www.trendmicro.com Open in urlscan Pro
96.16.156.66  Public Scan

Form analysis
2 forms found in the DOM

<form class="main-menu-search" aria-label="Search Trend Micro">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form">
    <table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

<form class="main-menu-search" aria-label="Search Trend Micro">
  <div class="main-menu-search__field-wrapper" id="cludo-search-form-mobile">
    <table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
      <tbody>
        <tr>
          <td class="gsc-input">
            <input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
          </td>
          <td class="gsc-search-close collapsed" style="width:1%;" data-target="#search-mobile-wrapper" data-toggle="collapse">
            <span class="icon-close"></span>
          </td>
        </tr>
      </tbody>
    </table>
  </div>
</form>

Text Content

dismiss
0 Alerts
undefined

 * No new notifications at this time.

Download
 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

Buy
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Find a Partner
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

Region
 * The Americas
 * United States
 * Brasil
 * Canada
 * México

 * Asia Pacific
 * Australia
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)

 * Malaysia
 * New Zealand
 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

 * Europe, Middle East & Africa
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Middle East and North Africa

 * Nederland
 * Norge (Norway)
 * Polska (Poland)
 * Россия (Russia)
 * South Africa
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

Log In
 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

Free trials
Contact Us
 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)


Business 
For Home 

Products Products
Hybrid Cloud Security
Workload Security
Conformity
Container Security
File Storage Security
Application Security
Network Security
Open Source Security
Network Security
Intrusion Prevention
Advanced Threat Protection
Industrial Network Security
Mobile Network Security
User Protection
Endpoint Security
Industrial Endpoint
Email Security
Web Security
Endpoint & Gateway Suites
Detection & Response
XDR
Managed XDR Service
Endpoint Detection & Response
Powered by
Global Threat Intelligence
Connected Threat Defense
All Products & Trials

All Solutions

Small & Midsize Business Security

Solutions Solutions
For Cloud
Cloud Migration
Cloud-Native App Development
Cloud Operational Excellence
Data Center Security
SaaS Applications
Internet of Things (IoT)
Smart Factory
Connected Car
Connected Consumer
5G Security for Enterprises
Risk Management
Ransomware
End-of-Support Systems
Compliance
Detection and Response
Industries
Healthcare
Manufacturing
Federal
Why Trend Micro Why Trend Micro
The Trend Micro Difference
Customer Successes
Strategic Alliances
Industry Leadership
Research Research
Research
About Our Research
Research and Analysis
Research, News and Perspectives
Security Reports
Security News
Zero Day Initiative (ZDI)
Blog
Research by Topic
Vulnerabilities
Annual Predictions
The Deep Web
Internet of Things (IoT)
Resources
DevOps Resource Center
CISO Resource Center
What is?
Threat Encyclopedia
Cloud Health Assessment
Cyber Risk Assessment
Enterprise Guides
Glossary of Terms
Support Support
Business Support
Log In to Support
Technical Support
Virus & Threat Help
Renewals & Registration
Education & Certification
Contact Support
Downloads
Free Cleanup Tools
Find a Support Partner
For Popular Products
Deep Security
Apex One
Worry-Free
Worry-Free Renewals
Partners Partners
Channel Partners
Channel Partner Overview
Managed Service Provider
Cloud Service Provider
Professional Services
Resellers
Referral Partners
System Integrators
Alliance Partners
Alliance Overview
Technology Alliance Partners
Our Alliance Partners
Tools and Resources
Find a Partner
Education and Certification
Partner Successes
Distributors
Partner Login
Company Company
Overview
Leadership
Customer Success Stories
Strategic Alliances
Industry Accolades
Newsroom
Webinars
Events
Security Experts
Careers
History
Corporate Social Responsibility
Diversity, Equity & Inclusion
Trust Center
Internet Safety and Cybersecurity Education
Investors
Legal



×
0 Alerts
undefined

 * No new notifications at this time.

