According to the IT threat evolution report by Kaspersky Lab, the number of internet users who encountered ransomware attacks that encrypt files more than doubled in the third quarter of 2016, amounting to 821,865 people. This marks the third consecutive quarter of increasing victim numbers. In addition to the rising number of victims, criminals are also exploring new areas of operation. In the third quarter of this year, the top five countries with the highest percentage of users attacked by encrypted ransomware were: Japan (4.83%), Croatia (3.71%), South Korea (3.36%), Tunisia (3.22%), and Bulgaria (3.2%). In the previous quarter, Japan also held the top position, while Italy, Djibouti, and Luxembourg were ranked second, third, and fourth respectively.
Ransomware, a malicious program that encrypts the victim’s files, remains one of the most widespread types of activities engaged in by modern cybercriminals who demand a ransom in exchange for decryption. The costs of its development are relatively low, and it can yield potentially high revenues if it results in a successful infection.
The main driver of the increase in the number of attacked users was Trojan-Downloader.JS.Cryptoload – a group of downloaders written in JavaScript, capable of downloading various groups of crypto ransomware. The most widespread among them in the third quarter were CTB-Locker (28.34% of attacked users), Locky (9.6%), and CryptXXX (8.95%).
– Crypto Ransomware remains one of the most dangerous threats to private users and companies. The recent surge in the number of attacked users may be attributed to the fact that the number of ransomware modifications we discovered in the third quarter – over 32,000 – was 3.5 times higher than in the second quarter. This may be due to the fact that security companies today invest significant resources to be able to detect new forms of ransomware as quickly as possible. Criminals must therefore avoid detection by creating increasingly new modifications of their malicious programs, said Fedor Sinitsyn, a ransomware expert at Kaspersky Lab.
Since encrypted ransomware is one of the most dangerous types of malware ever created, with potentially severe consequences, Kaspersky Lab offers advice on how to protect yourself and your organization against this threat.
Consumer Tips: • Creating a backup of data is essential. The sooner it becomes a routine in your daily activities when using a personal computer, the sooner you will become resilient to any ransomware attack. • Use a reliable security solution. When using it, do not disable the advanced security features it undoubtedly has. These are usually features that allow for the detection of new ransomware based on their behavior. For example, when Kaspersky Internet Security – multi-device 2017 detects strange modifications in user files, it immediately creates fresh copies of those files to prevent them from being “stolen.” It then examines the software that attempted to modify the files and blocks it if it is suspicious. • Keep your software updated on your computer. The most commonly used applications (Flash, Java, Chrome, Firefox, Internet Explorer, Microsoft Office) and operating systems (such as Windows) have an automatic update feature. Keep them enabled and do not ignore the requests from these programs to install updates. • Pay attention to files you have downloaded from the internet and received via email, especially from unreliable sources. In other words, if what was supposed to be an mp3 file has a .exe extension, it is definitely not a music file, but a malicious program. The best way to ensure that everything is fine with downloaded content is to make sure they have the correct extension and have successfully passed security checks on your computer. • If for some reason your files are encrypted by ransomware and you are asked to pay a ransom, do not do it. Every Bitcoin transferred into the hands of criminals reinforces their confidence in the profitability of this type of cybercrime, which in turn leads to the creation of new ransomware. At the same time, numerous security companies, including Kaspersky Lab, are fighting ransomware on a daily basis. Sometimes it is possible to create a decryption tool for a specific type of ransomware, and sometimes, as a result of cooperation with law enforcement agencies, it becomes possible to obtain keys for decrypting a specific group of ransomware, which can ultimately lead to the decryption of the files themselves. Last but not least: creating, spreading, and demanding a ransom for decryption are actions defined as criminal in most countries around the world. Report the attack to the police to initiate an investigation.
