Changes

==Attack process==

==Attack process==

Ransomware packages vary and so do attack vectors, vulnerability exploits, and locking methods.  However, most ransomware follows a basic five-step process.

Ransomware packages vary and so do attack vectors, vulnerability exploits, and locking methods.  However, most ransomware follows a basic five-step process.

#Delivery - base malware is delivered to the victim, often by e-mail<ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref><ref name="phishme">https://phishme.com/ransomware-delivered-97-phishing-emails-end-q3-2016-supporting-booming-cybercrime-industry/</ref>

#Delivery - base malware is delivered to the victim, often by e-mail<ref name="phishme"/><ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref>

#Connection - the base malware connects to a "command-and-control" server, which will in this case will provide the ransomware package<ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref>

#Connection - the base malware connects to a "command-and-control" server, which will in this case will provide the ransomware package<ref name="alienvault.com"/>

#Execution - the newly downloaded ransomware will attempt to exploit a vulnerability and completely infect the system<ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref>

#Execution - the newly downloaded ransomware will attempt to exploit a vulnerability and completely infect the system<ref name="alienvault.com"/>

#Encryption - the targeted information (typically the entire filesystem) will be encrypted quietly<ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref>

#Encryption - the targeted information (typically the entire filesystem) will be encrypted quietly<ref name="alienvault.com"/>

#Notification - the user is now notified that their information is being held hostage, and they must pay a ransom to get the decryption key<ref name="alienvault.com">http://learn.alienvault.com/c/ransomware-detection?utm_internal=ransomwarelookbook</ref>

#Notification - the user is now notified that their information is being held hostage, and they must pay a ransom to get the decryption key<ref name="alienvault.com"/>

==Variants==

==Variants==

==Avoidance==

==Avoidance==

To avoid ransomware infections, all of the basic safety habits should be practiced.  Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. Most ransomware is delivered by E-mail, usually as a package delivery notice, or some other legitimate-sounding message.<ref>http://www.computerweekly.com/feature/How-to-avoid-being-caught-out-by-ransomware</ref><ref name="phishme">https://phishme.com/ransomware-delivered-97-phishing-emails-end-q3-2016-supporting-booming-cybercrime-industry/</ref> This is true for smartphones, as well as computers—phones are common targets,<ref>http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html</ref> and in some cases are harder to recover. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />

To avoid ransomware infections, all of the basic safety habits should be practiced.  Unknown links should never be clicked, untrusted software should never be installed, e-mail messages from unrecognized senders should never be opened, and so on. Most ransomware is delivered by E-mail, usually as a package delivery notice, or some other legitimate-sounding message.<ref name="phishme"/><ref>http://www.computerweekly.com/feature/How-to-avoid-being-caught-out-by-ransomware</ref> This is true for smartphones, as well as computers—phones are common targets,<ref>http://www.pcworld.com/article/2901672/how-to-prevent-ransomware-what-one-company-learned-the-hard-way.html</ref> and in some cases are harder to recover. However, some ransomware is delivered by worm, so even if everything is done right, an infection can still take place.<br />

Usage of anti-malware software can help significantly in preventing an infection.  Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known.  Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology.  Additionally, networks can be configured to block traffic from suspicious domains and countries.  This can stop attacks form these locations quite easily.<ref>https://www.helpnetsecurity.com/2017/05/15/prevent-ransomware-guide/</ref>

Usage of anti-malware software can help significantly in preventing an infection.  Basic anti-virus and other anti-malware programs can be useful, since they detect known signatures of ransomware (and other malware) and block them. Heuristic (behavior-based) protection can also be helpful, as it can sometimes detect malware which is not otherwise known.  Larger computer systems such as those used by corporations also can benefit from the newer defense method of Deception technology.  Additionally, networks can be configured to block traffic from suspicious domains and countries.  This can stop attacks form these locations quite easily.<ref>https://www.helpnetsecurity.com/2017/05/15/prevent-ransomware-guide/</ref>