Cyberattacks have been a risk to both individuals and businesses since computers came into play. Gartner, for instance, predicts that by 2025 cyberattacks will aim to harm humans directly rather than just their digital businesses.
Instances like the Colonial Pipeline ransomware attack in 2021 is only one of the examples that show the real impact of malware and ransomware, attacks on society. This event caused one of the largest pipelines in the US to shut down for several days and was declared a national security threat by President Joe Biden himself. In addition, the financial impact of cyberattacks, especially malware attacks, can be disastrous. It is expected to reach $50bn by the end of 2023.
When it comes to malware, three are the main objectives that motivate an attack: actual harm, commercial vandalism and reputational vandalism. Malware can easily infiltrate any device via seemingly-innocuous links or pop-ups which are often ransomware.
While malware is more of an umbrella term, ransomware indicates a specific type of cyber threat. But what are the differences?
Is ransomware malware?
The short answer is yes, ransomware is a type of malware. Its typical method is to prevent the victim from accessing the affected device and its data by encrypting all files.
Immanuel Cavoya, a threat detection expert of SonicWall, an American cybersecurity company, told Tech Monitor: “Ransomware is a type of malware that is specifically designed to enter a computer system and then block access to it. Those using the malware then will demand a ransom. Generally speaking, however, a bad actor looking to score an easy ransomware payday looks for three key elements – money, a business/life critical case and easy entry.”
The name ransomware gives away its main characteristic, which entails the criminal group behind the attack asking for a ransom in exchange for the decryption of the files.
However, it is not always advisable to pay the requested sum, especially because the criminals often will not respect their end of the deal and also because the computer will still be damaged and an easier target.
What is the difference between ransomware and malware?
By definition, malware is any software that can aid criminal organisations to gain unauthorised access to devices and operating systems to steal data, disrupt it or damage the networks in any way.
As such, malware is more of an umbrella term that includes various kinds of cyber threats. Some examples include adware, also called spam, and worms, which duplicate themselves in other devices attaching themselves to hard drives or a device’s memory.
However, even if all ransomware is malware, not all malware is ransomware. For instance, a trojan horse is a type of malware that acts like a legitimate application or file on one’s device but ends up being a cover to download damaging malware on it. A virus too is malware which, as the name suggests, spreads from one computer to the other.
Ransomware, however, is a type of malware which encrypts files and won’t release them until a ransom payment is made.
What are the different types of ransomware?
Ransomware reaches a device via different tactics. Most of the time, they involve phishing, which releases malware once the victim has clicked on a compromised email attachment or link.
Simon Bain, cybersecurity expert and CEO of software company Omnilndex, told Tech Monitor that our current workflows are very easy targets. “This is because we are all continually sharing files for collaboration and analytics and therefore leaving openings in the system.
“If just one of the 17 million phishing emails hits a target, then bang! The system is compromised. It then just takes one automated sync to the network after the attack for it to spread deeper.”
The most widespread types of ransomware are crypto-ransomware or encryptors, lockers and scareware. In addition, there are also doxware or leakware and ransomware as a service (RaaS).
Encryptors are not only one of the best-known but also one of the most dangerous kinds of ransomware. This is because once the files are locked, the content becomes inaccessible without a decryption key, which is always in the hands of the criminals. Lockers are similar in the encryption of the files, but they also often entail a ransom note appearing on the screen.
Scareware, on the other hand, is fake software that claims to have detected a virus or other malware and the only way to “solve” the issue is to pay via a corrupted link. Some of these can lock the device completely, while some others are less damaging and only flood the computer with pop-up alerts.
Leakware, also called doxware, is a virtual threat to leak personal and private information online. Because a lot of the time it threatens to leak financial information too, most victims end up paying the ransom.
The last type, RaaS, is usually acted out by a professional hacker, who handles every part of it on behalf of the sender, in exchange for a percentage of the payment, almost like a virtual hitman.
How can you prevent malware attacks?
Most of the time, malware attacks are initiated via email attachments, fake internet ads, infected applications or websites. By clicking on one of these, even by mistake, the malware can be downloaded to the device.
There are certain ways people can protect themselves and their devices from malware attacks. For instance, installing reliable anti-virus and anti-spyware software can scan computer files and eliminate any kind of malware. Software updates are also vital since they can fix any vulnerabilities in the system.
When it comes to data recovery, on the other hand, Bain explained that it all depends on what systems a company has in place. “If they’re using a Web3 data platform with blockchain data storage, then they will still be able to immediately access their data after an attack because it is all stored in multiple identical and immutable copies.
“However, if a business is still using older systems then all measures need to be taken to ensure the malware is not spread to their data backups. While this caution may delay how quickly a business can be operational again, it can also prevent further damage being done.”
Since emails are one of the major ways malware spreads, extra security and spam protection are advisable. However, sometimes, even these precautions are not enough. In order to be completely prepared for a malware attack, it is important to regularly backup the most relevant files on a separate hard disk or with backup software.
In order to minimise the risks of cyber attacks, especially at medium or large enterprises, it is vital that all employees and employers go through cyber security training. It is useful not only to raise awareness of cyber security issues but also to train everyone on what to do in case of a breach. After assessing the cyber risks, companies can implement additional security measures like multi-factor authentication (MFA), which can include additional verification sources like a fingerprint, facial scan, or iris scan.
A good comparison would be to think of cyber and malware attacks as natural disasters. Disaster Recovery & Business Continuity (DRBC) can save the fate of a company, in these cases. It is a formal business document that guides the employees step-by-step in recovering after a security breach. Having a plan can determine whether a company will fail because of a cyber attack or not.
Bain explained: “Far too often the attack is made worse through syncing and sharing continuing to happen once the system has been exposed. Doing this gives malware the opportunity to cause more damage. It is therefore crucial that attacks are reported immediately and responded to.”
Read more: The biggest cyber threats your business faces in 2023
