People may think there are no signs that a ransomware attack is imminent until it is too late, but that’s not the case. Here are some of the early signals that lawyers and staff can watch for to help prevent an attack.
HOW IT WORKS
Ransomware attacks happen when a bad actor, a cybersecurity adversary interested in attacking information, phishes — in other words, tricks someone in an organization into clicking on a link or downloading a file that then installs a virus on their computer. It can involve hundreds of attempts against any users on a given network. The frightening part is only one attempt needs to work for the attack to be successful. Once downloaded, the malware will start to encrypt all the files on that individual’s computer — and then move on to any connected system.
Users will eventually receive a ransom demand asking for payment of a certain amount of money — usually in bitcoin or another untraceable cryptocurrency — to decrypt the data. Previously, paying the ransom would solve the problem. More recently, however, bad actors have taken payments and unlocked files but kept the data for sale on the so-called dark web. (They are, after all, criminals.) This outcome is another reason why spotting the early signs of a ransomware attack in the first place is so important.
EARLY SIGNS OF A RANSOMWARE ATTACK
These are the common warning signs of an imminent ransomware attack that a firm should educate lawyers and staff to watch for:
- An increase in phishing attempts: If a firm’s employees start noticing a significant uptick in spam emails, that could be a sign bad actors are looking for ways to plant malware. Since it only takes one person clicking on a bad link or mistakenly downloading a virus-laden file to potentially infect an entire network, any increase in phishing attempts should immediately set off alarm bells.
- Unauthorized access alerts: A firm’s network administrator may see an increase in unauthorized access attempt notifications. Individuals could also receive emails letting them know someone has tried to reset their passwords. These attempts at your network access could indicate a ransomware attack is underway.
“Previously, paying the ransom would solve the problem. More recently, however, bad actors have taken payments but unlocked files and kept the data for sale on the so-called dark web.”
- Virus protection alerts: If a bad actor is trying to place malware on someone’s computer, any installed virus protection software may raise an alert and block the program from running. Having up-to-date antivirus software is an excellent idea as it provides the first line of defense.
- Scrambled file names or contents: When malware encrypts the data on a computer, it will often scramble the names of files or make it so these files cannot be opened. If a user is looking at their drive and notices their usual file names have been replaced with unrecognizable gibberish, that could be the early stage of a ransomware hack.
- Computers locking up: Malware can interfere with a computer’s operating software, and that will cause performance issues, including system freezes. If these start to happen out of nowhere, ransomware could be the culprit.
