoft Office attachments. At peak, the FBI reported over 400,000 Locky attacks per day. Locky operated until late 2017.
CryptoLocker
CryptoLocker emerged in 2013 and helped pioneer the use of strong RSA encryption to restrict file access. It spread through infected email attachments and compromised websites using the Gameover ZeuS botnet.
Ryuk
Ryuk appears linked to North Korean state hackers and first gained attention in 2018 after targeting several major organizations. Ryuk exhibits greater manual intervention compared to typical “commodity” ransomware.
Conti
Active since 2020, Conti utilizes common attack vectors like phishing emails but also exploits software vulnerabilities to encrypt files on unpatched systems. Conti claims over 400 victims worldwide.
REvil
REvil (also Sodinokibi) exemplifies the popular ransomware-as-a-service model. Affiliates conduct campaigns using the REvil toolkit and pay the authors a cut. REvil was disrupted in 2021 but returned intermittently.
Most Affected Industries
Although ransomware threatens organizations across sectors, some industries face elevated risk levels:
Healthcare
Patient care relies on accessible medical records and back-end systems, making healthcare a frequent ransomware target. In 2021, over 90 ransomware incidents affected US healthcare organizations.
Education
Schools and universities contain valuable private data like financial aid records that appeal to attackers. Distance learning systems are also vulnerable endpoints.
Finance
Banks and insurers store highly sensitive account details and financial transactions that can lead to major fraud if breached. Regulatory requirements also pressure finance to pay.
Energy
Energy firms provide critical infrastructure that often cannot afford downtime. Oil and gas facilities in particular have paid large ransoms to resume crippled operations.
Government
Public sector agencies face ransomware attempting to disrupt key services. Small municipalities often pay ransoms due to lack of IT resources.
Worst Ransomware Attacks
Some notable ransomware incidents illustrate the scale of damage possible:
Colonial Pipeline – 2021
This largest US fuel pipeline shut down for days after DarkSide ransomware targeted business and IT systems. Widespread gas shortages resulted before Colonial paid $4.4 million.
JBS – 2021
A REvil attack forced meat supplier JBS to halt US beef production briefly and pay an $11 million ransom. The White House called it a threat to national security.
Kaseya – 2021
Breach at Kaseya’s remote management tools let REvil infiltrate downstream customers, ultimately impacting over 1,500 businesses globally. Losses topped $70 million.
Maersk – 2017
NotPetya ransomware froze cargo management systems at Danish transport giant Maersk, costing over $300 million. Maersk had to reinstall 4,000 servers and 45,000 PCs.
City of Atlanta – 2018
Attack hobbled government services for millions of Atlanta residents. Officials spent an estimated $17 million recovering compromised systems and data. No ransom was paid.
Ransomware Trends and Statistics
- Cybersecurity firm SonicWall recorded 188.9 million global ransomware attacks in the first half of 2022, a 13% year-over-year increase.
- Total ransomware damages are predicted to cost $30 billion globally in 2023.
- 77% of US organizations were hit by ransomware in 2021, a 102% annual increase.
- The average ransom payment grew 78% to $812,000 in 2021.
- Human error like clicking malicious links or attachments accounted for 26% of ransomware compromises in 2021.
- Small and mid-sized businesses faced the highest ransomware risk in 2021, with 56% attacked.
As ransomware attacks proliferate, organizations must prioritize improving defenses and incident response plans. Keeping software patched, securing backups, training staff, and monitoring for threats are essential best practices against ransomware.
Sources
Cybersecurity and Infrastructure Security Agency. (2022). Shields Up. https://www.cisa.gov/shields-up
Emsisoft. (2022). The State of Ransomware 2022. https://www.emsisoft.com/ransomware-statistics/
FBI. (2021). Ransomware Trends Show Increased Sophistication, Exploitation of IT Infrastructure. https://www.ic3.gov/Media/News/2021/2109010
IBM. (2022). X-Force Threat Intelligence Index 2022. https://www.ibm.com/security/data-breach/threat-intelligence
Sophos. (2021). The State of Ransomware 2021. https://www.sophos.com/en-us/medialibrary/pdfs/whitepaper/sophos-state-of-ransomware-2021-wp.pdf
Verizon. (2022). 2022 Data Breach Investigations Report. https://www.verizon.com/business/resources/reports/dbir/
