Historically, ransomware has been the most profitable kind of malware attack. Notably, some ransomware variants are deliberately designed to feasibly generate significant amounts of damage while generating enormous profits for cybercriminals.
The following are the five stages of a ransomware attack:
1. Reconnaissance Stage
Throughout the reconnaissance stage, the adversary gathers the largest amount of information as possible. Such information could be social media posts, email addresses, potential security vulnerabilities, and aliases.
2. Weaponization Stage
Within the weaponization stage, adversaries are getting ready to deliver their malicious software. At this stage, the attackers could utilize various techniques to conceal their payloads in an ordinary-looking file (Microsoft Word, Excel, or PDF file), or in a malicious website that could have been compromised for the purposes of becoming part of the attackers’ infrastructure.
3. Delivery Stage
Throughout the delivery stage, the attackers proceed to deliver the malicious payload (aka the dropper) to the victim via an infected link that either redirect to a website (Drive-by-download attacks, watering-hole, exploit kits) or to a file, a malicious attachment, or malvertising.
4. Exploitation & Exfiltration Stage
In the exploitation stage, currently available vulnerabilities will be used to deliver malicious code onto the target’s machine to obtain a more significant foothold.
After the dropped has been placed on the victim’s system, the installation procedure will initiate. Usually, it connects to a Command & Control (C&C) server to download important data (For example, the encryption key or a malicious executable file).
Unsurprisingly, there are distinct variations of ransomware that function on a self-reproduction basis and will seek to infect system files and disseminate to additional hosts.
Subsequently, the ransomware begins to encrypt files on the compromised system and conceivably on the network and cloud storage as well.
Immediately after the successful installation, formation and connection to C&C, and encryption throughout the present infrastructure (Network/Cloud Resources, Local Hosts), the ransomware will present a ransom message to the target. Usually, the desktop wallpaper is deployed for this intention.
5. Extortion & PayDay Stage
Lastly, the cybercriminals will anticipate that the victim pays the ransom demand in cryptocurrency to a wallet the attackers possess.
The ransomware demands for sophisticated ransomware attacks typically significantly exceed those for an ordinary ransomware attack.
Sophisticated ransomware actors tend to hold the victims’ most valuable assets for ransom, and they assure that duplicates of the data are inaccessible for restoration.
In the event that the victim fails to pay, the data is either lost because the encryption keys were deleted or breached.
