What are malware and ransomware, and how can you lower your risk of attacks on devices and networks?
On this page:
Ransomware is a type of malware (malicious software) that cybercriminals use to infect computers, devices, and networks, and restrict access to data until a sum of money is paid. Ransomware attacks have impacted businesses, hospitals, and public utilities worldwide.
In Sophos’ 2021 State of Ransomware Report, it was reported that the average ransomware recovery costs for businesses more than doubled, rising from $761,106 in 2020 to $1.85 million in 2021. Besides the ransom payment, calculated costs include downtime, salaries, device and network costs, lost opportunity, and other associated financial loss.
Methods for avoiding ransomware attacks are consistent with best practices typically recommended for securing and protecting personal and UW institutional data.
Ransomware is typically spread via phishing emails that contain links to malicious web pages or attachments. Infection can also occur through “drive-by” downloading, which occurs when a user visits an infected website, and malware is downloaded and installed without the user’s knowledge.
If the ransomware is successful, files are locked through a process known as “encryption,” which generates a “key,” and an on-screen ransom note offers the decryption key in exchange for payment. Ransom varies greatly but is and typically must be paid in virtual currency, such as bitcoins.
In some cases, decryption tools are developed and made available online, but there is no guarantee for their efficacy for unlocking any of the many strains of ransomware.
Infections on one machine may migrate to network drives; additionally, vulnerable web servers may be exploited directly by cybercriminals to deliver ransomware and other forms of malware to multiple users in an organization.
The potential consequences of infection in computers, systems, and on the University network may include:
The decryption key is not always delivered, so victims could lose data, money, and time if the ransom is paid. Cybercriminals may receive the victim’s money, and in some cases, their banking information, but there is no guarantee that the key will be delivered and data restored. Additionally, restored files might contain other forms of malware, and victims who pay ransom once could be vulnerable to repeated attacks.
This list is not exhaustive. For additional information, consult your department IT support person.
Phishing Online Educational Resources for UW
The No More Ransom Project
An initiative between police and IT security companies to disrupt ransomware-related cybercrime