Ransomware attacks have increased exponentially recently. Some companies have even started to buy insurance against ransomware attacks.

Unlike in the past, nowadays it is not as easy to hide the fact that you’ve been breached, especially if the breach is a result of a ransomware infection or leads to a ransomware infection.

This happens because the attackers of more than 20 different ransomware families started to threaten to publicly expose the data belonging to companies unwilling to pay the ransom. Most of the attackers use Tor domains to disclose the identity of the companies they’ve infected as well as to upload files they’ve stolen before starting the encryption process.

In this paper we analyse the techniques that get companies infected with ransomware in an attempt to find a way to figure out if an entity is a potential future ransomware victim and what can it do to minimize the chances of getting hit.

Ransomware infects systems through other malware families or exploit kits, vulnerable services, spam campaigns, and so on. By correlating the victims of these malware families and exploit kits, the entities running these vulnerable services, as well as the entities that have poor email hygiene with the victims of ransomware attacks, we can estimate the risk those exposures added to the probability of ransomware infection.

There are two ways of collecting victims of ransomware attacks. Non-paying victims can be collected by crawling Tor websites maintained by the attackers while both paying and non-paying victims can be collected by sinkholing ransomware families which use multiple command-and-control domains and don’t register all of them.

For the ransomware families for which we can gather both paying and non-paying victims as a result of having information from both the attacker’s website and our sinkholes, we can derive the percentage of paying victims.

And even if a company doesn’t get infected with ransomware, a third-party entity, such as a supplier of that company, can get infected with ransomware, thus allowing the attackers access to the same data the company shared with the third party. The initial company can later be blackmailed against making that data public to competitors – as happened with Apple recently. Therefore, it is also important for a company to monitor its third-party entities for how vulnerable they are in order to protect themselves.

Got a question about this presentation? To get in touch with the speakers, contact them by email on [email protected], [email protected], [email protected] and [email protected].