Download
 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

Buy
 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Find a Partner
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

Region
 * The Americas
 * United States
 * Brasil
 * Canada
 * México

 * Asia Pacific
 * Australia
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)

 * Malaysia
 * New Zealand
 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

 * Europe, Middle East & Africa
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Middle East and North Africa

 * Nederland
 * Norge (Norway)
 * Polska (Poland)
 * Россия (Russia)
 * South Africa
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

Log In
 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

Contact Us
 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)


 * No new notifications at this time.
 * No new notifications at this time.

 * Scan Engines
 * All Pattern Files
 * All Downloads
 * Subscribe to Download Center RSS

 * Home Office Online Store
 * Renew Online
 * Free Tools
 * Find a Partner
 * Contact Sales
 * Locations Worldwide
 * 1-888-762-8736 (M-F 8am - 5pm CST)
 * Small Business
 * Buy Online
 * Renew Online

 * The Americas
 * United States
 * Brasil
 * Canada
 * México

 * Asia Pacific
 * Australia
 * Hong Kong (English)
 * 香港 (中文) (Hong Kong)
 * भारत गणराज्य (India)
 * Indonesia
 * 日本 (Japan)
 * 대한민국 (South Korea)

 * Malaysia
 * New Zealand
 * Philippines
 * Singapore
 * 台灣 (Taiwan)
 * ประเทศไทย (Thailand)
 * Việt Nam

 * Europe, Middle East & Africa
 * België (Belgium)
 * Česká Republika
 * Danmark
 * Deutschland, Österreich Schweiz
 * España
 * France
 * Ireland
 * Italia
 * Middle East and North Africa

 * Nederland
 * Norge (Norway)
 * Polska (Poland)
 * Россия (Russia)
 * South Africa
 * Suomi (Finland)
 * Sverige (Sweden)
 * Türkiye (Turkey)
 * United Kingdom

 * My Support
 * Log In to Support
 * Partner Portal
 * Home Solutions
 * My Account
 * Lost Device Portal
 * Trend Micro Vault
 * Password Manager
 * Customer Licensing Portal
 * Online Case Tracking
 * Premium Support
 * Worry-Free Business Security Services
 * Remote Manager
 * Cloud One
 * Referral Affiliate
 * Referral Affiliate

 * Contact Sales
 * Locations
 * Support
 * Find a Partner
 * Learn of upcoming events
 * Social Media Networks
 * Facebook
 * Twitter
 * Linkedin
 * Youtube
 * Instagram
 * 1-888-762-8736 (M-F 8-5 CST)

undefined



 * Definition
 * Ransomware


RANSOMWARE

 * Email
 * Facebook
 * Twitter
 * Google+
 * Linkedin


 * Latest Ransomware News
 * The History and Evolution of Ransomware
   * Early Years
   * Ransomware Spreads Outside Russia
   * The Rise of Reveton and Police Ransomware
   * The Evolution to Crypto-ransomware
   * The Foray into Cryptocurrency Theft
   * Files to Encrypt
   * Ransomware as a Service
   * Ransomware Evolved: Modern Ransomware
 * The Biggest Attack to Date
 * The Future of Ransomware
 * The Bitcoin Connection
 * Ransomware Defense, Prevention, and Removal
 * Latest Notable Ransomware

View Ransomware Past, Present, and Future


RANSOMWARE DEFINITION

Ransomware is a type of malware that prevents or limits users from accessing
their system, either by locking the system's screen or by locking the users'
files until a ransom is paid. More modern ransomware families, collectively
categorized as cryptoransomware, encrypt certain file types on infected systems
and force users to pay the ransom through certain online payment methods to get
a decryption key.


RANSOM PRICES AND PAYMENT

Ransom prices vary depending on the ransomware variant and the price or exchange
rates of digital currencies. Thanks to the perceived anonymity offered by
cryptocurrencies, ransomware operators commonly specify ransom payments in
bitcoin. Recent ransomware variants have also listed alternative payment options
such as iTunes and Amazon gift cards. It should be noted, however, that paying
the ransom does not guarantee that users will get the decryption key or unlock
tool required to regain access to the infected system or hostaged files.


