Ransomware is a type of malware that infects systems, then encrypts all files it can find until a ransom is paid. It can infect personal computers, but also entire organizations, causing major financial losses.
Once a system is infected and its files are encrypted, they can almost never be recovered (for free). This is of course if we do not keep frequent (or at all) backups of our files. For this type of attack, it is important to base the integrity and availability of our files before it is too late.
The way ransomware spreads is becoming increasingly creative. Below we will list 5 ways you can block some of the transmission methods.
1.Shared files
One of the very basic things we need to pay attention to is that our shared folders should never have Read/Write permissions from everyone. When malware tries to spread, they look for any possible way they can communicate with other computers. Shared files are one of them.
2. Service Processes
If services are not used frequently, it is best to stop them. Malicious programs disguise these processes so that the user does not notice them.
3. Detection of C&C accounts
Many malware create local hidden accounts. When this happens, your installed antivirus may not be able to flag the hidden account's malicious activity. The solution is to frequently run discovery tools for user accounts on your systems.
4. Rogue browser plugins
A common way your system can become infected is through malicious plugins. Malicious plugins have the ability to record and even modify the content of the websites you visit.
5. Checking outgoing connections
When we use Firewalls or proxy servers, all our connections go through them. So it is important to have some program that checks if outgoing connections are destined for malware sites, C&C servers or botnets.
Finally, malware uses many different ways to infect new systems, which is why it is important to have multiple layers of security in place to block a large portion of attacks.
