Module 1 · 1.3

English

Nederlands English Deutsch

Ransomware and extortion

Module 1: Why you're a target · Reading time: 10 minutes

Learning objective: After this lesson you can explain how ransomware gets in, what double extortion is and which measures limit the damage.
Key concepts: ransomware, encryption, double extortion, initial access, lateral movement, ransom, decryptor (No More Ransom)

What ransomware is

Ransomware is malicious software that makes your files or systems unusable and then demands a ransom. Usually this happens through encryption: the software turns your files into unreadable data, with a key that only the attacker has. You can still see the files, often with a strange extension added, but you can no longer open them. A message appears on the screen or in every folder: pay within a few days, or everything will be gone.

Encryption itself is not malicious. It's the same technique that protects your laptop if it's stolen (lesson 5.2) and that secures your connection to a website. The difference is who holds the key. Good encryption cannot be cracked. That's why "we'll just get it decrypted" is almost never an option, unless the makers of the ransomware have made a mistake.

According to the NCSC, ransomware affects not only files, but also systems and backups. That last point is the most important part of this lesson.

How it gets in

A ransomware attack isn't a single moment, but a series of steps. It starts with initial access: the first foot in the door. The most common routes:

Route of access	How it works	What stops it
Phishing with an attachment or link	An employee opens an "invoice" or "delivery note" that launches malicious software	Awareness (lesson 9.2), updates, limited permissions
Stolen login details	A leaked password works on the webmail, the VPN or remote management	Unique passwords, two-factor authentication (2FA) (module 2)
A known vulnerability in a system connected to the internet	An outdated VPN server, firewall, NAS or website with a publicly known vulnerability	Updating quickly (lesson 5.1), not leaving things open unnecessarily
Remote management that's left open	A program for working on a PC remotely, reachable from the entire internet	Only through a secured connection, with 2FA
A supplier	The IT company or software of a supplier is abused	Agreements and minimal permissions (module 7)

After the initial access, an attacker often waits. He looks around, searches for administrator accounts and jumps from computer to computer. This is called lateral movement. He's mainly looking for two things: where the important data is stored and where the backups are. Only once he's found both does he strike, often at night or at the weekend, when no one notices.

Why a connected backup doesn't help

Many small businesses have a backup: an external drive that's always connected to the PC, or a network drive (NAS) that a copy is sent to every night. That's better than nothing in case of a broken hard drive. Against ransomware, it often doesn't help.

The reason is simple. Ransomware encrypts everything the infected computer or the compromised account can reach. If the backup drive is connected to the PC, the ransomware can reach it. If the backup is on a network drive you log in to with the same account, the ransomware can reach it. An attacker who has quietly looked around sometimes even deliberately deletes the backups before encrypting.

The same applies to synchronisation. A folder that's automatically synchronised with the cloud also synchronises the encrypted version. Sometimes you can still go back to an older version of a file, but that depends on the service and how long it keeps versions.

A backup that survives ransomware has at least one copy that the attacker cannot reach or cannot change: a drive that's kept loose in a drawer, or a backup with a separate provider with its own login that you don't use on your work computer, or storage that makes changing and deleting technically impossible for a period of time. In module 6 you'll set this up step by step. A backup that your hosting provider makes on separate servers, apart from your package, is already an off-site copy for your website and mail. Do check how long it's kept and who can delete it.

Double extortion

In the past, a good backup was the complete answer to ransomware: restore and you're done. Attackers have adapted. With double extortion, they first steal a copy of your data and only then encrypt it. Then there are two threats:

Pay, or you won't get your files back.
Pay, or we'll publish your data: customer files, quotes, salary data, mailboxes.

A backup helps against the first, not against the second. The NCSC also warns that attackers sometimes threaten to publish stolen data. In addition, stealing personal data is in itself a data breach, with a duty to report to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) (lesson 8.2), regardless of whether you pay.

Sometimes an attacker goes even further and approaches your customers or business partners directly, telling them their data was stolen from you. The pressure then falls not just on you, but on your reputation too.

Pay or not?

