Accelerated by digital transformation and the major transition to remote work, ransomware attacks have been on the rise. While the Colonial Pipeline attack grabbed the headlines back in 2021 due to the widespread knock-on impact of fuel shortages, notable brands, including Kia Motors, Acer, Accenture, ExaGrid, and public sector organizations like the Washington D.C. Metropolitan Police Department, fell foul to ransomware. The impacts were devastating, including system outages, data breaches, and millions of dollars in financial losses.
But ransomware attacks are preventable, if you understand the mechanics of these attacks, including the vectors and avenues that the bad guys use. To help reduce the chance of your organization becoming a victim, here’s a list of the 7 most common ransomware attack vectors, and tips on how to protect against them.
Malware is an umbrella term for any malicious software, including ransomware (although the terms are often used interchangeably). Malware can take the form of a Trojan horse that looks like a legitimate file but executes malicious code when the user opens or downloads it.
If the intent is to gain a ransom, then the malware will encrypt data on a victim’s computer and block the owner from accessing it. Once payment is received – usually by a stated deadline – access to the data is restored (although cybercriminals often exfiltrate the data for future nefarious purposes).
Phishing attacks are one of the most common delivery systems for ransomware. In these attacks, hackers successfully convince an individual to click on a link or open an attachment that then downloads ransomware to their system. This ransomware attack vector often takes the form of social engineering in which cyber criminals masquerade as someone the recipient trusts and tricks them into granting administrative access to corporate systems.
Malicious ransomware code can also be found in web scripts hidden in seemingly legitimate or compromised websites. This is a perfect attack vector for cybercriminals because victims believe they are visiting a trusted site. When an individual visits that site, the code is automatically downloaded and once executed it can infect the user’s system and move laterally across the organization, encrypting files and data.
Ads and pop-ups are another common web-based vector for ransomware attacks. They may appear genuine, but like phishing schemes they can trick people into clicking on them by posing as a trusted brand. At that point, they either direct the user to a new open window with malicious links or automatically download ransomware or other forms of malware to the user’s computer.
As users become more educated about email-based phishing schemes, hackers have taken to instant messaging platforms such as WhatsApp, Slack, Snapchat, Facebook Messenger, and Microsoft Teams to execute smishing campaigns. These threats work in much the same way as email attacks, where ransomware is launched when a user clicks on a link or attachment from a sender purporting to be a reputable company.
In the past, many organizations blocked these platforms but with the rise of remote work habits, instant messaging has become a critical collaboration tool for businesses everywhere, making these attacks hard to avoid.
Text messages are a hugely popular vehicle for ransomware. Spam, spoofing, and phishing messages are the main culprits, with attackers often using ransomware-as-a-service or malware-for-hire to easily and cost-effectively execute ransomware attacks. When a user clicks on a link, ransomware is downloaded to their device and can spread to everyone in their contact list, including co-workers.
Social engineering is one of the most successful ransomware attack vectors. Social engineering can include any of the tactics mentioned above, including phishing and smishing, or a combination of these. Through social engineering, ransomware attackers can gain administrative access to a computer system, allowing them to move swiftly throughout an organization’s digital environment and encrypt high-value files and data.
Ransomware operators take advantage of potential infection vectors in an organization’s attack surface. Reducing the threat of ransomware requires addressing multiple potential threat vectors, including:
To protect your organization against these ransomware attack vectors, consider the following:
Change perceptions in your organization that security is the sole responsibility of the Security Operations Center (SOC) and condition employees to view themselves as cyber foot soldiers. After all, the entire organization can be impacted by a cyber-attack, leading to downtime, lost productivity, financial losses, and significant disruption.
Conduct regular cyber awareness training, tabletop exercises, and security drills to reinforce lessons learned. By walking through a hypothetical ransomware incident, you can explain how these attacks happen, what employees should do if they find themselves targeted, and who to contact. Security teams can also launch mock phishing or smishing attacks to gauge how effective these awareness efforts have been, or not.
Basic cyber hygiene – like frequent system patching – is a powerful tool against ransomware attacks.
When Bitsight analyzed hundreds of ransomware events to estimate the relative probability that an organization will be a ransomware target, we found that organizations that delay applying patches correlated with increased ransomware risk. In fact, organizations with a patching cadence grade of D or F were more than seven times more likely to experience a ransomware event compared to those with an A grade.
Because ransomware attack vectors often begin as a seemingly benign link or attachment to an email, consider implementing email security protocols such as DKIM, SPF, and DMARC to reduce spoofing and to authenticate the origin of email messages.
To protect against instant messenger ransomware attacks, use anti-virus software that scans instant messages for suspicious links and attachments. Some security solutions also seek out and secure vulnerabilities on IM applications that hackers can exploit. You can also set up your corporate messaging platform so that only people on a whitelist can message each other.
Continuously monitor and scan your digital environment for the presence of malware and ransomware. With Bitsight, for example, you’ll get immediate insights into compromised systems that are infected with malware. Moreover, the Bitsight platform can uncover cybersecurity gaps, such as unpatched systems, misconfigured software, and other vulnerabilities that correlate with a higher potential for ransomware attacks.
The attack surface is expanding as AI becomes more embedded in enterprise and attacker workflows. Get the full picture on AI exposure, exploit pressure, and the underground trends security teams need to watch.
