I was a victim of a ransomware attack not too long ago. It was delivered to my device through a cracked application. Before that, I had no idea what ransomware is or how ransomware can be delivered.
Ransomware does not mysteriously materialize on its own and magically appears on your device. It requires some form of user interaction. It exploits the vulnerabilities to gain access and infect your system.
So, how can ransomware be delivered to your device? In this guide, we’ll explore the different entry points that ransomware exploits.
How Can Ransomware Be Delivered?
Ransomware is similar to a cyber hostage situation. Your data and files are held captive by malicious attackers. Much like real-life kidnappers, ransomware attackers exploit vulnerabilities to seize control of your devices.
Attackers employ advanced encryption techniques, making it hard to recover the files. This leaves you with limited options. At this point, the ransomware has found its way into your device. So, let’s see the various ways and tactics ransomware uses to infiltrate systems.
Removable Devices
Removable devices are portable storage devices that you connect to a computer. These can be USB flash drives, external hard drives, and memory cards. Attackers can infect a removable device with ransomware, leave it in public, or send it to someone directly.
When you plug in the device, the malware automatically executes. Some operating systems have an autorun feature that automatically executes programs on inserted media. Attackers can exploit this by hiding the ransomware within an autorun-enabled file on the removable device.
Cracked Applications
Cracked applications are versions of legitimate software modified to bypass the built-in licensing mechanisms. This allows you to access the software for free. Crackers usually use the following techniques to bypass software licensing.
- Cracks: Programs that disable the licensing check in the original software.
- Serial keys: Illegally obtained or generated codes that unlock the software.
- Keygens: Programs that generate these fake serial keys.
Cracking the software means someone other than the official developer has accessed and modified the software. Sometimes, this “someone” is the attacker. They bundle the cracked software with ransomware and execute it on your computer when you try to install the software.
Are you using a cracked version of Microsoft Windows, IDM, or Adobe products? You are vulnerable to ransomware attacks. Some cracked applications might even ask you to disable the antivirus during installation, which is a major red flag.
Remote Desktop Protocol Exploits
Remote Desktop Protocol (RDP) is a network communication protocol that allows you to connect to another computer remotely. This means you can see the other computer’s desktop and interact with it as if you were sitting directly in front of it.
By default, RDP runs on port 3389 on a Windows machine. If this port is exposed to the internet without proper security measures, attackers can scan for it and attempt unauthorized access. The same happens if you set weak or default passwords for RDP.
Attackers can make guesses and finally succeed and access your computer. Once inside through RDP, attackers can exploit vulnerabilities and make misconfigurations to move within the network and access other devices, resulting in widespread ransomware attacks.
Unsafe Websites
By now, all of us on the internet know that not all websites are safe. Clicking on suspicious ads, especially those promising free things or exploiting fear tactics, can redirect you to infected websites or automatically download ransomware onto your device. Also, certain websites can be booby-trapped to exploit vulnerabilities in your browser and plugins.
They then silently download and install ransomware in the background without your knowledge. If the browser is safe and can’t download in the background, it can prompt you to download seemingly legitimate software, cracks, and files from untrusted websites. The ransomware then enters your device disguised as the desired content.
Email Phishing
Email phishing is a deceptive cyberattack where attackers send emails disguised as legitimate sources like banks, delivery companies, or friends. They craft emails that look official, often mimicking trusted companies. The fake email addresses are tweaked to look like legitimate addresses.
For instance, if the legitimate email address is microsoft@gmail, they can tweak it to something like microssoft@gmail. If you are not careful, you’ll read the name as Microsoft. Apart from the address, which can’t be duplicated, the rest of the email will read Microsoft.
They then ask you to open an attachment. For instance, they can say you have been billed, and an invoice is attached. Generally, you’ll want to open the attachment and confirm. Once you open it, the ransomware is downloaded into the device.
Microsoft Macros
Macros are automated tasks and instructions you can create and run to perform repetitive actions in Word, Excel, Access, and PowerPoint. They allow you to record a series of steps and then replay them with a single click.
Attackers can embed malicious code within seemingly harmless documents, spreadsheets, and presentations. When you open the file and enable macros, the code executes, downloading and installing ransomware on your system.
In email phishing, the attackers might attach an Excel file that’s seemingly harmless. When you download and open it, it asks you to enable macros. Once activated, the macros trigger ransomware downloads or data encryption.
Tips to Prevent Ransomware From Entering Your Device
Now that you know the different ways ransomware can access and infiltrate your device, let’s look at some of the infiltration preventive measurements.
- Regularly update your operating system, applications, and antivirus software to patch known vulnerabilities that attackers exploit.
- Avoid using weak or reused passwords. Activate MFA whenever possible for an extra layer of security.
- Never open emails and attachments from unknown senders
- Stick to well-known and reputable websites for downloads. Avoid downloading software and files from untrusted sources.
- Disable macros by default to prevent malicious code embedded in documents from executing. You can then activate macros only on documents you trust
- Have a recent backup for your data and files. If everything goes wrong and you’re attacked, a recent backup will get you out of the mess.
- Enable the firewall to help block unauthorized access to your device.
- Turn off Bluetooth and Wi-Fi when not in use. This minimizes the chances of ransomware spreading from a connected device to your device.
Before ransomware encrypts data and files in your device, it exploits a loophole to infiltrate. It can range from email phishing, which is the most common, to downloading cracked applications. It’s advisable to keep your anti-malware software active and practice safe surfing.
