什麼是勒索軟體？

勒索軟體攻擊為何層出不窮？

現代勒索軟體熱潮始於 2017 年 WannaCry 爆發。這次大規模且廣為人知的攻擊表明，勒索軟體攻擊是可能的，並且可能有利可圖。從那時起，數十種勒索軟體變種被開發出來並用於各種攻擊。

The COVID-19 pandemic also contributed to the recent surge in ransomware. As organizations rapidly pivoted to remote work, gaps were created in their cyber defenses. Cybercriminals have exploited these vulnerabilities to deliver ransomware, resulting in a surge of ransomware attacks.

In an age dominated by digital risks, a staggering 71% of companies have encountered ransomware attacks, resulting in an average financial loss of $4.35 million per incident.

In the year 2023 alone, attempted ransomware attacks have targeted 10% of organizations globally. This marks a notable rise from the 7% of organizations facing similar threats in the previous year, representing the highest rate recorded in recent years.

Types of Ransomware Attacks

Ransomware has evolved significantly over the past few years. Some important types of ransomware and related threats include:

• Double Extortion: Double-extortion ransomware like Maze combines data encryption with data theft. This technique was developed in response to organizations refusing to pay ransoms and restoring from backups instead. By stealing an organization’s data as well, the cybercriminals could threaten to leak it if the victim doesn’t pay up.
• Triple Extortion: Triple extortion ransomware adds a third extortion technique to double extortion. Often, this includes demanding a ransom from the victim’s customers or partners or performing a distributed denial-of-service (DDoS) attack against the company as well.
• Locker Ransomware: Locker ransomware is ransomware that doesn’t encrypt the files on the victim’s machine. Instead, it locks the computer — rendering it unusable to the victim — until the ransom has been paid.
• Crypto Ransomware: Crypto ransomware is another name for ransomware that underscores the fact that ransomware payments are commonly paid in cryptocurrency. The reason for this is that cryptocurrencies are digital currencies that are more difficult to track since they’re not managed by the traditional financial system.
• Wiper: Wipers are a form of malware that is related to but distinct from ransomware. While they may use the same encryption techniques, the goal is to permanently deny access to the encrypted files, which may include deleting the only copy of the encryption key.
• Ransomware as a Service (RaaS): RaaS is a malware distribution model in which ransomware gangs provide “affiliates” with access to their malware. These affiliates infect targets with the malware and split any ransom payments with the ransomware developers.
• Data-Stealing Ransomware: Some ransomware variants have focused on data theft, abandoning data encryption entirely. One reason for this is that encryption can be time-consuming and easily detectable, providing an organization with an opportunity to terminate the infection and protect some files from encryption.

How Does Ransomware Affect Businesses?

A successful ransomware attack can have various impacts on a business. Some of the most common risks include:

• Financial Losses: Ransomware attacks are designed to force their victims to pay a ransom. Additionally, companies can lose money due to the costs of remediating the infection, lost business, and potential legal fees.
• Data Loss: Some ransomware attacks encrypt data as part of their extortion efforts. Often, this can result in data loss, even if the company pays the ransom and receives a decryptor.
• Data Breach: Ransomware groups are increasingly pivoting to double or triple extortion attacks. These attacks incorporate data theft and potential exposure alongside data encryption.
• Downtime: Ransomware encrypts critical data, and triple extortion attacks may incorporate DDoS attacks. Both of these have the potential to cause operational downtime for an organization.
• Brand Damage: Ransomware attacks can harm an organization’s reputation with customers and partners. This is especially true if customer data is breached or they receive ransom demands as well.
• Legal and Regulatory Penalties: Ransomware attacks may be enabled by security negligence and may include the breach of sensitive data. This may open up a company to lawsuits or penalties being levied by regulators.

如何防範勒索軟體

• 利用最佳做法

適當的準備可以大大降低勒索軟體攻擊的成本和影響。採取以下最佳實踐可以減少組織遭受勒索軟體的風險並最大限度地減少其影響：

1. 網路意識培訓和教育：勒索軟體通常透過網路釣魚電子郵件傳播。培訓使用者如何識別和避免潛在的勒索軟體攻擊至關重要。由於目前的許多網路攻擊都是從有針對性的電子郵件開始的，該電子郵件甚至不包含惡意軟體，而只是鼓勵用戶點擊惡意連結的社交工程訊息，因此用戶教育通常被認為是最重要的防禦措施之一組織可以部署。
2. 連續資料備份：勒索軟體的定義表明，它是一種惡意軟體，旨在使支付贖金成為恢復對加密資料的存取的唯一方法。自動化、受保護的資料備份使組織能夠從攻擊中恢復，並且不需要支付贖金的情況下，並且不需要支付贖金。 維護定期備份數據作為例行程序是一種非常重要的做法，以防止數據丟失，並在損壞或磁盤硬件故障時能夠恢復數據。 功能備份還可以幫助組織從勒索軟體攻擊中恢復。
3. 修補：修補是防禦勒索軟體攻擊的關鍵組成部分，因為網路犯罪分子通常會在可用的修補程式中尋找最新的未發現的漏洞，然後針對尚未修補的系統。因此，組織確保所有系統都應用了最新的修補程式至關重要，因為這可以減少企業中可供攻擊者利用的潛在弱點的數量。
4. 使用者身分驗證：使用竊取的使用者憑證存取 RDP 等服務是勒索軟體攻擊者最喜歡的技術。使用強大的使用者驗證可能會使攻擊者更難利用猜測或被盜的密碼

• 減少攻擊面

由於勒索軟體感染的潛在成本很高，預防是最好的勒索軟體緩解策略。通過解決以下問題來減少攻擊表面來實現這一點：

1. 網路釣魚郵件
2. 未打補丁的脆弱性
3. 遠端存取解決方案
4. 行動惡意軟體

• 部署反勒索軟體解決方案

需要加密所有使用者的檔案意味著勒索軟體在系統上運行時具有唯一的指紋。反勒索軟體解決方案旨在識別這些指紋。良好的反勒索軟體解決方案的共同特徵包括：

• 廣泛的變體檢測
• 快速檢測
• 自動恢復
• 恢復機制不基於常見的內建工具（例如“影子複製”，它是某些勒索軟體變體的目標）

Check Point 如何提供協助

Check Point 的反勒索軟體技術使用專門構建的引擎，可防禦最複雜、具有規避性的零日勒索軟體變體，並安全地恢復加密數據，從而確保業務連續性和生產力。我們的研究團隊每天都會驗證這項技術的有效性，並在識別和緩解攻擊方面持續展現出色的成果。

Harmony 端點是 Check Point 領先的端點預防和回應產品，包含反勒索軟體技術，利用 Check Point 業界領先的網路保護為 Web 瀏覽器和端點提供保護。Harmony 端點可跨所有惡意軟體威脅媒介提供完整、即時的威脅防護和修復，讓員工無論身在何處都能安全工作，而不會影響工作效率。