CanIPhish Logo
Language Color Theme

What is ransomware?

Ransomware is like a digital kidnapper, holding your computer hostage until you pay up! It's software that encrypts all your data and demands a ransom from you to decrypt it.

What is ransomware?

Ransomware is a type of malicious software that is designed to block access to data until a sum of money is paid. Ransomware attacks typically involve the attacker encrypting the victim's data and demanding a ransom from the victim to restore access.

View Options Again

Why should we care about ransomware?

It's important to protect against ransomware attacks because they can result in data loss, significant disruptions and costs for individuals and organisations. Ransomware attacks involve the attacker encrypting the victim's data and demanding a ransom to restore access.

View Options Again

Curious how cyber criminals spread ransomware?

Cyber criminals often use a combination of social engineering (i.e. manipulation) and exploitation of computer system vulnerabilities to deliver ransomware.
Cyber criminals may spread ransomware through email attachments. They may send emails that contain malicious attachments, which, when downloaded and opened, will install the ransomware on the victim's computer. This delivery method relies on social engineering.
Cyber criminals may spread ransomware by directing victims to malicious websites. When the victim visits the website, the ransomware may be automatically downloaded and installed on their computer. This delivery method relies on social engineering.
Cyber criminals may use exploit kits to spread ransomware. Exploit kits are sets of tools that are used to exploit vulnerabilities in computer systems and install malware, including ransomware. Exploit kits are often designed for mass exploitation and it allows criminals to scale their operations significantly.

Is the following statement True or False:
You should only download attachments in an email if the email is expected and from a trusted sender.

It's ok to download an attachment in an email if the email is expected and from a trusted sender. If the email raises any red flags such as it's unsolicited, calls for urgency, is from an unknown sender or contains suspicious wording or grammar, then you should report the email to your IT or Security team as a suspected phish.

View Options Again

What does ransomware do once it infects a computer?

It begins encrypting data on the infected computer. Once encrypted, ransomware will display a message demanding payment in the form of virtual currency (e.g. Bitcoin) in exchange for the decryption key.

What does ransomware do to data on your computer?

Ransomware encrypts data, which means it converts the data into a form that is unreadable without a decryption key.

View Options Again

Preventing ransomware

Ensuring you're protected against ransomware requires you to implement a variety of cyber security best practices. As a starting point, it's best to follow the three practices listed below.
One of the most effective ways to protect against ransomware is to ensure that all systems and software are kept up-to-date. This includes installing updates and patches as they become available, as these can fix vulnerabilities that can be exploited by ransomware.
Regularly backing up data is another important way to protect against ransomware. By regularly creating copies of important data, you can ensure that you have a copy available in case your data is encrypted by ransomware.
Cyber criminals often spread ransomware through email attachments and malicious websites. It is important to be cautious of suspicious emails and websites and to avoid opening attachments or clicking links from unknown sources. Instead, verify the authenticity of emails and websites before interacting with them.

Is the following statement True or False:
To prevent ransomware, we should store data in the cloud and make it publicly readable and writable.

Making data publicly readable and writable invites cyber criminals to encrypt the data and hold it for ransom. To prevent ransomware, data should be stored in a secure location, with backups stored in a separate location.

View Options Again

To prevent ransomware, we should

To deter ransomware attacks we should, be cautious of suspicious emails and websites, perform frequent backups and perform frequent software and system updates.

View Options Again

Ransomware recovery

Before restoring systems from a backup device, it's good practice to ensure that the cyber criminal no longer has access to your network. This is to ensure that they can't just re-encrypt restored data!

Why should we ensure cyber criminals no longer have access to our network before restoring data?

The main reason we want to ensure cyber criminals no longer have access to our networks when restoring from a ransomware attack is because they'll re-encrypt any restored data. The restoration of data may also prompt them to take further action to disrupt and destroy IT systems as it's an indicator that they likely won't be receiving their ransomware payment.

View Options Again

Why is ransomware growing?

Since the introduction of digital currencies such as Bitcoin, ransomware has exponentially grown in popularity. This is because cyber criminals now have a mechanism to anonymously accept funds from their illicit activities.

Wrapping up

If you open an email, visit a website, come across a file that seems suspicious or believe that your computer is infected with malware, don't hesitate to contact your IT or Security team for assistance.