Ransomware Characteristics

© 2017Cybereason Inc. All rights reserved.

Ransomware CharacteristicsSets itself apart from other malware

© 2017 Cybereason Inc. All rights reserved.

It features unbreakable encryption, which means that you can’t decrypt the files on your own

It has the ability to encrypt all kinds of files, from documents to pictures, videos, audio files and other things you may have on your PC

Encryption

Go to ransomfree.cybereason.com

https://ransomfree.cybereason.com/


Scrambling file names and extensionsSocial engineering tricks!

It will add a different extension to your files, to sometimes signal a specific type of ransomware strain.

It can scramble your file names, so you can’t know which data was affected.




Ransom notes and Bitcoin

It will display an image or a message that lets you know your data has been encrypted and that you have to pay a specific sum of money to get it back.

It requests payment in Bitcoins, because this payment can’t be tracked by researchers or law enforcement.

Most of the time, ransom payments have a time-limit, pay up or lose the data! If you don’t pay before the deadline, the ransom may increase, or the data will be destroyed and lost forever.


Building botnets and infrastructure

Ransomware often recruits the infected machines into botnets, so criminals can expand and plan for future attacks.

It can spread to other machines connected in a local network.




Data exfiltration and localized languages

Ransomware has data exfiltration capabilities.

It also can include geographical targeting, meaning the ransom note is translated into the victim’s language, making the chances for the ransom to be paid to increase.




• Spam email campaigns that contain malicious links or attachments

• Security exploits in vulnerable software

• Internet traffic redirects to malicious websites

• Legitimate websites that have malicious code injected in their web

pages

• Drive-by downloads

• Malvertising campaigns

• Botnets

• Self-propagation: Spreading from one machine to another

• Ransomware-as-a-service: Earning a share of the ransom by helping

further spread ransomware

Some of the most common methods used by cybercriminals to spread ransomware


Can’t be detected by traditional AV

Ransomware uses a complex set of evasion techniques to go undetected by traditional antivirus.

Cybereason researches and evaluates the new ransomware strains (and other types of attacks) to continuously analyze and develop new detection and response techniques.




See how RansomFree by Cybereason keeps your data safe from never-before-seen ransomware.



Ransomware Characteristics

Technology

Transcript of Ransomware Characteristics