Most Common Ransomware Attack Vectors

In 2020, the cybersecurity company SonicWall counted around 304 million ransomware attacks globally. By the summer of 2021, there was a surge of more than 148%, with the company predicting 714 million attempts by the end of the year. Cyberattacks shutting down critical infrastructure, such as that on the Colonial Pipeline in May of 2021, demonstrate just how costly and disruptive these criminal efforts can be. With the average ransom demand from attackers being $6 million, organizations should be aware that:

• Ransomware is growing more popular and sophisticated.
• Cybercriminals are always on the lookout for weak spots in your IT infrastructure.
• An intentional prevention strategy is necessary to provide the best protection.

At this point, organizations should consider what to do to protect themselves from a ransomware attack, rather than wondering if it will happen. To defend themselves, they first need to understand the tactics cybercriminals use and the attack vectors they exploit.

Why Is Ransomware on the Rise?

To carry out a successful attack, the cybercriminals must deliver some kind of malware that encrypts computers, files, and even entire networks. Once the data has been encrypted, a key is needed to unlock the files. The attackers can then contact the business saying that they will only decrypt the files for a payment, most often in cryptocurrency.

In 2021, several factors led to an unprecedented growth in these cyberattacks. Emails and fake websites were the primary delivery tools, and concern about the COVID-19 pandemic provided a convenient topic for clickbait. People were searching for details on the subject and were less careful about clicking on an attachment or embedded link. Once an unsuspecting employee clicked on a corrupt link or attachment, the device or system had already been infected.

In addition, the growth of cryptocurrencies provided an easier means to carry out anonymous ransom transactions. More people were familiar with the technology, so demanding a Bitcoin transaction was not unreasonable. Some criminal groups even provided step-by-step instructions for conducting a cryptocurrency payment.

The success of ransomware is also due to the ever-changing nature of cybercrime. Encrypting and ransoming data used to require people with high-level technical skills. But some of these cybercriminals have discovered that it is actually easier and more profitable to hire out their abilities (a Ransomware-as-a-Service model) than carry out individual attacks. Ransomware-as-a-Service means that even the most novel hackers can execute highly sophisticated, targeted cyberattacks.

The Most Common Ransomware Attack Vectors

Although the cyber threat landscape is becoming increasingly more complicated, when people hear stories of successful cyberattacks, they are often surprised that employees would be so careless. Still, criminals depend on employees believing that they would never fall for a clickbait scheme. The truth is that it only takes one mistake to open up the virtual door and allow criminals into the system. While there are a variety of vectors that bypass a network’s protections, the hackers have a few preferred methods.

RDP Compromise

Employees and IT professionals appreciate the convenience of interacting with a desktop from a remote location. RDP (Remote Desktop Protocol) offers the ability to work from home without missing a beat. IT team members use the remote desktop protocol to perform maintenance and troubleshoot problems without leaving their offices.

Unfortunately, RDP widens the attack surface. Without well-designed protection, a remote desktop can open up the network to hackers. Through brute-force attacks, a trial-and-error technique used to obtain user credentials, or credentials purchased on the dark web, cyber criminals can gain unauthorized RDP access to victim systems. Once there, they can deploy a range of malware, including ransomware.

Email Phishing

Email phishing remains one of the most popular options for cyberattacks. Armed with an email list, cybercriminals can cheaply send links to everyone within an organization. Phishing is a volume game because it only takes one employee’s mistake to make data vulnerable.

Other cybercriminals take a more targeted approach to phishing. Spear phishing uses public information to make malware emails seem legitimate. Perpetrators can use details from social media sites to fake a relationship with the target. That’s because employees are more likely to click links or download files from a trusted source.

When criminals attempt to access high-level data from executives, this practice is known as whaling. This strategy assumes that upper management may not be subject to the same cybersecurity oversight as lower-level employees. They may also be less familiar with common safety protocols.

