6 stages of the ransomware lifecycle

/in


Ransomware has been a thorn in the side of IT security practitioners for the better part of three decades, and it shows no signs of dissipating. This form of data theft extortion continues to run rampant through organizations of all types and sizes.

Although ransomware methods and tactics have grown increasingly sophisticated in recent years, the typical attack still follows a consistent series of steps, beginning with malware distribution and culminating in extortion. A thorough understanding of the ransomware lifecycle can give security teams important insight into defending against such attacks.

The ransomware lifecycle usually includes the following stages.

1. Malware distribution and infection

To launch the ransomware lifecycle, operators must distribute malware that lets them access an organization’s data and eventually hold it hostage.

The most common method of ransomware distribution is email — specifically, malicious attached documents and embedded URLs in phishing emails. Cybercriminals use social engineering tactics to make these emails appear legitimate. When an unsuspecting user downloads and opens an attached file or clicks on a malicious link, it initiates the endpoint infection process.

Other ransomware distribution methods include exploitation of unpatched software vulnerabilities; exploitation of Remote Desktop Protocol; credential theft; infection of removable devices, such as USB thumb drives; and infection of pirated software.

A thorough understanding of the ransomware lifecycle can give security teams important insight into defending against such attacks.

2. Command and control

Once malware has successfully infected a target device, it typically begins communicating with what’s known as a command-and-control server (C&C server), located externally on the internet. This server, which threat actors control, is responsible for sending encryption keys to the target device. It might also download additional malware and network-probing software to facilitate discovery and lateral movement activity in the next phase of the attack.

The time between the initial infection stage and the command-and-control stage varies. In some cases,…

Source…