Ransomware: a real and costly threat

Ransomware is powerful malware used by hackers to demand ransom payments. Increasingly widespread, they have made businesses their target of choice. Find out more about our anti-virus tips.

See all software Antivirus

What is ransomware?

The effects of ransomware on your device and data

Ransomware attacks all types of devices, from computers and servers to tablets and smartphones. The consequences of infection are numerous and disastrous:

• Infection of the device and restriction of access: access is restricted to the web browser, for example, and all other data and functions are blocked.
• Encryption of documents or images. In this case, you need to obtain the decryption key to recover your data. This is known as crypto-ransomware.
• Denial of service targeting a website: the website is suspended unless the ransom is paid.
• Theft of confidential data with threats to make it public.
• Forced advertising. The device locks up, leaving you with only one choice: click and view ads. The malware's author earns income proportional to the number of clicks.

What they have in common: blackmail. You can't remove the malware or decrypt your data unless you pay.

The source of your device's infection

The malware spreads:

• In an e-mail with infected content: a PDF attachment or a link in the body of the e-mail, for example.
• By downloading malicious files from a website.
• During web browsing, on specific sites and via malicious advertising banners. Even without clicking on them, the very fact of seeing them can infect your device.

Once on your device, the malware can take action and block it at any time.

The new scourge of our time

A growing phenomenon

Ransomware has been the most prolific cyberthreat since the start of 2016. Not only law enforcement agencies, but also medical facilities have borne the brunt. The Hollywood Presbyterian Medical Center, in the USA, reportedly had its oncology and radiology data hacked and paid $17k to cybercriminals.

A juicy business

A veritable cybercrime industry is taking shape: part of the ransom money collected is reinvested in the development of new malware. While cyber-attacks target both private individuals and professionals, hackers know that they will be able to "monetize" their services at a much higher price with businesses. What's more, ransomware kits are available for purchase on the Dark Web, facilitating mass distribution.

Companies on the front line

According to one survey, 72% of businesses have experienced a loss of access to their data lasting two days, following a ransomware infection. 32% of companies were unable to access their data for 5 days or more.

A staggering cost

Not only is the ransom already a colossal cost, but the time and energy involved is also enormous. The attacked company then has to restart its entire IT system. This means bringing workstations to a complete standstill. An enormous task for the IT Department. What's more, this type of attack is a disaster for the company's image, and has a very negative impact on its reputation.

See all software Antivirus

How to react?

Once you've been the victim of an attack

• Report your problem to the police? Yes, to alert them. But in the end, they won't be able to do anything for you or your data.
• Pay the ransom: yes, in most cases. Unfortunately, once your files have been encrypted, there's no other way to recover them. And despite this, you're not immune to the possibility that other, more discreet viruses may have been installed without your knowledge and then persist on your devices. What's more, there's no guarantee that the decryption key will be provided and will work.
• Clean up your machine and restore a backup copy: yes. But in some cases, as with the latest Petya ransomware craze, restoration is no longer enough.

In any case, the outcome is costly and offers no guarantees. As is often the case in IT security, prevention is better than cure.

Upstream to defuse the risk

Eight basic reflexes to adopt:

1. Regularly update your antivirus software with the latest security patches. Ransomware often exploits flaws in older versions.
2. Back up your data regularly on external hard drives, or via a dedicated, secure cloud solution.
3. Beware of suspicious attachments or links.
4. Avoid using macros on Microsoft Office files (Word, PowerPoint, Excel) when their origin is questionable. View them in a reader first.
5. Uninstall unnecessary plug-ins, such as Silverlight, Flash or Java, if you don't use them. This reduces the attack surface.
6. Use administrator status on your device as a minimum. Only a few specific actions require it, and it increases the likelihood of attacks.
7. Install ad-blockers. You'll be spared malware spread by advertising banners.
8. Equip your company with a specialized anti-malware security solution, such as Bitdefender's GravityZone offering for businesses. Choose a solution that covers all your employees' endpoints and mobile devices, and protects your web gateways and messaging systems.

Ransomware continues to claim victims in the professional world. They represent a colossal cost and multiple inconveniences for companies. The best way to avoid them is to install an up-to-date, high-performance cybersecurity shield, for better protection and efficient risk management.