Ransomware: Variants, Potential Threats, and Mitigation Strategies

This report explains the different variants of ransomware, their working principle, and potential threats and risks. It also provides mitigation strategies to reduce the impact of ransomware on computer systems and personal data. The report includes a case study on the WannaCry ransomware attack and its effects on computer systems worldwide.

nnin ead A M ARu g H : R NSO W RE
0
an om areR s w

A M AR NSO W RE
1
Introduction
Ransomware is defined as software
which is used to publish the victim’s
information. There are many simple
ransom wares that are very easy to hack
of unlocked and to reduce this type of
problem malware developed new
technology that is cryptoviral extortion
[1]. It is a very common problem for all
computer systems and it is very harmful
to computer devices. The main objective
of this report is to describe the impact of
ransomware on the society and evaluate
potential threats and risks of this
software. Ransomware is one of the
biggest problems for society and it
affects human body systems, users,
home appliances, potentially harmful for
any organization, increase financial
problems, and permanent loss of
information or data. This report is
explaining the working principle of
ransomware and potential threats and
risks of ransomware [2].
Variants of Ransomware
There are many types of ransomware in
which are describing below
Locker ransomware
Locker ransomware is defined as a
ransomware which is used to access any
computer resources. This type of
ransomware is used to lock the
computer system or devices and ask to
pay money in order to restore data or
information. The locked computer can
access user and only user or customer
allowing to communicate with
ransomware and pay the ransom. This is
only designed to prevent access to the
computer device and there are many
organizations that are using this for
security purpose [2].
Crypto Ransomware
The main purpose of this ransomware is
to determine and encrypt data or
information stored in the computer
systems and provide a platform to
obtain the decryption key. In this
modern generation, there are many
people who are storing personal data or
information in computer systems and
devices. Backup is one of the most
common processes to protect data or
information and Crypto ransomware
store human personal data and it uses
internet of thing to store data in
computer systems. This is an advanced
ransomware which reduced hacking
systems and it increased security
system for all people and organizations
[3].

A M AR NSO W RE
2
Mac ransomware
Karger is a type of Mac ransomware
which is established in 2016 and this is
the first type of Mac which infects the
Mac running OS X. This was injected into
the users and when any user downloads
this software which can infect with the
ransomware. Once this infected than it
waits around 3 days and after that, it
encrypts around 300 data files and
users pay to access this service in
computer devices [4].
Cerber ransomware
It is the most common type of
ransomware which is used to encrypt
data or information file in computer
systems. This ransomware encrypts all
data files of infected customers and
demand for money to restore data of
information from the computer system.
It also works when a human is not
connected with internet connections [5].
This ransomware sends an email to user
and demand money to access their data
or information.
Crypto wall ransomware
It was established after the crypto
locker and it reduced drawbacks of the
crypto locker. This type of ransom is
used to decrypt data or information of
any computer system and to access this
service user give money or fund to the
organization after that they can use this
service. There are many types of the
crypto wall such as crypto bit, crypto
defence, and crypto wall 2.0, and 3.0 [6].
The working mechanism of
ransomware
Ransomware is a type of software which
is used to protect data or information of
computer system and it is increased
rapidly in the last few years. There are
many steps through which ransomware
can access any computer system. One of
the greatest mutual delivery schemes is
phishing spam add-ons that come to the
dupe in an email, masked as a folder
they must trust [7]. Once they're copied
and opened, they can revenue over the
target's processor, particularly if they
have integral communal engineering
gears those artificial operators into
letting managerial admission. There is
many another form of ransomware such
as NotPetya, exploit security holes to
contaminate processors without
demanding to trick operators. There are
few steps involved in ransomware
process such as
 The malicious software plots on
the processor through an unsafe
email accessory or transfer. The
malware produced a fault in the

A M AR NSO W RE
3
working scheme in order to run
unsafe code on your processor.
 After that ransomware encrypt
personal files of the computer
system and mover into the
computer system
 The hacker demand money to
restore data or information to
their computers by using various
online websites [8].
Potential threats posed by
ransomware
Ransomware is one of the most common
problems for users and customers and it
is increased rapidly in the last few years.
They sent a fraud E-mail on people
accounts and encrypt all data or
information which is stored in computer
systems and devices. After that, they
communicate with the person by online
websites and demand money or fund to
restore their personal data or
information. This problem increases by
spam messages and e-mails and there
are many threats and risks occur due to
this problem such as affects human
body system, harmful for computer
system and data, increase many hacking
system, through which many people are
learning hacking programmes which are
a very serious problem, can effects on
children and adults, and reduced
security systems, and also increase
financial problems. There are mainly
two types of ransomware used at that
time for encryption purpose such as
encrypting ransomware and locker
ransomware [8].
Encrypting ransom ware involves many
advanced data structure for encryption
of data and it is used to block human
computer systems and devices. This
ransomware reduces security systems
and hacks computer systems by sending
spam e-mails and demand money to
restore data or information. This
process is very harmful to human-
computer systems and also increases
human health risks [9].
Locker ransomware is also called as a
computer locker and it locked human-
computer systems and devices by using
some algorithm process. This
ransomware inserts in computer
systems by e-mail and other process
and after that, it blocks all personal files
and data in computer systems and
demand money by online websites. This
ransomware blocks all files and may be
lost in your personal data which is very
harmful to your computer systems [9].

