Ransomware - Ruthless Threat to Your Data!

Ransomware - Ruthless Threat to Your Data! An increasing number of Croatian companies are falling victim to viruses that render traditional antivirus programs helpless. They destroy data on your computers and demand a ransom. Save your computer in 3 simple steps: backup - update - upgrade!

What is ransomware?

Ransomware is malicious code, a type of malware, that blocks a user's access to their computer and demands a ransom payment. The amount of the ransom and the reason for payment vary depending on the type of ransomware. Some versions of ransomware convince victims that they need to pay a ransom to avoid punishment by law enforcement agencies, while others inform users that it's the only way to decrypt locked data.

Types of ransomware:

Ransomware programs that encrypt files (CryptoLocker, CryptoWall) - A specific "ransom" is demanded to decrypt the files, typically ranging from $300.00 to $2,000.00. It's a form of cybercrime that often goes unpunished because it's nearly impossible to trace the money flow. Notably, numerous Croatian companies and even some government entities have fallen victim to this virus (e.g., HT Telekom, Ministry of Defense, FINA, T-Portal). Paying the ransom does not guarantee receiving the decryption key or preventing future attacks.

Ransomware programs that do not encrypt files - These block the entire computer and attempt to force users into paying a fictitious ransom through threats. Once the system is infected, the virus will try to identify illegal files such as unlicensed software versions or explicit content. Once found, it locks the computer and displays warning messages across the entire screen. To appear more convincing, the messages often mimic government or law enforcement agencies like the FBI or the Ministry of the Interior (MUP). These messages include official logos and other insignia.

Ransomware programs that lock the browser - This type of virus is similar to the previous one. In most cases, it alleges that the user is engaged in illegal online activities and demands payment of a ransom to avoid imprisonment. The key difference is that this type doesn't infect the entire system but only blocks the web browser.

The types of malicious ransomware are constantly evolving. CryptoLocker and CryptoWall remain the most notorious, continually "improving" and modifying over the years, keeping them among the most dangerous threats to both individuals and organizations.

Attacks by these viruses skyrocketed in the period from 2014 to 2015, increasing by more than 260% in less than a year!

According to the latest data from Kaspersky Lab, the number of users attacked by crypto-ransomware increased by a staggering 550% from 2014/2015 to 2015/2016, prompting the launch of the "No More Ransom" initiative. The "No More Ransom" website was initiated by the Dutch police, Kaspersky Lab, Europol, and Intel Security to inform the public about the latest viruses and assist them in case of infection.

Where does the virus come from, and why are antivirus programs powerless?

There are numerous methods of infection by these viruses, but the most common is when a user opens an infected email attachment or clicks on a link leading to a website that attempts to infect the computer. Often, these emails appear to come from reputable senders such as Amazon, eBay, or various financial institutions. While browsing the web, users may encounter pop-up windows of various content. Some of these windows claim that the user needs to perform a system upgrade or protect their computer because it is infected. In reality, they contain malicious software.

Due to the constant modification of the virus, it is impossible to create an effective antivirus program for this type of threat!

How to protect your data from permanent destruction?

Data backup (data backup) - the most effective data protection. This involves regularly copying important data to a medium physically separated from the original data. It is advisable to create two or three copies of the original data, which can be accessed even if the original data is destroyed by this virus. Our recommendation is "Cloud Backup." More information at - Data Security and Backup.

Use antivirus software and other security technologies - all computers on a network must have antivirus software. However, it's important to know that antivirus programs do not provide protection against all types of attacks. More information at - NOD32 Antivirus-Malware-Spyware.

Update and upgrade operating systems and all applications on your computers to the latest versions - using outdated operating systems, such as Windows XP, which are no longer supported by manufacturers, increases the risk of a successful virus attack. It is recommended to continuously monitor and upgrade new versions of applications, systems, and especially antivirus programs. More information at - ICT Consulting.

What if you are still infected with ransomware?

In most cases, it is impossible to recover infected or "locked" data. The only option then is to rely on backup data.

Paying the ransom is strongly discouraged!

If you notice anything unusual happening on your computer, if it has significantly slowed down, the best course of action is to shut it down immediately and contact an expert. If there is a backup, data should only be restored once the virus has been safely removed. If there is no backup, there is no guarantee of data recovery.

Therefore, it is essential to be vigilant about unusual events, messages, or unfamiliar software and to avoid anything suspicious.

For inquiries or additional information, CONTACT US, and our expert staff will get back to you shortly!

Examples of messages that appear after a computer is infected.