Ransomware computer viruses are becoming more sophisticated—and so are the attacks that make use of ransomware. In some cases, ransomware is used to disable access to a machine so criminals can perform further actions without being tracked. Criminals have also used ransomware to cause chaos and avoid detection after hacking into a network and stealing data.
Ransomware attacks are sometimes used to create a diversion while cybercriminals steal or exfiltrate data. While users and IT teams are busy trying to take machines offline and contain the infection, criminals are busy downloading files from users’ computers.
A study on Distributed Denial of Service (DDoS) attacks by Neustar showed that ransomware was found in 15% of DDoS cases. And Dark Reading author Kelly Jackson Higgins says attackers are including ransomware with other types of attacks as well.
Ransomware can be an effective way for criminals to cover their tracks. For example, cybercriminals might install ransomware that encrypts valuable data such as log files in an effort to make those files inaccessible to investigators. Even if the files are later decrypted, investigators may not look for a second attack because ransomware incidents typically receive the most attention. Investigators need to be especially vigilant: In addition to searching for the cause of the ransomware infection, they need to look into whether more attacks were performed on the machine.
In many cases, the best practice is to wipe a machine that is infected with ransomware and then restore its files from backup. This provides assurance that backdoors and other compromised elements of the system will no longer be available for the attacker to take advantage of at a later point.
However, wiping the system can remove valuable evidence as well. In cases where additional evidence is needed, it’s important to take a forensic image of the computer prior to wiping it. This allows investigators to review data from the image when conducting the investigation. In some cases, ransomware decryption tools become available that will allow investigators to decrypt the data from an image. This data could be valuable in determining whether additional data was exposed and whether the ransomware was used to cover up other illegal activities.
For more news and information on the battle against ransomware, visit the FightRansomware.com homepage today.