A M AR NSO W RE
4
A case study on ransomware attack
WannaCry is one of the most common
cybersecurity risks and it is increased
rapidly in the last few years. In 2017
there are many cybersecurity attacks
observed in which WannaCry one of the
biggest security attack is identified. On
May 12, 2017, WannaCry affected
around thousand computes systems
worldwide and it is a part of the
ransomware attack. Ransomware was
defined as infectious because it has the
ability to feast across a community and
an organization system by exploring
susceptibility in computer systems [9].
At that time WannaCry hacked many
computer systems and encrypt all
personal data or information files after
that they demand money or fund to
restore data or information. Therefore it
is the very serious problem for all users
and they always communicate with e-
mail and after that, they hacked your
data files and blocked them.
Recommendation
Ransomware is one of the biggest
problems for all users and organizations
because it encrypts the human-
computer system and blocks all
personal data files. To reduce this type
of problem there are few mitigation
process are used such as educate
employees for data security, use proper
data backup system for personal data
files, restrict code execution, restrict
system or computer devices access,
update software regularly, use security
systems, robust filtering process,
blocking attachments, removing spam
emails and messages [10]. All these are
very common strategies and mitigation
to reduce ransomware problem in
which there is the main two most
mitigation process which can be sued
for this problem such as use proper
backup plan and robust filtering. Robust
filtering is used to block spam messages
and e-mails and it reduced this type of
problem by 40% [11]. Therefore to
reduce ransomware attack people can
use cloud computing technology for data
backup and they can use robust filtering
process both can help to reduce this
type of security risks and also increase
data or information security [12].
Conclusion
Ransomware is one of the biggest
problems in all countries and it is
estimated that in 2017 around one
thousand computer systems were
hacked by ransomware. There are
mainly two types of ransomware are
used such as Encrypting ransomware
and locker ransomware. This report

A M AR NSO W RE
5
described different variants of
ransomware and also explained the
mechanical process of ransomware.
There are various processes through
which this problem can be reduced
which are described in this report.
Ransomware attack can be reduced if
any person uses proper data backup
plan like cloud computing system and
use a robust filtering process to block
spam messages both are main two
mitigation process through which this
security risk can be resolved.

A M AR NSO W RE
6
References
1. N., Andronio, S., Zanero, and F. Maggi,
“Heldroid: Dissecting and detecting
mobile ransomware.” In International
Workshop on Recent Advances in
Intrusion Detection, vol. 12, pp. 382-404,
2015.
2. A., Bhardwaj, V., Avasthi, H., Sastry,
and G. V. B. Subrahmanyam,
“Ransomware digital extortion: a rising
new age threat.” Indian Journal of
Science and Technology, vol. 9, no.14, pp.
1-5, 2016.
3. K., Cabaj and W., Mazurczyk, “Using
software-defined networking for
ransomware mitigation: the case of
cryptowall.” IEEE Network, vol. 30, no. 6,
pp. 14-20, 2016.
4. M., Conti, T., Dargahi and A.,
Dehghantanha, “Cyber Threat
Intelligence: Challenges and
Opportunities.” Cyber Threat
Intelligence, vol. 15, pp. 1-6, 2018.
5. A., Gazet, “Comparative analysis of
various ransomware virii.” Journal in
computer virology, vol. 6, no. 1, pp. 77-
90, 2010.
6. A., Kharraz, S., Arshad, C., Mulliner, W.
K., Robertson and E., Kirda, “UNVEIL A
Large-Scale, Automated Approach to
Detecting Ransomware.” In USENIX
Security Symposium, vol. 19, no. 11, pp.
757-772, 2016.
7. A., Kharraz, W., Robertson, D.,
Balzarotti, L., Bilge and E., Kirda,
“Cutting the Gordian knot: A look under
the hood of ransomware attacks.”
In International Conference on Detection
of Intrusions and Malware, and
Vulnerability Assessment, vol. 22, no. 2,
pp. 3-24, 2015.
8. X., Luo, and Q., Liao, “Awareness
education as the key to ransomware
prevention.” Information Systems
Security, vol. 16, no. 4, pp. 195-202,
2007.
9. F., Mercaldo, V., Nardone, A., Santone
and C. A. Visaggio, “Ransomware steals
your phone. formal methods rescue it.”
In International Conference on Formal
Techniques for Distributed Objects,
Components, and Systems, vol. 22, no. 4,
pp. 212-221, 2016.
10. M., O'Rourke, “The Inevitability of
Ransomware.” Risk Management, vol.
64, no. 7, p. 3, 2017.
11. M., Shukla, S., Mondal and S., Lodha,
“POSTER: Locally virtualized

A M AR NSO W RE
7
environment for mitigating ransomware
threat.” In Proceedings of the 2016 ACM
SIGSAC Conference on Computer and
Communications Security, 16, no. 5, pp.
1784-1786, 2016.
12. A., Zimba, “Malware-free intrusion: a
novel approach to Ransomware
infection vectors.” International Journal
of Computer Science and Information
Security, vol. 15, no. 2, p. 317, 2017.