What Is a Blackmail Virus and How to Fight It? Complete Security

Once upon a time in the thirty-ninth kingdom… lived a blackmailer virus. Wait, was that only 30 years ago? The Ransomware blackmail virus is so popular (not from the good meaning of the word) that it seems to us that we have known it all our lives. Although he is only 31 years old, he is still young and beautiful, even in his prime and can do a lot of harm to any user on the Internet. Although there are still users who are sceptical of such viruses and believe that they will not get to them. In today's article, we will talk about who is (what is) this virus blackmailer, how it is arranged, how it infects computers and how its "work" can affect your business. Let's go.

The first blackmail virus attack in history  

Back in 1989, biologist Joseph Popp wrote the "Trojan AIDS virus," the first known malware to be the world's first example of a virus known as a "blackmailer." The AIDS Trojan was introduced into PC systems via a floppy disk, which Popp simply sent to the mailing list of participants in the WHO International Conference on AIDS. Just imagine: for one time (in 1989) 20,000 infected floppy disks were distributed! Joseph Popp was eventually caught, but could he have imagined at that moment that he had ushered in a new era of blackmail viruses? 

So, let's understand what is a blackmail virus?  

Speaking of the value itself, I would simplify: the Ransomware virus is a type of software that is created for the specific purpose of earning and placing (closes from reading and access) user files in the code or simply - hides under a password. It is worth noting that Ransomware encrypts files. Encryption is one of the most important tools in computer (information) security. However, some blackmail viruses behave unusually, such as deleting files or encrypting applications (such as SQL Server ). Ransomware is usually accessed through a dangerous remote channel, through operating system vulnerabilities, or through software downloads via e-mail.

How the blackmail virus works

So we found that Ransomware encrypts files on computers. But how does this happen? How does he do it? In addition to the code and encryption algorithm, in such cases, there are always details of social engineering. There is a lot of information about making an emotional connection with victims before hacking their PCs and encrypting their data. Sometimes criminals (cybercriminals) even get in touch on social networks and start communicating, pursuing a very specific goal. Step by step, message by message, the hacker gains the victim's trust through the right psychological techniques in communication and correspondence and then uses that trust to access personal, sometimes even confidential data, such as passwords or bank details. Although for the sake of objectivity, it should be noted that most often infected files or links to dangerous resources are sent by such hackers directly in messages to victims, after obtaining a credit of trust and knowing for sure that the victim will click on the link or download the infected file

you open an email from someone you trust, such as a friend or any legal organization you get scary messages that your computer has just been infected (still an emotional connection, right?), although it's still not, then you quickly click on a link that promises to cure you right now and… download completed. Congratulations! Ransomware has already settled on your computer.  Now let's delve into the ways in which all this could happen to you - just arm yourself. 

The first way of the extortion virus: malicious emails 

The user receives an email with attachments or links in the email itself. Although most of these emails end up in your spam folder, some of them can get into your inbox in your inbox. Although many even climb into the "spam" folder and try to read emails from there and even click on the links, which even the browser "spits". So, let's move on. The user downloads the attachment file or clicks on the link. The virus installation process has already begun. Ransomware begins encrypting the data you have on your computer: photos, documents, or PDFs, basically everything you have on your computer. You will then receive a message stating that you need to pay for decrypting or unlocking your own files. The following is an example email in a spam folder

The second way of the extortion virus is to browse and exploit sets as malicious advertising

The user clicks on the online ad in the browser (usually a bright and interesting picture), and the system redirects the user to a fake website. Attackers usually try to create these fake sites to make them look as legitimate as possible and like the real original, so it may take some time for your antivirus or Complete security system to discover the exploit codes hidden there. The exploit kit starts scanning your computer and launches some software, usually written in Java or Flash, to find any possible vulnerabilities. And, if such a vulnerability is detected, the blackmail virus will be placed on your computer. Ransomware encrypts all data stored on your computer's hard drive (as is the case with a malicious e-mail script). You will have to pay for the blackmailer-hacker. Always remember that payment does not guarantee that you will get your files back. This only guarantees that the cybercriminal will get your money. 

Who is the target audience for the extortionist virus?

Everyone. Ransomware can target both individuals and companies of any size. Any organization can run the risk of being broken - whether you are a small business or an individual entrepreneur. There are no restrictions and exceptions. Any industry could be affected: education, government, health, retail or finance. If you think that this does not concern you in any way and you are definitely not a goal, then you are such a goal. The best target for a hacker is a user who does not know the security rules. 

What are the implications for business of a blackmailer virus attack?  

They are unlimited. In the 4th quarter of 2019, the average payment to hackers for the decryption key increased by 104% and increased to 84,116 US dollars compared to 41,198 US dollars in the 3rd quarter of 2019. Payment does not guarantee the restoration of data access. This does not even guarantee that your computer is no longer infected. Ransomware can simply kill a business, and the recovery process will not be easy, as well as require additional resources, both monetary and human.  

Main risks:  

Data loss (temporary or permanent) 

Complete blocking of business processes 

Financial losses due to failures and downtime 

Financial losses associated with the resumption of the company 

Company reputation 

Most often it is an emergency and a catastrophe that needs to be corrected. Previously, we prepared material on analytics and data for 2019 on cybersecurity.  

Protection against extortion virus attacks 

The best way to protect against extortionist hacker attacks is to prevent it. You can periodically back up all data, teach administrators the rules of conduct when detecting viruses and invest in the formation of cybersecurity in the company. Use cloud technologies and turn to our specialists to increase the level of cybersecurity in the company.