10 Ways Ransomware Attackers Pressure you into Paying the Ransom
Ransomware operations used to be much simpler; attack infects systems and encrypt data on them, and then demands ransom from the victim. However, with ransomware tactics now well-documented from past attacks, many businesses have developed mechanisms to protect themselves and recover quickly from ransomware attacks without paying cybercriminal gangs. Threat actors are aware of these countermeasures and have raised the stakes in order to get ransom by using various tactics.
Some of the ways ransomware operators pressure victims into paying ransom are discussed below:
1. Threaten to Publicly Release Stolen Data
Ransomware operators usually make copies* first before encrypting victims’ data after an infection. This data is now used as leverage to pressure victims into paying a ransom. Even if the victim organization has a reliable backup, they often cannot risk company and customer data being published online due to embarrassment or legal consequences. When a victim is uncooperative, attackers may threaten to publish stolen data on publicly available sites for competitors, customers, and the media to see.
Cybercriminals can also threaten to auction stolen data on underground forums and the dark web.
2. Warn Victims Against Reporting
The first response of many organizations to cyberattacks is to notify law enforcement agencies who can provide guidance on how to restore the system and avoid paying a ransom. To prevent this, ransomware attackers may warn victims against contacting law enforcement agencies.
3. Deleting Backups
Another strategy cybercriminals use to pressure businesses involves deleting all backups on the target system. In addition, backup software is removed from the system. Some go as far as requesting data backup vendors to delete the victims’ backups. All these actions are to leave a business with no choice but to pay the cybercriminals.
4. Reaching out to Business Partners
If a ransomware gang’s demand is not met, they may attempt to coerce victim organizations by contacting their partners and customers about ongoing ransomware attacks. The partners are told to encourage ransom payment or risk the leakage of their personal data online.
5. Messaging Employees and Executives.
Attackers can cause distress by placing a call or sending emails to employees and senior executives. They may threaten to reveal personal information if their demands are not met.
6. Changing Passwords
Ransomware gangs often create a new domain admin account after compromising a network. Using this new account, they reset the password for all other domain admin accounts. Thus, IT admins are blocked from gaining access into the network to fix or limit the damage caused by the ransomware.
7. Launching Distributed Denial of Service (DDoS) Attacks
Attackers have been found to resort to distributed denial of service attacks against the victim organization in order to force their cooperation. DDoS attacks distract the security team from tackling the ransomware attack head-on.
8. Phishing Employees
Another pressure tool for attackers is to launch a phishing attack against the employees of a compromised organization. Compromised employees’ accounts are then used to contact the IT security and management team as a warning to prepare for more attacks if the ransom is not promptly paid.
9. Recruiting Insiders
Some cybercriminals have discovered that it is much easier to infect an organization with ransomware with the aid of insiders. Disgruntled or dishonest employees are recruited to help compromise organizations’ systems with malware.
This method may also give direct access to critical system infrastructure that may not be accessible remotely hence increasing the damage caused by the ransomware attack.
10. Distributing Ransom notes
Some ransomware operators have been observed to flood victim organizations with printed ransom notes using the victim’s printers and POS terminals. This sends the message that the organization is insecure and can’t be trusted with sensitive data.
HOW TO DEFEND YOUR BUSINESS
– A series of defenses are needed to protect against ransomware attacks.
– Conduct employee awareness training to highlight examples of ransomware and the process of infection.
– Establish an open medium through which employees can easily report any ransom messages or proposals they get from hackers.
– Encrypt all the important business and personal data on your organization’s systems so they can’t be used as leverage.
– Develop an incident response plan to handle potential ransomware attacks.
– Disable all internet-facing remote access protocols in your organization’s system.
– Deploy cloud-hosted management console and enable multi-factor authentication for all account access.
******
Ransomware attacks are increasing with cybercriminal gangs using coercive tactics to improve attack success. It is up to your organization to device protective mechanisms against them. In order to protect your business and customers’ data from falling into the wrong hands, engage an expert to harden your system’s security by getting in touch with SDTEK today.
The post 10 Ways Ransomware Attackers Pressure you into Paying the Ransom appeared first on SDTEK | San Diego, CA.
