If you followed the news in early 2021, you saw the word “ransomware threat detection” everywhere. Each week another major company revealed a ransomware attack, but this threat isn’t new – the first large-scale case, the AIDS Trojan, spread by floppy disk in 1989.
NetWitness knows how damaging a security incident can be, so we created this Ransomware FAQ to help. It explains major ransomware types, common distribution methods, and best practices for ransomware detection and enterprise-level protection. You’ll also find guidance on advanced threat detection techniques, continuous threat investigation and response, and how threat detection and response services can strengthen your overall cyber threat detection and response strategy.
What is Ransomware? Understanding its Role in Modern Threat Detection Solutions
Ransomware is a class of malware that, once executed on a victim’s computer, renders the system and/or its data inaccessible until a ransom payment is completed. This is typically achieved by either:
Locker
Prevents the user from using basic system functions, making the computer inoperable. The goal of Locker is to prevent system access, not destroy data.
Crypto
Identifies and encrypts the contents of entire drives and/or specific valuable data on the victim system. Beginning with CryptoLocker in 2013, most modern attacks involve some form of data encryption.
What Does Ransomware Cost Companies? Why Ransomware Threat Detection Matters?
With improvements in encryption algorithms, the introduction of crypto payments, and easier distribution, the major difference from 1989 to today is financial:
- In 2019, costs associated with ransomware attacks passed $7.5 billion.
- In 2021, medium-sized organizations paid out an average of $170,404 for ransom demands.
- Over the last three years, requested ransom fees have increased 4,000%, going from $5,000 in 2018 to around $200,000 in 2020.
High-Profile Attacks: Why Organizations Need Cyber Threat Detection and Response
In 2021 alone, there have been several major high-profile attacks resulting in hundreds of millions of dollars lost. These incidents underline why enterprises rely on cyber threat detection and response programs and proactive threat detection, investigation, and response strategies:
- CNA – US insurer CNA paid a $40 million ransom after a Phoenix CryptoLocker attack by Evil Corp that hit 15,000 devices.
- Colonial Pipeline Company – DarkSide used leaked VPN credentials to deploy an attack affecting fuel supply across the US East Coast.
- JBS USA – Hit by REvil ransomware, shutting major plants and resulting in $11 million Bitcoin ransom.
How is Ransomware Distributed? Key Indicators for a Threat Detection Platform
From the first widely distributed attacks using a floppy disk to the use of botnets in the mid to late 2000s, ransomware distribution methods have evolved. Modern attackers blend phishing, automated scans, and Ransomware-as-a-Service to evade even the best threat detection platform and ransomware threat detection service.
Phishing- Malicious emails remain the top delivery vector.
Automated Recon Scans- Attackers search for exposed systems with open ports or unpatched software.
Ransomware-as-a-Service (RaaS)- Operators provide malware, infrastructure, and support while affiliates execute the attack.
360° Cybersecurity with NetWitness Platform
– Unrivaled visibility into your organization’s data
– Advanced behavioral analytics and threat intelligence
– Threat detections and response actionable with the most complete toolset
How is Ransomware Distributed? Key Indicators for a Threat Detection Platform
From the first widely distributed attacks using a floppy disk to the use of botnets in the mid to late 2000s, ransomware distribution methods have evolved. Modern attackers blend phishing, automated scans, and Ransomware-as-a-Service to evade even the best threat detection platform and ransomware threat detection service.
Phishing- Malicious emails remain the top delivery vector.
Automated Recon Scans- Attackers search for exposed systems with open ports or unpatched software.
Ransomware-as-a-Service (RaaS)- Operators provide malware, infrastructure, and support while affiliates execute the attack.
Stages of a Ransomware Infection and How Threat Detection and Response Fits In
Once a target has been identified, the attack lifecycle can be observed through the following stages. Each stage demands robust threat detection and response:
Initial Access / Distribution
Ransomware often starts through drive-by downloads, malicious files, or third-party compromises.
Infection
The dropper downloads a malicious executable and deletes itself.
Payload Staging
This stage prepares for execution and persistence. Actions include:
- Privilege escalation attempts
- Registry modifications
- Backup deletion
- Recovery tool disablement
- System boot manipulation
- C2 communication
- Network share discovery
Scanning
The ransomware scans for files to encrypt, including network and cloud storage.
Data Encryption
Files are encrypted using symmetric or asymmetric algorithms. Examples include Curve25519 and Salsa20.
Ransom Demand
Notes provide payment instructions and often reuse identifiable traits tied to specific threat groups.
Common Behaviors of Ransomware Families: Key Signals for Threat Detection
Some of the methods observed across multiple attacks include:
- Privilege escalation attempts
- Disabling of security tools
- Deletion of Volume Shadow Copy
- Remote encryption of mapped network drives
- File renaming
- Creation of a ransom note
These behaviors are critical signals for both ransomware threat detection and identity threat detection and response solutions.
Ransomware Detection: Key Red Flags for Cyber Threat Detection and Response Teams
- A large number of files are renamed in a short period of time.
- Accessing and disabling of services/processes/applications that could detect payload execution.
- System backups and recovery partitions are deleted.
- System event logs disabled or deleted.
- Suspicious command-line activity.
- Ransom notes naming conventions.
Example Command-Line Arguments Used in Attacks
“C:WindowsSystem32wevtutil.exe” cl Security
“C:WindowsSystem32wevtutil.exe” cl System
“C:WindowsSystem32wevtutil.exe” cl Application
“C:WindowsSystem32wevtutil.exe” cl Setup
Rolling the Dice: Ransomware in the Gaming Industry
Discover how ransomware attacks hit gaming companies, how attackers moved laterally, and why network visibility is key. Learn real-world lessons and strategies to detect, respond, and protect critical systems.
