What Is Ransomware?

Ransomware is a type of malicious software that encrypts your files. Often, the only way to decrypt and gain access to the files is by paying a “ransom” or fee to the attackers. The attackers might provide the decryption key allowing you to regain access to your files. Ransomware may spread to any shared networks or drives to which your devices are connected. We are continuing to see ransomware attacks make the news and GHC Information Security expects their frequency to increase in the foreseeable future.

How Can I Get Infected with Ransomware?
Common vectors for ransomware attacks include e-mails with malicious attachments or links to malicious websites. It’s also possible to get an infection through instant messaging or texts with malicious links. Antivirus may or may not detect a malicious attachment, so it’s important for you to be vigilant.

How Can I Protect Myself Against Ransomware?
There are two steps to protection against ransomware:

• Preparation. Back up your information regularly. Once a ransomware infection occurs, it’s often too late to recover the encrypted information. Your research project or other important information may be lost permanently.
• Identification. Ransomware typically appears as phishing e-mails, either with links to malicious websites or infected files attached. You might also see a ransomware attack perpetrated through a pop-up telling you that your computer is infected and asking you to click for a free scan. Another possible vector is malvertising, malicious advertising on an otherwise legitimate website.

Probably the Most Important Steps You Can Take to Prepare…

• Ensure that your information is backed up regularly and properly. Because ransomware can encrypt the files on your computer and any connected drives (potentially including connected cloud drives such as Dropbox), it’s important to back up your files regularly to a location that you’re not continuously connected to. For example, save your important files on a USB drive then store that device in a fireproof safe or safe deposit box.
• Ensure that you’re able to restore files from your backups.
• Ensure that antivirus/antimalware is up to date and functioning. But don’t rely on your antivirus to protect you! Most can’t detect or stop malicious attachments.
• Ensure that you’re keeping your system (and mobile devices) up to date with security updates. If you’re prompted by your computer or mobile device to accept updates, accept them at your earliest convenience.
• Don’t do day-to-day work using an administrator account. A successful ransomware attack will have the same permissions that you have when working. (If you’re not using an account with administrator privileges, the initial attack may be foiled.)

What Do I Do If I Think I’m Infected?

• Disconnect your device from wireless networks at GHC and your Wi-Fi at home.
• Isolate or shut down the infected computer. (If you’re on Wi-Fi, turn off the Wi-Fi. If you’re plugged into the network, unplug the computer. Infected systems should be removed from the network as soon as possible to prevent ransomware from attacking network or shared drives.)
• Contact a reliable computer repair vendor or seek guidance from the device manufacturer if it is still under warranty. Most devices can be restored to their factory defaults with instructions provided over the phone.