HOW DOES RANSOMWARE SPREAD

Users might encounter this threat through a variety of means. Ransomware can be
downloaded onto systems when unwitting users visit malicious or compromised
websites. It can also arrive as a payload that is either dropped or downloaded
by other malware. Some ransomware are delivered as attachments from spammed
email, downloaded from malicious pages through malvertisements, or dropped by
exploit kits onto vulnerable systems.

Once executed in the system, ransomware can either lock the computer screen or,
in the case of cryptoransomware, encrypt predetermined files. In the first
scenario, a full-screen image or notification is displayed on an infected
system's screen, which prevents a victim from using their system. This
notification also details instructions on how a user can pay the ransom. In the
second scenario, ransomware prevents access to potentially critical or valuable
files like documents and spreadsheets.

Ransomware is considered "scareware" as it forces users to pay a fee (or ransom)
by scaring or intimidating them. In this sense, it is similar to FakeAV malware,
but instead of capturing the infected system or encrypting files, FakeAV shows
fake antimalware scanning results to coax users into purchasing bogus
antimalware software.

--------------------------------------------------------------------------------


LATEST RANSOMWARE NEWS

 * LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion
   Groups: Ransomware in Q1 2022
 * Ransomware Spotlight: RansomEXX
 * Ransomware Spotlight: AvosLocker
 * Ransomware Spotlight: Hive
 * Navigating New Frontiers: Trend Micro 2021 Annual Cybersecurity Report

--------------------------------------------------------------------------------


THE HISTORY AND EVOLUTION OF RANSOMWARE


EARLY YEARS

Cases of ransomware infection were first seen in Russia between 2005 and 2006.
Trend Micro published a report on a case in 2006 that involved a ransomware
variant (detected as TROJ_CRYZIP.A) that zipped certain file types before
overwriting the original files, leaving only the password-protected zip files in
the user’s system. It also created a text file that acted as the ransom note
informing users that the files can be retrieved in exchange for US$300.

In its earlier years, ransomware typically encrypted particular file types such
as .doc, .xls, .jpg, .zip, .pdf, and other commonly used file extensions.

In 2011, Trend Micro published a report on an SMS ransomware threat that asked
users of infected systems to dial a premium SMS number. Detected as
TROJ_RANSOM.QOWA, this variant repeatedly displayed a ransomware page to users
until they paid the ransom by dialing a certain premium number.

Another notable report involved a ransomware type that infects the Master Boot
Record (MBR) of a vulnerable system, preventing the operating system from
loading. To do this, the malware copies the original MBR and overwrites it with
malicious code. It then forces the system to restart so that the infection takes
effect and displays the notification (in Russian) once the system restarts.

View infographic: Ransomware 101 - What, How, & Why


RANSOMWARE SPREADS OUTSIDE RUSSIA

Ransomware infections were initially limited to Russia, but due to ransomware’s
popularity and profitable business model, it soon found its way to other
countries across Europe. By March 2012, Trend Micro observed a continuous spread
of ransomware infections across Europe and North America. Similar to
TROJ_RANSOM.BOV, this new wave of ransomware displayed a notification page
(supposedly from the victim’s local police agency) instead of the typical ransom
note (discussed more thoroughly in the section titled “The Rise of Reveton and
Police Ransomware”).

During this period, different tactics were used to spread ransomware. A case in
2012 involved the website of a popular French confectionary that was compromised
to serve TROJ_RANSOM.BOV. This watering hole tactic resulted in widespread
infections both in France and Japan, where the shop also had significant fan
bases. It is also worth noting that instead of the usual ransom note,
TROJ_RANSOM.BOV displayed a fake notice from the French police agency,
Gendarmerie Nationale.



HIDE


THE RISE OF REVETON AND POLICE RANSOMWARE

Reveton is a ransomware type that impersonates law enforcement agencies. Known
as “police ransomware” or “police trojans,” these malware are notable for
showing a notification page purportedly from the victim’s local law enforcement
agency. This page informs them that they were caught doing an illegal or
malicious activity online.

To know which local enforcement agency is applicable to users, Reveton variants
track the geographical location of their victims. Thus, affected users living in
the US receive a notification from the FBI, while those located in France are
shown a notice from the Gendarmerie Nationale.

