How To Prevent Ransomware

Automation is a problem you’ve probably heard about a ton in the past decade, and now, even ransoms are automated. Ransomware is a type of malware that extorts users for money, taking control of a website or data and demanding a ransom for its release. If that sounds unpleasant to you, we’re here to make sure you’re never a victim.

What To Do if You’re Under a Ransomware Attack

Even if you performed all of the above tasks, it’s still possible for ransomware to sneak in. If that’s the case, don’t panic. You can get through this. Here’s what to do if you’re ever under a ransomware attack.

Removing Ransomware: How To Respond

Once you get infected with ransomware, you need to respond. Here are the steps you need to take to minimize the damage ransomware can cause:

1. Isolate and disconnect your computer. First, disconnect the affected computer from the internet and its network. That way, the ransomware can’t spread to other computers.
2. Don’t pay the ransom. We’ll talk a bit more about this below, but just as the U.S. government doesn’t negotiate with terrorists, there’s no reason for you to give in to cybercriminals’ demands.
3. Run an antivirus scan. Perform a full virus scan of your device to let your antivirus work its magic. If it detects the ransomware, it can quarantine and remove it without you having to pay up.
4. Use a ransomware decryption tool. A common ransomware method is to encrypt your computer so that you can’t see your files or data. If that’s the case, you’ll need a ransomware decryptor, which could be separate from your existing antivirus software. Don’t worry, though; Kaspersky offers one for free.1
5. Restore your files from backup. You backed up your files … right? If you listened to us, then it’s time to upload your backup back onto your device that’s now (hopefully) free of the ransomware. Again, regular backup is key.2

For more information on ransomware and other antivirus-related topics, read all of our antivirus guides.

Should You Pay the Ransom?

We are of the firm belief that you should not pay the ransom that ransomware requests — or that anyone requests, for that matter. According to Cybereason’s Ransomware: The Cost to Business Study 2024,3 which surveyed 1,000 cybersecurity professionals, paying the ransom is not the best move. The study found that 84 percent of organizations decided to pay the ransom, but only 47 percent got their data and services back without them being corrupted.

Additionally, paying the ransom encourages more ransomware attacks, creating a vicious cycle. But the most damning reason not to pay the ransom is that fact of cold, hard cash. Paying the ransom doubles the total cost of dealing with ransomware attacks. We’ll discuss the monetary costs of ransomware attacks below, but trust us: Negotiating with terrorists (or hackers) is never a good idea.

Methods for IT Administrators

For businesses, preventing ransomware attacks falls to, you guessed it, IT administrators. While this isn’t a comprehensive list of the preventative measures you should take, it’s a start.

• Train employees to avoid phishing messages.
• Create spam filters to authenticate both inbound and outbound email.
• Install antivirus software on all work-related devices.
• Configure access controls so that only authorized users can access sensitive data.
• Create a centralized patch management system for quick, automatic updates.
• Install firewalls to block malicious IP addresses.

What Is Ransomware, and How Does It Work?

It may be obvious by now, but ransomware is a form of malware that targets systems and data and extorts users for ransom. But where does it come from?

How Ransomware Is Delivered

According to a survey of organizations that had ransomware attacks in 2020, the most common way that ransomware infected their computers was through file downloads and emails with malicious links, aka phishing. That accounted for nearly one-third of all ransomware attacks, with remote server attacks accounting for just over one-fifth of all attacks. See the rest of Sophos’ data below:

Why Are Ransomware Attacks so Effective?

There’s a psychological component that makes ransomware attacks so effective, and it’s called panic. Seeing an intimidating or threatening message demanding a ransom can make victims scared, naturally.4 Not to mention the widespread nature of ransomware: In 2020, over half of organizations were victims of ransomware attacks, and 73 percent of these attacks involved the encryption of their data, known as crypto-ransomware, according to Sophos. As anyone who’s ever lost access to their electronic devices can tell you, this combination of threats and encryption makes ransomware particularly effective.

Who’s at Risk of Ransomware Attacks?

While we normally speak about ransomware attacks against organizations, many might be wondering if it can happen at the individual level as well.

Business vs. Personal

Both individuals and businesses can be the target of ransomware attacks, according to the U.S. Department of Justice. However, there is some variance within business industries. For example, the private sector is victim to ransomware attacks more often than the public sector. While 51 percent of all businesses worldwide were affected by ransomware, only 45 percent of public organizations were affected. Conversely, media, leisure, and entertainment businesses were more likely to fall victim to ransomware at 60 percent overall, according to Sophos.

Types of Devices

While we couldn’t find any studies on ransomware rates per type of device, we know that ransomware can attack both computers and mobile devices.

Why Ransomware Prevention Is Important

If you’re not convinced that ransomware is important to prevent, let’s talk about what it costs in terms of dollars and cents.

The Costs of Ransomware Attacks

We’re not exaggerating when we tell you that the average cost of ransomware attacks for organizations is $732,520 for those who don’t pay the ransom and $1,448,458 for those who pay. If that doesn’t convince you not to pay the ransom, we don’t know what will. Of course, even businesses that don’t pay the ransom still lose a ton of money, as you can see. Those losses stem from the loss of their reputations, revenue, and business data.5

As more and more companies learn that not paying the ransom is the way to go, there’s been a butterfly effect: Ransoms are decreasing. Between the third and fourth quarters of 2020, the average ransomware payment decreased by 34 percent to $154,108, while the median ransom payment decreased by 55 percent to $49,450.6 With any luck, it’ll continue to decrease until ransomware attacks stop altogether.

Types of Ransomware

Ransomware can be divided into two categories:

• Crypto-ransomware encrypts a computer’s valuable files, preventing the user from accessing them.
• Locker ransomware does not encrypt a computer’s files but locks a victim out of their device.

There are variants of ransomware within those categories, with examples from all over the world. Here are the most common ransomware variants as of the last quarter of 2020, according to Coveware:

Ransomware Do’s and Don’ts

To reiterate, here’s how you should and should not handle ransomware attacks and prevention.

Famous Ransomware Attacks

Well, maybe they’re more infamous.

Locky

Locky was a ransomware variant released in 2016 that could encrypt over 160 different file types. Its method? To trick victims into installing it through phishing emails, a form of social engineering.

WannaCry

In 2017, WannaCry spread across 150 countries, exploiting a vulnerability in the Windows operating system. WannaCry turned out to be named quite accurately, as it affected 230,000 computers and one-third of all U.K. hospitals, losing the National Health Service £92 million. Damages around the world added up to $4 billion.

Bad Rabbit

Finally, Bad Rabbit launched in 2017, performing “drive-by” attacks that targeted insecure websites without any action needed from the user. Bad Rabbit hid within a fake request to install Adobe Flash. Bad is right!

Recap

Ransomware is a cyberattack or type of malware that demands payment to regain control over a system or sets of data. To prevent becoming a victim of ransomware, you need to ensure your devices are secured and backed up.

If you experience ransomware, there are ways to get out ahead. First, disconnect your computer from the internet so that the ransomware doesn’t spread. Then, use your antivirus software to run a scan to try and remove the ransomware. If you need to, consider using a ransomware decryption tool. Finally, restore your files from the last backup. This is your sign to back up your files.

While it might be easier said than done, try your best not to panic and give in to any ransom demands. The best way to stay protected is by thinking ahead and involving prevention strategies. So, avoid clicking on links or attachments you don’t recognize – the same goes for downloads. And always keep your system and antivirus softwares up-to-date for the most protection.