Mini-Module
Summary
The Threat Hunting for Ransomware Attacks module is designed for - Cybersecurity professionals seeking to deepen their knowledge and skills and - Individuals interested in pursuing a career in cybersecurity and threat hunting. Throughout this module, students will develop - Gain a deep understanding of ransomware attack methodologies, - Develop critical threat hunting skills tailored to detecting and responding to ransomware, and - Learn to use advanced tools and techniques for identifying ransomware indicators of compromise.
Recommended prior knowledge:
-
Basic understanding of cybersecurity fundamentals
-
Familiarity with network and system administration
-
Experience with cybersecurity tools (recommended)
Introduction
Ransomware is a type of malicious software that infects computer systems, encrypts users' data, and demands a ransom in exchange for restoring access to the data. These attacks are typically carried out using social engineering techniques or by exploiting security vulnerabilities. Ransomware encrypts critical files on the target system and demands a specific amount of cryptocurrency, usually Bitcoin, in exchange for providing the decryption key.
How Is It Carried Out?
-
Infiltration: Ransomware typically infiltrates a system through phishing emails, malicious websites, security vulnerabilities, or malicious advertisements (malvertising). -
Encryption: Once inside the system, ransomware begins encrypting specific file types on the target device. These files often include personal and business-critical documents, databases, and system files. -
Ransom Demand: After encryption is complete, the ransomware attacker displays a ransom note on the victim's screen. This note states that a ransom must be paid to decrypt the encrypted files. -
Payment: If the victim pays the ransom, the attacker usually provides the decryption key. However, this does not always work reliably, and there is a possibility that the data may not be recovered.
( Image Source : https://www.extrahop.com/blog/ransomware-explanation-and-prevention )
This section has provided an introduction to the topic. The next section will cover "Understanding the Ransomware Attack Lifecycle.”