Ransomware is malicious software that encrypts a victim’s files or server contents, blocking access until the victim pays an attacker a cryptocurrency ransom. It turns a security breach into direct extortion: operations can be interrupted while an organization tries to regain control of its systems. section 1.1 section 12.0
Ransomware commonly operates as a franchise business. A ransomware vendor supplies the malware to criminal affiliates; affiliates find vulnerable or already compromised servers, deploy the software, and split paid ransoms with the vendor. Some operators even provide victims with help decrypting systems after payment. section 1.1 section 12.0
A deployment route is code injection. If an attacker can make a remote server run malicious code, that code can install ransomware. Injection vulnerabilities also enable other harms, including bypassing authentication, stealing data, and disrupting a vulnerable web server, so preventing injection reduces more than ransomware risk. section 12.0
Reduce exposure by treating ransomware as part of everyday application security:
- Track vulnerabilities and dependencies so known weaknesses are less likely to leave servers open to opportunistic scanning. section 1.10
- Make systems observable so compromise and service disruption can be investigated rather than remaining invisible. section 1.10
- Educate the team and include security reviews in the development lifecycle. section 1.10
A vulnerable-server ransomware path
An affiliate scans for a vulnerable server, or obtains the address of one already compromised. If the server accepts injected malicious code, the affiliate can deploy ransomware; by the next day, the server’s contents may be encrypted and its operator asked for cryptocurrency to regain control. section 12.0