Reveton variants also employ a different payment method compared to early
ransomware attacks. Once a system is infected with a Reveton variant, users are
prompted to pay through UKash, PaySafeCard, or MoneyPak. These payment methods
afford ransomware perpetrators their anonymity, as both Ukash and PaySafeCard
have a faint money trail.

In 2012, different types of Reveton variants were seen exhibiting new
techniques. In the latter part of the same year, Trend Micro reported on
variants that played an audio recording using the victim’s native language, as
well as another variant that used a fake digital certificate.


THE EVOLUTION TO CRYPTOLOCKER AND CRYPTORANSOMWARE

In late 2013, a new type of ransomware that encrypted files aside from locking a
system emerged. The encrypted files ensured that victims were forced to still
pay the ransom even if the malware itself was deleted. Due to its new behavior,
it was dubbed as “CryptoLocker.” Like previous ransomware types,
cryptoransomware demands payment from affected users in exchange, this time, for
a decryption key to unlock the encrypted files.





Although the ransom note in CryptoLocker only specifies “RSA-2048” as the
encryption method used, analysis shows that the malware uses AES + RSA
encryption.

RSA is asymmetric key cryptography, which means it uses two keys. One key is
used to encrypt the data and another is used to decrypt the data (one key,
called the public key, is made available to any outside party; the other is kept
by the user and is called the private key.) AES uses symmetric keys, which means
that it uses the same key to encrypt and decrypt information.

The malware uses an AES key to encrypt files. The AES key for decryption is
written in the files that are encrypted by the malware. However, this key is
encrypted with an RSA public key embedded in the malware, which means that a
private key is needed to decrypt it.

Further research revealed that a spam campaign was behind the CryptoLocker
infections. The spammed messages contained malicious attachments that belonged
to TROJ_UPATRE, a malware family characterized by its small file size and simple
downloading function — it downloads a ZBOT variant, which then downloads the
CryptoLocker malware.

Near the end of 2013, a new variant of CryptoLocker emerged — this time, with
propagation routines. This variant, detected as WORM_CRILOCK.A, can spread via
removable drives, a routine unheard of in other CRILOCK variants. This means
that the malware can easily spread compared to other variants. Additionally, it
does not rely on downloader malware like CRILOCK to infect systems; rather, it
pretends to be an activator for software used on peer-to-peer (P2P) file-sharing
sites. Technical differences have led some researchers to believe that this
malware was produced by a copycat.

Afterward, another file-encrypting ransomware type soon came into the picture.
The cryptoransomware known as CryptoDefense or CryptorBit (detected as
TROJ_CRYPTRBIT.H) encrypts database, web, office, video, image, script, text,
and other non-binary files. It also deletes backup files to prevent the
restoration of encrypted files and demands payment for a decryption key for the
locked files.


THE FORAY INTO CRYPTOCURRENCY THEFT

Ransomware soon began to incorporate yet another element: cryptocurrency (such
as bitcoin) theft. In 2014, Trend Micro saw two variants of a new malware called
BitCrypt. The first variant, TROJ_CRIBIT.A, appends “.bitcrypt” to any encrypted
files and displays a ransom note in English. The second variant, TROJ_CRIBIT.B,
appends the file name with “.bitcrypt 2″ and uses a multilingual ransom note in
10 languages. CRIBIT variants use the encryption algorithms RSA(426)-AES and
RSA(1024)-AES to encrypt the files and specifies that the payment for unlocking
files be made in bitcoins.

It was also discovered that a variant of the Fareit information stealing
malware, TSPY_FAREIT.BB, downloads TROJ_CRIBIT.B. This Fareit variant can steal
information from various cryptocurrency wallets, including wallet.dat (Bitcoin),
electrum.dat (Electrum), and .wallet (MultiBit). These files contain important
information such as transaction records, user preferences, and accounts.


FILES TO ENCRYPT

Earlier cryptoransomware types targeted .doc, .xls, .jpg, .zip, .pdf, and other
commonly used files to encrypt them. Cybercriminals have since included a number
of other file types that are critical to businesses, like database files,
website files, SQL files, tax-related files, CAD files, and virtual desktop
files.


