Discussion on Ransomware in the Media

This article discusses the rise of ransomware in the media, its definition, working mechanism, recent attacks reported in the media, and actions taken by industries to combat ransomware. It provides a comprehensive overview of the topic and is a valuable resource for studying and understanding ransomware.

Running head: DISCUSSION ON RANSOMWARE IN THE MEDIA
Discussion on Ransomware in the Media
Name of the Student
Name of the University
Author note

1DISCUSSION ON RANSOMWARE IN THE MEDIA
Table of Contents
1. Introduction.................................................................................................2
2. Discussion....................................................................................................2
2.1 Definition of Ransomware......................................................................2
2.2 Working Mechanism of Ransomware......................................................3
2.3 The Recent Ransomware Attacks reported in the Media........................4
2.4 Actions taken by Industries....................................................................7
3. Conclusion...................................................................................................9
References.....................................................................................................10

2DISCUSSION ON RANSOMWARE IN THE MEDIA
1. Introduction
In the recent times, there is a lot of surge of news in the media, which
are in relation to the rise of ransomware. The recent media articles are in
relation based on coverage that have been focused over the rise of
malwares. These kind of internet threats have overshadowed most of the
major internet platforms and have raised huge kind of concerns for the
security agencies in designing new kind of applications that would help in
protecting the organisations against such kind of threats.
The rise of ransomware had primarily originated in Russia in the year
2005. This ransomware was known as Winlock, which can be defined as a
non-encrypted virus that had led to a loss of over 10 million of investment
that were made by Russian authorities (Kharraz et al. 2015). Ransomware
could be defined as a sophisticated virus that would mainly be created by
tech-savvy and competent culprits. This form of virus is mainly planned for
getting access to the large Information Systems (IS) of the world. Based on
the attacks made by ransomware, it could be discussed that this form of
illegal extraction of money from the authorities have put major stakes
towards business. This report helps in discussing the major ransomware
attacks that had made their presence over the major industries.
2. Discussion
2.1 Definition of Ransomware
Ransomware could be defined as a malicious software that could be
designed in a manner that would pose serious threats to the activities
performed by a user. This kind of virus often threatens the data possessed
by a company. With the impact of such kind of virus, the user over whom the
attack has been processed would be denied access towards their data. In
order to free up and gain access to the data, the attacker demands for a
ransom amount of money from the victim (Cabaj, Gregorczyk and Mazurczyk
2018). The users are directed by instructions based on which they need to

3DISCUSSION ON RANSOMWARE IN THE MEDIA
process the payment and thus the computer might be freed from the virus.
In order to disable the effect of ransomware, various knowledgeable
professionals would be required to tackle against the effect of such kind of
viruses. One of the most vital challenges that would be faced by
professionals is to recover the most infected data (Mercaldo et al. 2016). The
entire process of breaking the code that had been supported within the
ransomware would be the biggest challenge posed for the IT professionals.
2.2 Working Mechanism of Ransomware
There are certain possible vectors that could be undertaken by
ransomware for gaining access to a certain computer. The primary and
significant form of delivery systems of ransomware is phishing. In such kind
of attacks, the attacker might send attachments that would be sent within an
email. These files are thus masqueraded in the form of a file, which would be
trusted by the users (Jin et al. 2018). Upon downloading the file, the users
would be directed to a website. These files comprise of different tools based
on social engineering that have the capability of tricking users for allowing
administrative access. One of the common example of ransomware that
makes use of this kind of technique of gaining access to the user computer is
NotPetya.
In some kind of ransomware attacks, the attacker would claim
themselves to be a part of the law enforcement agency (Craciun, Mogage
and Simion 2018). They would shut down the computer of the user based on
the presence of pirated software. A ransom amount of money would be
demanded by the cyber criminals.
2.3 The Recent Ransomware Attacks reported in the Media
In the recent past years, the topic of ransomware has gained immense
form of popularity and has also raised huge kind of curiosity. Some of the
major kind of ransomware that have been reported in the media articles are:

