How does a ransomware infection work?
Email is the most common gateway for ransomware
Phase 1: Infection
How does ransomware enter a company?
Ransomware can enter via file types where it can deposit active code, for example, in Office macros or embedded in PDF files. These files are often sent as email attachments. However, it is also possible to become infected by visiting an infected website, i.e., you can also catch Emotet by clicking on a link.
The programmers of the malicious codes often exploit vulnerabilities in operating systems, browsers, or email clients that the software manufacturers themselves are not yet aware of or at least have not yet closed (so-called zero-day gaps).
Phase 2: Embedding
At first, ransomware does not make itself noticeable and nests on the computer. If, for example, Emotet infects a computer on which Outlook is installed, it intercepts the communication. It notes with whom emails are exchanged and on what topics. It then generates an email from one's own mailbox with a text and a topic about which one has already exchanged with known recipients. This looks like a legitimate email from the sender's hand to the recipient.
Email is, therefore, the riskiest gateway for ransomware.
Phase 3: Dissemination and collection of data
Emotet tries to spread horizontally to other computers. To do this, it uses brute force attacks with known passwords. Of course, it is particularly helpful for Emotet if a computer or user with administrative rights can be infected. With administrative rights, it then spreads horizontally to as many machines as possible and keeps contact with the attackers' command and control center. On the machines it has infected, as much account data, passwords (especially of administrative accounts), and personal data as possible are collected and sent to the attackers.
Phase 4: Blocking and extortion
The attackers gather information and then await the appropriate moment to attack the company.
For example, at the weekend, they can
- delete all back-ups
- encrypt machines
- and then leave a message with their demands.
A ransomware infection can, therefore, be present for months before anyone notices it. That's why tracking where the ransomware came from and how it spreads is very difficult.
Phase 5: Negotiation, payment, and release of data
The instant messaging service Telegram is often used to negotiate the ransom, as the secure architecture of this service makes tracing difficult. Some ransomware has already integrated a corresponding negotiation functionality. Provided you agree on a sum with the extortionists, the ransom is usually paid in the form of bitcoins.
However, experts and investigating authorities often advise against accepting a ransom demand; too usually, the data is not decrypted despite payment, and the computers are still locked.