RANSOMWARE AS A SERVICE

When the ransomware as a service (RaaS) model entered the picture, it made it
easier for a variety of attackers, even those who have little technical
knowledge, to wield ransomware against targets. RaaS involves selling or renting
ransomware to buyers who are called affiliates, and this model can be credited
as one of the primary reasons why ransomware attacks have been proliferating
rapidly.

The RaaS-operating criminal group first needs to develop or acquire the
ransomware software and infrastructure. They then proceed to recruit affiliates
through online forums, Telegram channels, or personal connections, with some
operators investing as much as US$1 million for recruitment efforts. Once
enlisted, affiliates can then launch their own attacks. RaaS provides a win-win
situation and a high payout for both operators and affiliates. Affiliates can
earn payouts without having to develop the ransomware themselves, while
operators can directly make a profit from their affiliates. The payouts are
normally organized using a revenue model for RaaS subscriptions. The
possible revenue models besides subscription are one-time payments, profit
sharing, and affiliate marketing.


AN EVOLUTION: MODERN RANSOMWARE

After the shift to cryptoransomware, extortion malware has continued to evolve,
adding features such as countdown timers, ransom amounts that increase over
time, and infection routines that enable them to spread across networks and
servers. Threat actors continue experimenting with new features, such as
offering alternative payment platforms to make ransom payments easier, routines
that threaten to cause potentially crippling damage to non-paying victims, or
new distribution methods.

Targeted Ransomware and Double Extortion

These developments eventually lead to the appearance of targeted ransomware.
Targeted ransomware is also known as big-game hunting and human-operated
attacks. By taking a targeted approach, threat actors have found a new way of
revitalizing ransomware variants. As with targeted attacks, modern ransomware
variants are tailored for specific victims and take more preparation and
research. This means that threat actors have had to narrow down their targets to
entities that are more likely to lead to bigger payoffs if attacked.



WATCH TO LEARN HOW THREAT ACTORS, SUCH AS THOSE BEHIND NEFILIM, LAUNCH TARGETED
RANSOMWARE ATTACKS 

Present iterations of targeted ransomware have the added challenge of double
extortion. Through their targeted approach, threat actors come to know which
data is most valuable to their targets. By adding double extortion to their
attacks, they coerce their victims into complying with their demands. Threat
actors force victims into compliance not only by encrypting files but also by
threatening to publicize stolen sensitive data if their demands are not met.

The following are some of the most notable targeted ransomware families seen in
2020.



Timeline of notable ransomware attacks that involved double extortion in 2020

Ryuk was among the first ransomware to take a targeted approach. First
encountered in 2018, it created a new standard for future ransomware variants.
Ryuk is notable for its choice in high-profile targets, which included the
fatigued healthcare industry in 2020. Conti, which became one of the most
detected ransomware families in 2021, is reportedly the successor of Ryuk.

REvil, aka Sodinokibi, is one of the most notorious ransomware families that
victimized high-profile companies in 2021, including meat supplier JBS and
software company Kaseya. It has been linked to the now-defunct GandCrab
family. Apart from threatening victims with DDoS and directly contacting
customers, business partners, and the media, REvil operators have also auctioned
off stolen data as part of their double extortion strategies. 

Nefilim was discovered early into 2020. Like many ransomware variants of that
year, it used double extortion tactics and had data exfiltration capabilities.
What’s notable about Nefilim is its use of living-of-the-land techniques to stay
hidden in its victims’ systems.

Clop got on the double extortion bandwagon in 2020, when its operators
publicized the data of a pharmaceutical company. Since then, the ransomware’s
extortion strategies have become progressively devastating, such as going after
top executives and customers.

LockBit, which version 2.0 surfaced in July 2021, is capable of automatic
encryption of devices across Windows domains by abusing Active Directory (AD)
group policies, prompting the operators behind it to claim that it’s one of the
fastest ransomware variants in the market today. In October 2021, its operators
announced LockBit Linux-ESXi Locker version 1.0, which signifies its efforts to
expand its target Linux hosts.