4DISCUSSION ON RANSOMWARE IN THE MEDIA
1. TeslaCrypt – The ransomware had been discovered in 2016. The
prime targets of the ransomware would be based on auxiliary files that would
be in association with the video games. The ransomware would also be able
to affect the facility of maps, saved games, downloadable content and the
other contents (Scaife et al. 2016). This kind of ransomware was mainly
targeted towards the game users and thus made it extremely impossible for
users to restore the files back without any form of help from the creators of
the malware. However, soon after the attack, the creators of the ransomware
had announced that they have completed each of sinister activities.
2. SimpleLocker – Most of the consumers in the recent times, have
their major needs of transferring files from one device to another. The
ransomware scammers had found this fact as the most vital aspect of
spamming the devices and thus gain access to data. One of the most
common platform that could be susceptible to promote the attacks was the
Android operating system (Mercaldo, Nardone and Santone 2016). In the late
2015 and 2016, the infections made by ransomware had almost spiked to
large heights. There had been a huge rise of “blocker” attacks that made the
situation to be extremely critical for users to gain access to the important
files. The users were not also able to access any of the parts present within
the user interface.
The discussed ransomware had begun to spread during the year 2015.
It can be thus defined as the first form of Android-based attack. They were
mainly targeted towards the users and based on encrypting the files within
the computer of users. The SimpleLocker ransomware were also known as
the first form of ransomware attacks that had delivered their malicious
payload with the help of a Trojan downloader (Moon and Chang 2016). With
the help of such advanced technical mechanism, it was difficult for catching
with the measures based on security.
The ransomware attack posed by SimpleLocker had mostly infected
the mobile devices of the user based on downloading applications and other

5DISCUSSION ON RANSOMWARE IN THE MEDIA
form of malicious content from outside of the Google Play Store (Ferrante et
al. 2017). Upon revising of the latest form of attacks posed due to
ransomware, Google has been striving hard for assuring their users about
the latest kind of security that would be implemented.
3. WannaCry – In the mid of the year 2017, two of the major
ransomware attacks had strike their presence all over the globe. The spread
of the news in relation to the ransomware had spread all over the news.
Different hospitals and radio stations in California and Ukraine were shut
down completely.
The primary attack was made by WannaCry that has been considered
as the worst form of ransomware that had made their immense presence
over all the computers in the world (Chen and Bridges 2017). Different kind
of major computer systems from all over the world had been hugely affected
and most of them were almost shut down completely. The work performed in
different industries had also been hugely affected as productivity of
computers had dropped. The ransomware had mostly affected the
computing systems in Europe on May 12th. The Avast Company had taken
account of bringing in immense amount of security measures towards the
computer systems. Avast had mostly detected that over 250,000 detections
were found in more than 116 countries.
Another major ransomware attack, which was known as EternalBlue
could be defined as an exploit that had taken advantage of a certain form of
defect within the implementation of SMB protocol by Microsoft (Kshetri and
Voas 2017). The company had released a certain security patch based on
securing the system of the user but a major problem had again aroused as
most of the users had not installed the patch within their system. The
ransomware had mostly taken advantage of this loophole and thus spread
across each of the devices present within the network. This was mainly due
to the reason that user interaction would not be required for further form of
infection within the computing systems. Different security specialists and

6DISCUSSION ON RANSOMWARE IN THE MEDIA
researchers had discussed over the situation that the SMB port, 445 were
present within many organisations and which were exposed to the open
Internet (Kao, D.Y. and Hsiao 2018). This has further helped the worm to
propagate further within the systems.
4. NotPetya – This ransomware could be defined as a ransomware
package that had actually related to the type of ransomware present during
the year 2016. Within a few weeks after the spread of the outbreak of
WannaCry, a most updated version of a ransomware had spread. This kind of
new ransomware had also made use of the EternalBlue package, which was
also possessed by WannaCry (Adamov and Carlsson 2017). The cyber
security specialists who had performed a detailed analysis over the
ransomware attacks had automatically detected the traffic within the
network as one of the non-standard ports that had primarily been used for
launching another similar forms of attacks similar to WannaCry.
5. Ryuk – It is also considered as one of the most vital targeted variant
of ransomware that had hit most of the companies during the year 2018 and
2019. The most chosen victims of the ransomware were such kind of
organisations that had little level of tolerance against ransomware attacks.
These organisations also had low factor of tolerance against the issues raised
by downtime of servers (Genç, Lenzini and Ryan 2018). One of the most
devastating feature that was present within the Ryuk ransomware was that it
had the capability to disable the option of Windows System Restore and thus
infect most of the computers from all over the world. Based on infecting the
computers, they had the capability of complicating situations of retrieving
the encrypted form of data without paying a certain amount to the attackers
(Conti, Gangwal and Ruj 2018). However, in some cases the ransom amount
demanded from the affected users was mainly high than the expected value
of the victims.