The advice from government bodies and the police is unanimous: better not to pay. No More Ransom, the initiative set up by Europol and the police of various countries, among others, puts it this way: paying a ransom offers no guarantees. There are good reasons for this:

You have no guarantee you'll receive a working key, or that decryption will succeed.
You have no guarantee that stolen data will actually be deleted afterwards.
You confirm that your business pays, which makes you an attractive target for a future attack.
You fund the next attacks on others.
The way in hasn't been closed yet. Without an investigation, it can happen again.

The NCSC calls restoring from a backup the most reliable solution. If that doesn't work, check whether a decryptor exists: a free program that can decrypt files from a particular ransomware family, because researchers found a flaw in that family or seized keys. No More Ransom (https://www.nomoreransom.org) collects these decryptors and helps you work out which ransomware you're dealing with. There isn't a solution for every family by far, but checking costs nothing.

In any case, report it to the Dutch police, and check whether you have a duty to report: to the Dutch Data Protection Authority (AP) if personal data was affected, to the NCSC if you fall under the Cyberbeveiligingswet (lesson 9.1), and sometimes to a client under your contract.

What limits the damage

You can reduce the chance of an attack and limit the damage if it still happens. An overview, with the lesson where you learn it:

Update, especially everything connected to the internet: VPN, router, NAS, website (lesson 5.1).
Two-factor authentication (2FA) on mail, remote management and all administrator accounts (lessons 2.3 and 2.4).
Minimal permissions: don't work daily with an administrator account, and don't give everyone access to everything (lesson 7.1).
A backup out of reach of your normal accounts, and regularly test whether restoring works (module 6).
An incident card so everyone knows what to do: disconnect the network, don't just switch things off, call (lessons 8.1 and 8.3).
Awareness: a colleague who immediately reports opening a strange attachment gives you hours of head start (lesson 9.2).

In practice: what it looks like

An example, put together from situations that occur often. An installation company with twelve employees had a VPN server to access files from home. The firmware hadn't been updated for a year and a half. Through a known vulnerability, an attacker got in, looked around for a week and found the administrator account of the network drive. On a Saturday night, the PCs, the network drive and the USB drive with the backup connected to it were encrypted. What remained: the mail and the website, which were hosted by a hosting provider with their own backup, and an old copy of the accounts on a drive the bookkeeper kept at home. This allowed the company to start invoicing again after a few days. The quotes and drawings from the past few months were gone.

An update and one loose drive in a drawer would have made the difference between a few days and a few months.

Summary

Ransomware encrypts files, systems and backups and demands a ransom; good encryption cannot be cracked.
Ransomware gets in through phishing, stolen passwords, un-updated systems connected to the internet, remote management or a supplier; the attacker often looks around first.
A backup connected to the computer or reachable with the same account is often encrypted along with everything else.
With double extortion, data is stolen first; a backup doesn't help against the threat to publish it, and it counts as a data breach.
Better not to pay; restore from a backup, check No More Ransom for a decryptor and report it to the police.

Quiz

Exercise

Exercise D1.3: What if it happens tonight? Go through what ransomware could encrypt in your own business tonight. Write down where your backups are, whether they're reachable from a normal work computer or with a normal account, and which systems are connected to the internet. Then answer the reflection questions.

Exercise D1.3: What if it happens tonight?

Here's how to approach it: (1) Make a list of every place where important files are stored: PCs, laptops, network drive, cloud storage, email, accounts, website. (2) Write down for each place where its backup is kept, and whether that backup can be reached from an ordinary work computer or with an account you use daily. (3) Check which systems are connected to the internet and reachable from outside (VPN, remote management, NAS, router, website), and when they were last updated. (4) Check whether there is at least one copy that ransomware cannot reach (loose in a drawer, or with a separate provider with its own login). (5) Take a one off look at https://www.nomoreransom.org/en/index.html to see how the site works, so you know if you ever need it.

I know where all my important files are stored.
I know where the backup is for each location.
I know which backups can be reached from a work computer.
I know which systems are reachable from outside and whether they've been updated.
There is at least one copy out of reach (or it's on my plan for module 6).

What would you still have tomorrow morning if everything the office PC can reach gets encrypted tonight?

With double extortion, which data would cause the most damage if it ended up online?

Who do you call first?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing