Ransomware in business: how it gets in, what it costs and what stops it

Encryption is the last part, and the least important one

Everyone’s mental image of ransomware is the screen with the ransom note. That screen is the end. By the time it appears, the attack has been inside for days or weeks and has already done what really matters.

The usual sequence is this: they get in, they look around, they obtain high privileges, they find where the backups are and disable them, they take the data out, and only then do they encrypt. The order is not accidental: encrypting earlier would raise the alarm and stop them doing everything above.

From that comes the consequence that is hardest to accept: a perfect backup no longer solves the problem. It gives you your operations back, not your confidentiality. The negotiation stops being about recovering the files and becomes about not publishing them, and for that a backup is no use at all.

That is why the leak site exists: a website where the victims who do not pay get published. It does two jobs at once, punishing whoever does not pay and acting as a shop window to convince the next one.

And it is worth knowing that the worst case exists: sometimes there is no key. A wiper destroys and disguises itself as ransomware to buy time and confuse the response. Paying there gives nothing back, because there is nothing to give back.

Who is on the other side: an ecosystem, not a group

Thinking about ransomware as one particular gang leads to the wrong conclusions, above all to the idea that if that gang is dismantled the problem goes down.

The work is split up:

• Whoever gets in is usually not whoever encrypts. An initial access broker does nothing but obtain ways into companies and sell them. Their product is a valid credential or an already exploited vulnerability.
• Whoever encrypts usually rents the tool. Ransomware as a service supplies the encryptor, the panel, the negotiation and the leak site, and takes a percentage. Whoever attacks your company may be an affiliate with barely any technical skill.
• Brands get rebuilt. When a law enforcement operation takes a platform down, the infrastructure falls but the affiliates do not: they spread across whichever ones are left, or reappear under another name.

That is why this page does not publish a list of families with dates. It would be a list of other people’s names that expires within months and that would force us to assert dates we cannot check. What does not expire is the structure: as long as selling access and renting encryptors is profitable, the name of the group is the least of it.

How they get in, in order of frequency

Almost always through one of these four, and none of them is sophisticated:

1. A valid credential. Leaked somewhere else and reused, or stolen by an infostealer on a personal machine. It is the cleanest route because it triggers nothing: the access is legitimate.
2. A remote access exposed to the internet with no second factor, or with one that can be relayed. Remote desktop, an old VPN, an admin panel that "only the supplier knows about".
3. An unpatched perimeter system. The machines facing the internet are the first ones to be scanned, and the vulnerabilities that are actually being exploited are public. Patch management here is not about patching everything, it is about patching first what can be seen from outside.
4. A person. Phishing with an attachment or with a link that asks for credentials. It still works and it is better written now.

What almost never happens is what people imagine: a targeted, original attack against your company in particular. The normal thing is that you fit into a sweep.

What decides the ransom, and why you will not find a figure here

This page used to carry two contradictory amounts: one of a few hundred and one of millions. Both have been withdrawn, and not out of caution, but because the question "how much does a ransom cost" has no answer that is any use. The amount is not a price list, it is an estimate they make about you.

What moves it:

• What they think you can pay. They look at your filed annual accounts, your published revenue and your size. It is one of the things they do while they are inside without anyone noticing.
• Whether you have insurance and for how much. If they find the policy in the finance director’s mailbox, the figure ends up looking suspiciously like the cover.
• What they have taken. Customer data, records, information under a confidentiality agreement or material affecting a deal in progress are worth more than a folder of invoices.
• How long you can stay down. A factory or a logistics operation has less room than an office, and they know it.

Any average figure you read out there describes other companies, not yours. If you need a number for a board, the one that works is a different one and it is yours: what a day of downtime costs your company. That one can be calculated, and it is the one that decides how much it is worth investing in not getting there.

Paying or not paying

The decision is not a technical one and it is not made by whoever runs the systems. What is technical is knowing what you are buying and what you are not.

• Paying buys a key, not a recovery. Decrypting a large estate is slow and not always complete.
• It does not buy silence you can verify. You are paying for a promise not to publish, given by whoever has just extorted you, and the data is already out.
• It marks you as a payer.
• And it has legal and sanctions implications that depend on who is being paid and on the jurisdiction you operate in. A lawyer looks at that with the case in front of them, not a web page.

What has to be decided beforehand, not during: who is in charge in a crisis, who talks to the regulator and to customers, and on what basis the call gets made. That is incident response, and the part about preserving the evidence without destroying it is digital forensics. Improvising those three decisions at three in the morning is how the worst ones get made.

What actually breaks the chain

In order of effect, not of price:

1. Backups the attacker cannot delete. An immutable backup or an offline one, with credentials that are not the domain ones. Finding and destroying the backups is a fixed step of the attack, and a backup reachable from the compromised network is not a backup.
2. A restore that somebody has tested end to end. Not one file: the service. Almost everyone has backups and almost nobody knows how long it takes them to come back.
3. Identity. A second factor that cannot be relayed on everything that faces the internet, and least privilege for real: separate admin accounts with no mailbox on them. Half the damage of a ransomware attack is that the first account they get hold of can already do everything.
4. Segmentation. So that one compromised machine does not see the other thousand. It is what turns an incident into one department’s problem.
5. Detection on the endpoint. An EDR with somebody watching it. With nobody watching, it is a licence.
6. And on top of all of it, defence in depth, which means assuming that one of the above is going to fail.

How it gets checked before it happens

All of the above can be bought, switched on and documented, and still not work. The only way to know is for somebody to try.

• Internal network pentest. It answers the specific question: from an ordinary workstation, can you reach the backups, the domain controller and the file servers? That is the route ransomware takes.
• Assumed breach. It starts by taking as given that a machine is already compromised, which is what actually happens, and measures how far it gets and how fast.
• Red team. For when what you want to measure is not the vulnerabilities but whether anyone notices and what they do about it. It is the exercise closest to real ransomware without being it.
• Phishing simulation, measuring how many people report it and how fast, which is the useful number.
• Credential monitoring, so that you find out one of your accounts is for sale before somebody buys it.

The general order of priorities, if this is the first thing you are looking at, is in the guide to cybersecurity for companies, and the picture of what is actually getting in is in cyber threats facing companies in Spain. For a specific case, get in touch.