Software Vulnerabilities

Updating software can be frustrating for businesses and government offices. If something works for an organization, employees will be slow to change. Many government departments are still working with software written in older languages like COBOL. Other businesses use software versions with expired support.

In such cases, hackers may not need to obtain passwords or other login information. When they find an unpatched vulnerability, it provides an easy vector for a direct attack. Some of the top vulnerabilities in Java products exploited by hackers have been known for almost a decade, and patches have been readily available.

Moreover, cybercriminals are constantly searching for zero-day vulnerabilities. If they can launch a cyberattack before developers realize the problem, there is little that an organization can do. However, legitimate software companies seek to fix vulnerabilities as quickly as possible. Ignoring patches and updates is a risky practice.

How to Protect Your Organization from a Ransomware Attack

While hackers may be looking for internal software vulnerabilities, most successful cyberattacks result from a weak layer of protection and human error. Like many horror movies, the threat is already in the house. Companies need to take data protection seriously and develop a culture of cybersecurity to prevent incursions.

Education and Testing

Cybercriminals know that people look for patterns. They must consistently vary their methods to fool users. The best way to protect data is to train every responsible person about the signs of suspicious activity. Cybersecurity companies regularly report on the latest trends—information that may prevent someone from clicking a suspicious link.

IT departments should also provide information about creating strong passwords. It can be tempting for an employee to save time by recycling familiar words and phrases. However, it is dangerous when the password for a less secure app matches one for a mission-critical platform.

Periodic testing can also strengthen security. The IT team mimics cybercriminals by sending emails that include links or requests for security information. They can measure how employees respond and use the results for further education and awareness.

Plans and Protocols

As ransom cyberattacks become more common, businesses need to establish clear protocols for reporting potential threats and handling requests for sensitive information. When an employee finds a questionable email, they must report it immediately to the IT team. This group can then respond to the threat effectively and inform the entire organization about the appropriate actions.

Requests for information should also be subject to verification. It only takes a few minutes to confirm the legitimacy of an email. While seeking confirmation adds a few more steps to the process, the added protection is invaluable.

White-Listed Apps and Sites

Most employees do not require access to every part of the internet on their work-related devices. Allowing only whitelisted apps and websites will keep the network safe even if someone clicks the wrong link. If an employee needs access to a new site, the IT team can investigate its safety first.

Patching and Other Updates

Companies must pay attention to update notices from every software platform they use. In most cases, opting for automatic updates is the ideal policy for keeping the network safe. IT staff should also pay attention to news about emerging vulnerabilities that may require temporarily taking a platform offline.

Role-Based Access

Data safety involves both preventive and protective policies. A role-based architecture can limit the damage done by a cyberattack. If a hacker gains access to an employee’s account, they will not have access to data on the entire network. Hopefully, employees with full access will have the training and knowledge to avoid such attempts.

Data Backups

Demanding a ransom only works because a business has no other way to access its data. However, regularly backing up information minimizes this loss. It will be inconvenient to reboot the system with unencrypted data, but it is better than paying a high fee that further encourages cybercriminals.

Advanced Email Protection

With email as a preferred delivery mechanism for ransomware, it is crucial to detect and block malicious emails before they reach employee mailboxes. Because traditional, single-layered defense approaches cannot stop targeted, socially-engineered attacks, organizations need to choose a dedicated solution that protects their email against the whole range of cyberattacks and data theft. Technologies that leverage machine-intelligence to scan all emails for potential threats can provide the necessary level of protection.

Keeping Data Safe for Your Organization

So long as ransomware attacks are profitable, cybercriminals will not stop. The rate and sophistication of these incursions will very likely grow over the next few years. The best way to counter ransomware and protect your organization is to set up a sound prevention strategy. Shifting from detection to prevention is crucial. Expert security solutions like xorlab ActiveGuard can help you reduce the attack surface and identify and prevent threats before they can infect your organization and cause harm.

To find out more about how you can protect your organization against ransomware attacks, download for free The Clear & Complete Guide to Smarter Email Security: