What is Crypto Ransomware?

How Does Crypto Ransomware Work?

A ransomware attack is a multi-stage process including everything from initial access to demanding a ransom payment. Some of the key steps include the following:

Infection Methods

To encrypt files, ransomware needs access to the files on a victim’s machine. Some common attack vectors include the following:

• Phishing Emails: Phishing emails use social engineering to trick the recipient into installing the malware. The emails might have attachments infected with malware or include malicious links that point to infected web pages.
• Malicious Websites: Websites may have malware available for download. Often, this involves a trojan horse, which is malware that pretends to be legitimate software but actually infects the user’s computer.
• Compromised Accounts: Ransomware operators may also deploy malware using compromised user accounts. If a password is guessed or breached, the attacker can log in via RDP or VPN to plant their malware on corporate systems.

Encryption Process

Most ransomware uses a combination of symmetric and asymmetric encryption algorithms.

Symmetric encryption is highly efficient for bulk encryption. Ransomware uses it to encrypt files and deny their owners access to them. Asymmetric encryption is used to protect the symmetric encryption keys. If the public key is bundled with the malware, the ransomware can encrypt and store the symmetric encryption key alongside the encrypted files. The attackers keep only copy of the private key and can use it to decrypt the symmetric key once the victim has paid the ransom.

Ransomware’s encryption process has also evolved. For example, some ransomware variants will only encrypt part of a file. This enables the encryption process to occur more quickly — decreasing the risk of interruption — while still rendering the files unusable.

Ransom Notes and Demands

After file encryption is complete, the ransomware will display ransom notes to the victim. These typically inform the victim that they’ve been infected with ransomware and provide information on how the ransom should be paid.

Payment in Cryptocurrency

Crypto ransomware uses cryptocurrency for payments. If the victim elects to pay the ransom, they will purchase cryptocurrency and transfer it to the attacker’s account, whose address is likely included in the ransom note. Then, the attacker should provide a decryptor that can be used to restore the victim’s encrypted files.

Why Cryptocurrencies are Used for Ransom Payments

Cryptocurrencies are used for ransom payments for a few different reasons. The primary one is that they’re pseudonymous and not affiliated with the central banking system. Users’ cryptocurrency accounts aren’t linked to their real-world identity unless they go through an exchange that requires Know Your Customer (KYC). As a result, it can be difficult to trace a cryptocurrency payment to its recipient, protecting the attacker against detection.

Prevent Ransomware Attacks with Check Point

Ransomware has emerged as a leading threat to businesses due to the potential for lost data and significant financial losses for an organization. To learn more about how to manage your organization’s exposure to this threat, check out the CISO Guide to Ransomware Prevention.

Check Point’s Harmony Endpoint protects organizations against ransomware and other threats, including those outlined in the Cyber Security Report. To learn how Harmony Endpoint can help strengthen your organization’s endpoint security, register for a free demo today.