Ransomware Attack and its Impact on Society Report 2022

Running head: RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
Name of the student:
Name of the university:
Author Note:

1RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
Executive Summary
The main perspective of the report is to put a clear emphasis on the overall concept of the
ransomware cyber-attack. This report emphasizes on the particulars regarding the overall
constraints of ransomware attack that is significantly stated as the mechanism of the overall
working regarding the ransomware as well as the significant threats involved in regards to the
occurrence of the cyber-attack. Moreover, the report also deals with the three most significant
types of the ransomware attacks that had prevailed in the recent times. In addition to this, the
report will tend to provide a clear emphasis on the overall bounds of the ransomware attacks
and provide a clear overview of the attack in regards to the report.

2RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
Table of Contents
1.0 Introduction..........................................................................................................................3
2.0 Variants of Ransomware......................................................................................................3
2.1 Crypto Locker..................................................................................................................4
2.2 WannaCry........................................................................................................................4
2.3 Bad Rabbit........................................................................................................................5
3.0 Working mechanism of Ransomware..................................................................................5
4.0 Potential threats involved.....................................................................................................7
5.0 Summary..............................................................................................................................9
6.0 References..........................................................................................................................11

3RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
1.0 Introduction
In simple terms, the concept of ransomware may be depicted as the presence of the
malicious software within a computer system that tends to lock down the overall data until
and unless the demanded amount of ransom has been paid. Hence, the name of this data
security threat is stated to be as ransomware. This ransomware attack has been firstly
identified within the computer systems by the late 2013. However, relatively from the start of
this type of attack a thousand of computers are found to be the significant victim in regards to
this type of attack (Brewer, 2016). The concept of ransomware has been mainly derived from
both the fields of effective education regarding the users of the computers as well as the
professionals dealing with the security of data and information and the companies involved in
the manufacturing of the antiviruses.
The impact of this type of data security breach may provide a negative emphasis on
the society as with this attack the overall information stored within a single computer system
may be at risk thus exposing the important information to the attackers involved with such
security breach (Richardson and North, 2017). The significant part of this attack depicts that
once a computer system is infected with ransomware the recovery of the data within the
computer system is a difficult procedure as well as there is no guarantee whether the data can
be recovered even after the ransom is paid.
2.0 Variants of Ransomware
The report will be mainly be considering three variants in the field of the ransomware
that are identified as Crypto Locker, WannaCry as well as Bad Rabbit (Hampton, Baig and
Zeadally, 2018). These are briefly stated as follows:

4RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
2.1 Crypto Locker
The Crypto Locker ransomware mainly occurred within the computer systems from
September 2013 and it was active until May 2014. This attack mainly targeted the computer
systems that uses the Microsoft Windows operating system. The propagation of this
malicious virus is being done with the usage of email and sending the viruses as attachments
(Gonzalez and Hayajneh, 2017). When the malware is being activated within the computer
system then the malware tends to encrypt the over files that are being stored within the local
as well as mounted network drives in regards to the memory of the computer system. This
encryption of the secure data as well as information is carried out using the RSA public key
cryptography methodology. This public key cryptography is significantly hampered by the
private key methodology that is being stored within the control services of the malwares. This
identified Ransomware attack offered the users of the computer to decrypt the information or
data that are being infected by the attack if a certain amount of ransom is paid online.
However, there persists a chance of uncertainty whether the overall data may be safely
retrieved by the user or not.
2.2 WannaCry
The WannaCry ransomware attack was significantly identified by the month of May
2017, which was effectively carried out by the WannaCry ransomware crypto worm.
Similarly, like Crypto Locker this attack also attacked the computer systems that run on the
Microsoft Windows (Mohurle and Patil, 2017). Unlike crypto locker, the WannaCry
ransomware also encrypts the data or the information present within a computer system that
is likely affected by it. The propagation methodology that is adapted by this type of attack
was the mode of Eternal Blue. This is significantly identified by an exploit, which was
developed by the National Security Agency of the United States. The attack primaarily
targeted the computer systems that were running on the older versions of the Windows OS.

5RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
The prime advantage that is adhered by this ransomware attack is depicted to be the fact of
the backdoor installation within the infected systems (Chen and Bridges, 2017). The ransom
that is asked by this type of attack was a significant amount of money in respect to the Crypto
Locker (Weckstén et al., 2016). To restrict this attack from spreading onto most number of
the computer systems Microsoft effectively and within time launched many security patches
over the computers, that effectively restricted the attack to spread in other organizations that
were remain unaffected.
2.3 Bad Rabbit
The Bad Rabbit is depicted as one of the significant ransomware attacks that had hit
the computer systems of most parts of Russia by the year 2017. This ransomware utilised the
methodology of the ransomware dropper that intends to distribute themselves with the help of
drive by attacks (Zimba and Chishimba, 2019). When a user of a computer system is
significantly trying to visit a legitimate website, the malware dropper tends to drop the
malware onto the user’s system that intends to violate the overall infrastructure of the
computer system. This in turn encrypts the overall data within the computer system thus
making the system to lock the data. Thus for the decryption of the data a certain amount of
ransom is asked by the attackers which does not guarantees the exact retrieval of data after
the ransom is paid (Roberts, 2018). Most of the victims of this attack is identified in the
country of Russia, after which it is also significantly identified in countries like Ukraine,
Turkey and many more. The antivirus manufacturing giant Kaspersky firstly detected this
type of threat thus providing enhanced solution to restrict or prevent this type of attack to
spread within other computer systems.

6RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
3.0 Working mechanism of Ransomware
A set of steps has been identified that represents the working of a ransomware
(Zavarsky and Lindskog, 2016). These are stated as follows:
1. The end-user of a computer system receives an attachment that is provided within an email
that appears from a reliable source. This kind of email comprises an URL that leads to the
SaaS application. The primary application are likely to be Salesforce, Zen Desk and many
more.
2. The user clicks on the link, which leads the user to a new browser window thus leading the
user to a website that is legitimate.
3. After this page has been uploaded then the web server tends to host the kit of exploitation
thus developing a communication in regards to the victim machine.
4. As soon as the vulnerable version of the URL is seriously confirmed then the exploitation
set tends to feat the overall weakness of the systems.
5. From this vulnerability the child processes spawns to the overall system environment
including the vssadmin.exe, thus deleting the overall persisting shadows within the victim
computer system as well as further creates the new shadows in accordance to tend for hiding
them.
6. The binary child processes uses a dedicated PowerShell that tends to propagate copies of
the files present within the system throughout the overall file system.
7. Thus, the program of powershell.exe creates some child processes spreads out to the
overall file system present within the computer system. Moreover, this creates three copies,
first of which goes to the AppData directory, next of which is created within the Start
Directory as well as lastly within the root present within the C: directory.

7RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
8. After the overall encryption in regards to the victim’s files, then this malware tends to send
an encryption key that intends to take control of the overall information in the host specific
servers to control them.
9. After this, the server directs a message to user of the target computer. This message can be
a simple alert message like “alert user of encryption as well as directions to pay us”. This
may also include the directions that will help the victim to download the additional malwares
that enables the attacker to permanently access as well as steal the significant credentials of
the victim as well. To emphasize on the fact of increasing the distress of the victim the
attacker also uses a timer that will measure the overall countdown regarding the time of
paying the victim a sufficient amount of ransom that the attacker demanded (Gordon, Fairhall
and Landman, 2017). Moreover, paying away the ransom does not guarantees the victims
files to be retrieved. However, the mechanism of attack does not tends to end here. The
impact of the attackers moreover tends to load the additional malwares onto the machine of
the user thus giving access to the attacker to harvest the personal information of the victim as
well as put negative impact on the details of the intellectual property as well as credentials so
that they can tamper them and make huge amount of money from that information.
Thus, the overall steps in regards to the overall working mechanism regarding a
ransomware attack may be depicted by the following figure stated below:

8RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
(Image: Working Mechanism of Ransomware)
(Source: Pope, 2016)
4.0 Potential threats involved
Ransomware is depicted to be attacking the computer systems all over the globe,
henceforth the impact areas of ransomware is not industry specific. It may be observed within
the healthcare industry as well as education industry, government industry, manufacturing
and many more (Yaqoob et al., 2017). The ransomware also tends to incur a great amount of
financial loss of the individual as well as the organization that is being affected by this attack.
The encryption regarding the data within the attacked systems is a significant threat as with
the effect of this attack the personal as well as the significant important data may get hamper
in such a way that the attackers may use this personal information in order to retrieve the
personal assets and thus hamper the personal properties.
The ransomware mainly focuses on the area of financial extortion from the computer
as well as the organization that are affected by this attack. The financial amount that are
being demanded by the attackers is way too high as well as the demands once met does not
guarantees about the overall retrieval of data (Schirrmacher, Ondrus and Ter Chian Felix Tan,
2018). The data or the personal information that is being attacked by the attackers is very

9RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
important as this attackers mainly target the individuals or the organization that may tend
them to acquire more money by the disruption of the data. The organizational areas that are
mainly affected by the ransomware attack or the industrial fields that are mainly focused by
the attackers to attack the data is depicted by the following figure:
(Image: Industrial areas of attack)
(Source: Bhardwaj et al., 2016)
The significant information stored by the organizations as stated in the figure are
stated to be very significant in regards to the attackers, as the end users of these organizations
tend to provide any type of ransom or amount of money for the retrieval of data (Kharraz et
al., 2015). Thus, the potential threats that can be collectively stated as money extortion, data
disruption as well as non-retrieval of information that are personal as well as valuable to the
individual or an organization.
5.0 Summary
Thus, the overall report gives a clear reflection of the most significant cyber-attack
that is identified as the Ransomware attack. This attack also possess many types of variants in
regards to the attack. The report identifies the three important attacks or variants of
ransomware attacks that tends to provide a negative emphasis on the overall society with
respect to the data disruption as well as the huge amount of financial loss of the attacked
individuals as well as the organizations where the ransomware has been affected. Moreover,

10RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
the report also states the overall working mechanism of the ransomware that may be stated to
be common in regards to the different types of ransomware.
The mechanism as stated in the above report is mainly followed by most of the
variants of ransomware, which persist in the cyber-attack field. However, the report states a
clear perception of the threats that are being involved in the fact as well as in the fields that
are attacked by the ransomware. These threats are depicted to be very significant in regards to
the society as well as the industries that are being affected by this this type of cyber-attack.
Thus, it can be concluded that the ransomware attack is a significant cyber-attack that is
being identified in this modern world thus making the data as well as information to be
vulnerable. Thus, the software as well as antivirus companies must focus on the development
of the certain kinds of software, which will possess the capability of restricting the
ransomware attacks in the computers as well as in the overall targeted organizations.

11RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
6.0 References
Bhardwaj, A., Avasthi, V., Sastry, H. and Subrahmanyam, G.V.B., 2016. Ransomware digital
extortion: a rising new age threat. Indian Journal of Science and Technology, 9(14), pp.1-5.
Brewer, R., 2016. Ransomware attacks: detection, prevention and cure. Network Security,
2016(9), pp.5-9.
Chen, Q. and Bridges, R.A., 2017, December. Automated behavioral analysis of malware: A
case study of wannacry ransomware. In 2017 16th IEEE International Conference on
Machine Learning and Applications (ICMLA) (pp. 454-460). IEEE.
Gonzalez, D. and Hayajneh, T., 2017, October. Detection and prevention of crypto-
ransomware. In 2017 IEEE 8th Annual Ubiquitous Computing, Electronics and Mobile
Communication Conference (UEMCON) (pp. 472-478). IEEE.
Gordon, W.J., Fairhall, A. and Landman, A., 2017. Threats to information security—public
health implications. N Engl J Med, 377(8), pp.707-709.
Hampton, N., Baig, Z. and Zeadally, S., 2018. Ransomware behavioural analysis on windows
platforms. Journal of information security and applications, 40, pp.44-51.
Kharraz, A., Robertson, W., Balzarotti, D., Bilge, L. and Kirda, E., 2015, July. Cutting the
gordian knot: A look under the hood of ransomware attacks. In International Conference on
Detection of Intrusions and Malware, and Vulnerability Assessment (pp. 3-24). Springer,
Cham.
Mohurle, S. and Patil, M., 2017. A brief study of wannacry threat: Ransomware attack 2017.
International Journal of Advanced Research in Computer Science, 8(5).

12RANSOMWARE ATTACK AND ITS IMPACT ON SOCIETY
Pope, J., 2016. Ransomware: minimizing the risks. Innovations in clinical neuroscience,
13(11-12), p.37.
Richardson, R. and North, M.M., 2017. Ransomware: Evolution, mitigation and prevention.
International Management Review, 13(1), p.10.
Roberts, N., 2018. Ransomware: an evolving threat (Doctoral dissertation, Utica College).
Schirrmacher, N.B., Ondrus, J. and Ter Chian Felix Tan, 2018. Towards a Response to
Ransomware: Examining Digital Capabilities of the WannaCry Attack. In PACIS (p. 210).
Weckstén, M., Frick, J., Sjöström, A. and Järpe, E., 2016, October. A novel method for
recovery from Crypto Ransomware infections. In 2016 2nd IEEE International Conference
on Computer and Communications (ICCC) (pp. 1354-1358). IEEE.
Yaqoob, I., Ahmed, E., ur Rehman, M.H., Ahmed, A.I.A., Al-garadi, M.A., Imran, M. and
Guizani, M., 2017. The rise of ransomware and emerging security challenges in the Internet
of Things. Computer Networks, 129, pp.444-458.
Zavarsky, P. and Lindskog, D., 2016. Experimental analysis of ransomware on windows and
android platforms: Evolution and characterization. Procedia Computer Science, 94, pp.465-
472.
Zimba, A. and Chishimba, M., 2019. Understanding the Evolution of Ransomware: Paradigm
Shifts in Attack Structures. International Journal of Computer Network and Information
Security, 11(1), p.26.