THE BIGGEST ATTACK TO DATE

Though ransomware routines are not altogether new, they still work and so are
still used by operators. Case in point: The ransomware variant WannaCry (aka
WCry), which originally spread via malicious Dropbox URLs embedded in spam, took
an unexpected turn in May 2017, when it began exploiting a recently patched
vulnerability in the Server Message Block (SMB). In turn, this has led to the
biggest ransomware attack to date and, in 2020, WannaCry remained one of the
most detected ransomware families across the globe.

Even before WannaCry reared its ugly head, companies and individuals worldwide
had already been suffering the dire consequences of such threats. We document
all of this in our report titled, “Ransomware: Past, Present, and Future.” 



2020 regional distribution of ransomware threats based on Trend Micro detection


THE FUTURE OF RANSOMWARE

Were ransomware to change in a few years, it would not be surprising. In terms
of potential, they can evolve into malware that disable entire infrastructures
until a ransom is paid. It is worth emphasizing that these infrastructures could
be critical not only to a business’s operation, but also to that of a city or
even a nation. Cybercriminals might also soon further develop attacks on
industrial control systems (ICSs) and other critical infrastructures to paralyze
not just networks but also ecosystems. At present, ransomware campaigns are
already taking on high-profile and critical targets in the healthcare,
transportation, and government sectors.

Organizations need to be prepared for the possibility of more threat actors or
groups shifting to and joining the ransomware bandwagon. The theme of double
extortion seems to indicate how ransomware operators will continue to find new
ways of increasing the stakes for their victims and cornering them into meeting
their demands instead of just walking away. Legitimate tools or
living-of-the-land components will likely continue to be part of attacks in the
future, with threat actors choosing key components based on the profile of their
targets.

With enough preparation and by using the techniques of targeted attacks,
cybercriminals might aim for even bigger targets, like the industrial robots
that are widely used in the manufacturing sector, or the infrastructures that
connect and run today’s smart cities. Online extortion is bound to develop from
taking computers and servers hostage to eventually doing the same to any type of
insufficiently protected connected device, including smart devices and critical
infrastructures. The return on investment (ROI) and opportunities for
development that the targeted approach has opened will ensure that it continues
in the future.


THE BITCOIN CONNECTION

With the exception of some ransomware families that demand high amounts,
ransomware variants typically ask for 0.5 to 5 bitcoins (as of 2016) in exchange
for a decryption key. This is important to note for two reasons: First, some
variants increase the ransom the more time lapses that it remains unpaid.
Secondly, the Bitcoin exchange rate is on the rise. In January 2016, one bitcoin
was worth US$431. Bitcoin's value has risen dramatically since then, topping out
at US$1,082.55 at the end of March 2017.


RANSOMWARE DEFENSE

Although there is no silver bullet with regard to stopping ransomware, a
multilayered approach that prevents it from reaching networks and systems is the
best way to minimize the risk.

For enterprises, email and web gateway solutions such as Trend Micro™ Deep
Discovery™ Email Inspector and Trend Micro™ InterScan™ Web Security prevent
ransomware from reaching end users. At the endpoint level, Trend Micro Smart
Protection Suites features behavior monitoring and application control, as well
as vulnerability shielding to minimize the risk of getting infected by
ransomware threats. Trend Micro Deep Discovery Inspector detects and blocks
ransomware on networks, while Trend Micro™ Deep Security stops ransomware from
reaching enterprise servers — whether physical, virtual, or in the cloud.

Organizations can also consider Trend Micro Cloud One™ – Workload Security,
which has a virtual patching feature that can protect the system from exploits.
Since some of the malware’s techniques can bypass signature-based security
agents, technologies like Trend Micro Behavior Monitoring and Machine Learning
(ML) can be used to prevent and block those threats.

Enterprises can also take advantage of Trend Micro XDR, which collects and
correlates data across endpoints, emails, cloud workloads, and networks,
providing better context and enabling investigation in one place. This, in turn,
allows teams to respond to similar threats faster and detect advanced and
targeted threats earlier.