7DISCUSSION ON RANSOMWARE IN THE MEDIA
2.4 Actions taken by Industries
With the huge rise in news articles claiming about the recent huge
form of rise of ransomware attacks, it can be discussed that such kind of
serious measures need to be put in proper place. This would highly help in
reducing the serious impacts that could be made by ransomware
(Karahasanovic, Kleberger and Almgren 2017). The different private and
government organisations present within the US have been in the process of
trying different kind of steps that would be helpful in curbing the serious
problems that are thrown by ransomware attacks.
These companies have been in the constant process of issuing
warnings based on preparing for backup of credible data in relation to the
company. These companies should not just limit themselves to listening to
the warnings provided by other organisations, but they should think about
certain areas through which they which they could imply such kind of
principles within the business (Jansen and Jeschke 2018). This would also
include the backing up of files and not sharing of any kind of personal
information when they would be prompted by malware. The different forms
of sensitive data should also be encrypted by the companies.
Other kind of measures based on safeguarding the assets is based on
taking a routine follow up over the different kind of activities performed by a
company. Different kind of security measures based on using firewalls,
penetration testing and virus scanning should also be implemented within
the organisations in order to recover the important data of the company.
Other measures such as the use of a popup blocker and adware could also
be implemented based on removing the security threats occurring within the
organisation. In case of any kind of susceptible attack that might get posed
over any system, it should always be ensured that every form of data would
be backed up. In case of any form of failure within the process of backing up
of data, the backup expert should properly ensure that they would have the
proper kind of tools. These security experts should properly ensure that they

8DISCUSSION ON RANSOMWARE IN THE MEDIA
have the proper level of expertise based on securing the interconnection
made between different networks of computers.
Some of the six form of measures that have been taken by
organisations in the recent times to secure their systems against the attack
of ransomware are:
1. Once the organisation would detect that some of the systems have
been infected with virus, they should be completely removed from the room.
The networked components in relation to the infected machines should be
completely removed (Kelpsas and Nelson 2016). The backup of data should
also be taken in an offline mode because there is a high risk that the data
assets might be intercepted when connected over a network.
2. A proper kind of incident response plan should be created. The
organisations should ensure that there would be a cross-functional
representation present within the investigation team that includes
compliance, legal, information security, business, human resources, public
relations and different other departments.
3. The cyber security specialists present within any company should
have the capability of identifying and addressing different forms of
vulnerabilities that might affect the systems (DeMuro 2016). The company
should efficiently make use of software security patches and thus update the
security systems within the organisation. A certain amount of investment
could also be made within the security patches that would need to be
purchased and thus installed within the computer systems (Hampton, Baig
and Zeadally 2018). Thus, the companies should also prepare their
computing systems for performing eradication events.
3. Conclusion
The discussion in the above report focuses over the use of different
kind of effects that could be posed from the effect of ransomware. These are
defined as harmful virus and applications that have the capability of infecting

9DISCUSSION ON RANSOMWARE IN THE MEDIA
other systems. The organisations need to implement the best form of
security measures for the purpose of protecting their data systems. This
discussion was thus based on discussing about the recent forms of
ransomware attacks that have been posed over major companies in the
recent 5 years. These kind of ransomware have the major form of impact
over the data assets of any organisation. They can be considered as the
prime target for attackers. Such data could be kept as hostage and based on
that the attackers could claim a ransom amount from the people within the
organisation.
The organisations should ensure that each of the computing systems
used would be possessing the latest operating systems and they would also
make a proper use of firewalls and different other security measures. Hence,
these companies should think of new ways in which they could make a
tremendous impact over the security of the data. Huge form of encryption
and other latest techniques should be taken into account and thus the data
within the company could be kept in a secured manner. The research
discusses about the new kind of trends based on ransomware, which could
make an impact over the organisation. With the implication of the discussed
security measures, it would be highly be helpful for the organisation to
secure their systems and data assets.
References
Adamov, A. and Carlsson, A., 2017, September. The state of ransomware.
Trends and mitigation techniques. In 2017 IEEE East-West Design & Test
Symposium (EWDTS) (pp. 1-8). IEEE.
Cabaj, K., Gregorczyk, M. and Mazurczyk, W., 2018. Software-defined
networking-based crypto ransomware detection using HTTP traffic
characteristics. Computers & Electrical Engineering, 66, pp.353-368.
Chen, Q. and Bridges, R.A., 2017, December. Automated behavioral analysis
of malware: A case study of wannacry ransomware. In 2017 16th IEEE

