Ransomware

Attackers usually rely on encryption, but they also apply other pressure. They often steal data first and threaten to release it if the victim does not pay, a combination known as double extortion. Some threaten partners and clients or launch distributed denial of service attacks, and some steal data and extort the victim without deploying ransomware at all. Attackers typically demand the ransom in a cryptocurrency.

An incident can leave an organization unable to reach the data it needs to operate and deliver services, and recovery can be long and costly. CISA groups the common ways in as internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, an earlier malware infection, advanced forms of social engineering, and third parties and managed service providers. Some groups focus on large organizations, such as critical infrastructure providers and governments, that cannot tolerate long disruptions.

CISA advises keeping offline, encrypted backups of critical data and testing them regularly, because many ransomware variants look for reachable backups to delete or encrypt. It also advises a regularly exercised incident response plan, phishing-resistant multifactor authentication, regular vulnerability scanning and patching of internet-facing systems, and not exposing services such as remote desktop protocol to the internet.

Law enforcement does not encourage, endorse, or condone paying ransoms. Paying does not guarantee access to the data, leaves the computer infected, funds criminal groups, and makes the victim more likely to be targeted again. Some malware poses as ransomware but does not decrypt the files after payment; this is known as wiper malware.