For small and medium-sized businesses, Trend Micro Worry-Free Services Advanced
offers cloud-based email gateway security through Trend Micro™ Hosted Email
Security. Its endpoint protection also delivers several capabilities such as
behavior monitoring and a real-time web reputation service that detects and
blocks ransomware.

For home users, Trend Micro Security 10 provides robust protection from
ransomware by blocking malicious websites, emails, and files associated with
this threat.


HOW TO PREVENT RANSOMWARE ATTACKS

To protect yourself and your system from ransomware, follow these recommended
steps:

 * Avoid opening unverified emails or clicking links embedded in them.
 * Back up important files using the 3-2-1 rule: Create three backup copies on
   two different media with one backup in a separate location.
 * Regularly update software, programs, and applications to protect them from
   the latest vulnerabilities.
 * Create a culture of security and equip personnel with adequate knowledge on
   ransomware and other threats that utilize phishing and unsecure accounts in
   their campaigns.
 * Enforce the principle of least privilege to prevent users from running
   certain programs that can be used by ransomware variants.
 * Limit access to shared or network drives and turn off file sharing. This
   minimizes the risk of a ransomware infection spreading to other devices.

Organizations can also mitigate the effects of public shaming dealt by the
conditions of ransomware’s double extortion scheme by being responsible and
taking the following steps:

 * Notify law enforcement about the attack and the extent of the data breach.
 * Follow data regulation protocols such as the General Data Protection
   Regulation (GDPR) and make the necessary disclosures and notifications.
 * Prevent similar attacks from succeeding by addressing the security issues
   exploited by the attack.


RANSOMWARE TOOLS AND SOLUTIONS

Trend Micro offers free tools such as the Machine Learning Assessment Tool that
provides endpoint security preventing threats from entering the network and the
Anti-Threat Toolkit (ATTK) that scans potentially compromised machines for
ransomware and other forms of malware.

 


LIST OF NOTABLE RANSOMWARE FAMILIES




Family Name Notable Features Conti The distribution and execution of the
ransomware payload are done via the creation and execution of scheduled tasks on
remote systems. REvil After execution, REvil can perform several steps,
including: privilege escalation via CVE-2018-8453 and decryption of its JSON
configuration file to identify elements that will dictate how it will proceed
with its routines. BlackCat (aka ALPHV) Coded in the Rust programming language,
the operators of this ransomware is infamous for employing multilevel extortion
techniques. Nefilim Its code shares many notable similarities to that of the
Nemty 2.5 ransomware. It uses several legitimate tools and has data exfiltration
capabilities used for its double extortion tactics. LockBit  Automatically
encrypts devices across Windows domains by abusing Active Directory (AD) group
policies.  Hive The operators of this double extortion ransomware primarily
targeted the US in 2021, with victim organizations mostly coming from the real
estate, IT, and manufacturing industries. RansomExx (aka Exx) Upon execution,
the RansomExx Linux version calls a function referred to as GeneratePreData,
which is responsible for the creation of a 256-bit AES key using both
pseudo-random values from native Linux functions and mbedtls operations. Clop
FIN11 used a web shell to exfiltrate data from FTA and deliver the Clop
ransomware as a payload.

Visit the Threat Encyclopedia for the latest notable ransomware





SECURITY NEWS

 * Trend Micro Cloud App Security Threat Report 2021
 * An Analysis of Azure Managed Identities Within Serverless Environments
 * Exposing Earth Berberoka: A Multiplatform APT Campaign Targeting Online
   Gambling Sites
 * LockBit, Conti, and BlackCat Lead Pack Amid Rise in Active RaaS and Extortion
   Groups: Ransomware in Q1 2022
 * Ransomware Spotlight: RansomEXX


SECURITY INTELLIGENCE BLOG




 * Contact Sales
 * Locations
 * Careers
 * Newsroom
 * Trust Center
 * Privacy
 * Accessibility
 * Support
 * Site map

 * linkedin
 * twitter
 * facebook
 * youtube
 * instagram
 * rss

Copyright © 2022 Trend Micro Incorporated. All rights reserved.