The Gen Threat Report, formerly known as the Avast Threat Report, has revealed a 100% increase in ransomware activity for the US, UK, and Canada; 66% in Australia; and a whopping 379% in India.
Ransomware is one of the most dangerous and fast-growing threats in the digital world today. It’s a type of malware that can lock you out of your files or entire system until you pay a ransom, usually in cryptocurrency.
Unfortunately, as detailed in the Gen Q2/2024 Threat Report, the threat of ransomware is not going away—in fact, it’s getting worse. Let’s take a closer look at what ransomware is, how it’s evolving, and what you can do to protect yourself.
What is ransomware?
Ransomware is a form of malicious software that, once it infects your device, encrypts your files or locks you out of your system entirely. The attackers then demand a ransom, often in Bitcoin or another cryptocurrency, in exchange for a decryption key that will supposedly restore your access.
These attacks can be devastating. Imagine losing access to your family photos, important work documents, private information, or your entire digital life in an instant. That’s the reality of a ransomware attack—and paying the ransom doesn’t guarantee you’ll get your data back. In many cases, victims who pay the ransom never receive the promised decryption key.
The rise of ransomware in 2024
Ransomware attacks are on the rise, with a notable 24% increase in the second quarter of 2024 alone. The sharpest spikes were seen in the United States, United Kingdom, Canada, and India. However, no country is safe from this growing threat. Recently, ransomware attacks have become more sophisticated, targeting both individuals and businesses with increased precision.
One reason for this increase is the evolution of ransomware tactics. Cybercriminals are constantly refining their methods to maximize their impact. For example, some attackers now not only encrypt your files but also threaten to release sensitive data publicly if you don’t pay up multiple times. This double-extortion tactic puts even more pressure on victims to comply with their demands.
Real-world examples of ransomware from 2024
One of the most prevalent strains was LockBit, a ransomware family that has been wreaking havoc across the globe. Interestingly, after the identity of one of its key developers was revealed, the number of LockBit attacks surged, possibly as an act of retaliation or desperation.
Another concerning development was the rise of Twizt, a botnet that shifted its focus to spreading LockBit ransomware through malicious email attachments. This change in tactics shows how flexible and adaptive these cybercriminals can be, always looking for new ways to infiltrate systems and extort money.
Despite the alarming rise in ransomware attacks, there were also some victories. Law enforcement agencies around the world have been actively working to disrupt these criminal operations. In Q2/2024, several high-profile botnet providers were taken down, leading to arrests and the seizure of infrastructure.
Additionally, cybersecurity companies have continued to develop free decryption tools, like the one released for the DoNex ransomware. Created by our own team of experts, this tool may give the victims a chance to recover their files without paying a ransom.
How ransomware spreads
Ransomware can infect your device in several ways, not so different from other types of malware. Here are a few of the most common methods:
- Phishing emails: Many ransomware attacks begin with a phishing email that contains a malicious attachment or link. When you open the attachment or click the link, the ransomware is downloaded and installed on your device.
- Malicious websites: Sometimes, visiting a compromised or fake website is enough to get infected. These sites might exploit vulnerabilities in your browser or prompt you to download an infected file.
- Drive-by downloads: In some cases, simply visiting a website can trigger a download of the ransomware without any interaction on your part. This can happen if the website is compromised and has malicious scripts embedded in its code.
- Infected software or apps: Downloading software or apps from untrusted sources can also lead to a ransomware infection. Always make sure you’re downloading from reputable sites or official app stores.
- Exploited vulnerabilities: Cybercriminals can exploit security flaws in your operating system or software to install ransomware. This is why keeping your software up to date is so critical.
7 tips to help protect you against ransomware
While ransomware is a serious threat, there are actions you can take to help protect yourself. Here are 7 things you can do:
- Back up your data regularly. The best defense against ransomware is having up-to-date backups of your important files. Make sure these backups are stored offline or in a secure cloud service. If you’re hit by ransomware, you can restore your files without paying the ransom.
- Be cautious with email attachments and links. Be wary of unsolicited emails, especially those with attachments or links. Even if an email looks like it’s from a trusted source, verify its legitimacy before opening anything.
- Keep your software updated. Regularly updating your operating system, antivirus, and other software is crucial. These updates usually include security patches that protect against known vulnerabilities.
- Use difficult and unique passwords. Ensure that your accounts are protected with strong, unique passwords. Consider using a password manager to help you keep track of them. Enable two-factor authentication (2FA) wherever possible.
- Install reliable security software. A robust antivirus can help detect and block ransomware before it can do any harm. Make sure your security software is always up to date.
- Avoid untrusted websites and downloads. Be cautious when downloading files or software, especially from unfamiliar websites. Stick to reputable sources to reduce your risk of infection.
- Keep yourself informed. Awareness is key. Make sure you and your loved ones understand the risks of ransomware and how to avoid it. Knowing what to look for can help prevent an attack before it happens.
What to do if you’re targeted by a ransomware attack
No one wants to go through a ransomware ordeal, but it can happen to anyone. If it does happen, here’s what you should do:
- Disconnect from the internet. Immediately disconnect your device from the network to prevent the ransomware from spreading to other devices on your network.
- Don’t pay the ransom. Paying the ransom doesn’t guarantee you’ll get your data back. It also encourages these criminals to continue their activities. Instead, restore the data from your backup or look for decryption tools that might help you recover your files.
- Contact a professional. Reach out to a cybersecurity expert or a reputable IT professional who can help assess the situation and determine the best course of action.
- Report the incident. Report the ransomware attack to local law enforcement and any relevant authorities, such as the FBI in the US or the National Cyber Security Centre in the UK. This can help in tracking down the attackers and preventing future incidents.
Protecting against ransomware
Ransomware is a growing threat that requires our constant attention and vigilance. By staying informed and taking proactive steps to protect your data, you can reduce the risk of falling victim to these attacks. Remember, the best defense is always a good offense—stay alert, stay updated, and stay safe.
