The Journey of Crypto-Ransomware: Detection, Response, and Prevention

What is Crypto-Ransomware?

Crypto-ransomware is a type of malware that encrypts files stored on a server, PC, or mobile device in order to extort money. Encryption ‘scrambles’ files so that they are unreadable. A ransom is demanded in exchange for the decryption key needed to restore the files.

Threat actors use a mix of sophisticated technology knowledge with psychological manipulation (social engineering) as causative agents of crypto-ransomware attacks.

Common Modes of Transmission:

• Malicious files or links delivered via email, text, or instant message
• Trojan-downloaders or exploit kits, toolkits that are planted by attackers on websites
• Security exploits in vulnerable software
• Internet traffic that redirects to malicious websites
• Legitimate websites that have malicious code injected into their web pages
• Malvertising campaigns
• Self-propagation capabilities (spreading from one infected computer to another)