10DISCUSSION ON RANSOMWARE IN THE MEDIA
International Conference on Machine Learning and Applications (ICMLA) (pp.
454-460). IEEE.
Conti, M., Gangwal, A. and Ruj, S., 2018. On the economic significance of
ransomware campaigns: A Bitcoin transactions perspective. Computers &
Security.
Craciun, V.C., Mogage, A. and Simion, E., 2018, November. Trends in design
of ransomware viruses. In International Conference on Security for
Information Technology and Communications (pp. 259-272). Springer, Cham.
DeMuro, P.R., 2016. Keeping internet pirates at bay: Ransomware
negotiation in the healthcare industry. Nova L. Rev., 41, p.349.
Ferrante, A., Malek, M., Martinelli, F., Mercaldo, F. and Milosevic, J., 2017,
October. Extinguishing ransomware-a hybrid approach to android
ransomware detection. In International Symposium on Foundations and
Practice of Security (pp. 242-258). Springer, Cham.
Genç, Z.A., Lenzini, G. and Ryan, P.Y., 2018, June. No random, no ransom: a
key to stop cryptographic ransomware. In International Conference on
Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 234-
255). Springer, Cham.
Hampton, N., Baig, Z. and Zeadally, S., 2018. Ransomware behavioural
analysis on windows platforms. Journal of information security and
applications, 40, pp.44-51.
Jansen, C. and Jeschke, S., 2018. Mitigating risks of digitalization through
managed industrial security services. AI & SOCIETY, 33(2), pp.163-173.
Jin, Y., Tomoishi, M., Matsuura, S. and Kitaguchi, Y., 2018, March. A Secure
Container-based Backup Mechanism to Survive Destructive Ransomware
Attacks. In 2018 International Conference on Computing, Networking and
Communications (ICNC) (pp. 1-6). IEEE.

11DISCUSSION ON RANSOMWARE IN THE MEDIA
Kao, D.Y. and Hsiao, S.C., 2018, February. The dynamic analysis of WannaCry
ransomware. In 2018 20th International Conference on Advanced
Communication Technology (ICACT) (pp. 159-166). IEEE.
Karahasanovic, A., Kleberger, P. and Almgren, M., 2017. Adapting Threat
Modeling Methods for the Automotive Industry. In Proceedings of the 15th
ESCAR Conference (pp. 1-10).
Kelpsas, B. and Nelson, A., 2016. Ransomware in Hospitals: What Providers
Will Inevitably Face When Attacked. The Journal of medical practice
management: MPM, 32(1), p.67.
Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L. and Kirda, E., 2015, July.
Cutting the gordian knot: A look under the hood of ransomware attacks.
In International Conference on Detection of Intrusions and Malware, and
Vulnerability Assessment (pp. 3-24). Springer, Cham.
Kshetri, N. and Voas, J., 2017. Do crypto-currencies fuel ransomware?. IT
professional, 19(5), pp.11-15.
Mercaldo, F., Nardone, V. and Santone, A., 2016, August. Ransomware inside
out. In 2016 11th International Conference on Availability, Reliability and
Security (ARES)(pp. 628-637). IEEE.
Mercaldo, F., Nardone, V., Santone, A. and Visaggio, C.A., 2016, June.
Ransomware steals your phone. formal methods rescue it. In International
Conference on Formal Techniques for Distributed Objects, Components, and
Systems (pp. 212-221). Springer, Cham.
Moon, J. and Chang, Y., 2016. Ransomware analysis and method for minimize
the damage. The journal of the convergence on culture technology, 2(1),
pp.79-85.
Scaife, N., Carter, H., Traynor, P. and Butler, K.R., 2016, June. Cryptolock
(and drop it): stopping ransomware attacks on user data. In 2016 IEEE 36th

12DISCUSSION ON RANSOMWARE IN THE MEDIA
International Conference on Distributed Computing Systems (ICDCS) (pp.
303-312). IEEE.