Prevention and countermeasures for high-risk ransomware attacks 

At SITS | Traxion, we understand the critical consequences of such attacks, particularly when personal data is involved. The disclosure of sensitive information can severely impact the privacy of those affected and lead to legal and financial repercussions. That’s why we focus on preventing these incidents before they happen, leveraging expert guidance to help organizations manage threats, mitigate risks, and protect their most valuable assets.

When faced with ransomware, it’s not just about extortion—it’s about protecting your data and maintaining trust.

What makes ransomware so dangerous? 

Ransomware attacks in the Netherlands continue to pose significant threats across various sectors, particularly ICT and industry, which together account for over a third of the incidents. The 2023 ransomware report recorded 149 unique incidents, with information drawn from both incident response teams and police reports​. Criminals often gain access through compromised logins or vulnerabilities in software. Despite the frequency of attacks, only 21% of victims opted to pay the ransom, a signal of growing resistance to such extortion​.

Ransomware attacks are not limited to large organizations; smaller entities are equally targeted, though larger organizations dominate the statistics due to their reporting capabilities. The consequences of these attacks can be devastating, leading to service outages, data leaks, and the loss of sensitive information. The interconnectivity of digital ecosystems means that even non-vital organizations can impact critical sectors when attacked​. With 29 active ransomware families identified, the threat landscape is vast and complex​.

It is the mixture of financial motivation and destructive power that makes ransomware so dangerous. In addition, hackers are constantly developing ransomware attacks and increasingly sophisticated techniques are being used, including new encryption methods, anonymous payment systems such as cryptocurrencies and social engineering.

Effective information sharing remains crucial, but data sharing on ransomware incidents is still inadequate, leading to incomplete understanding and response​. Collaborative efforts between public and private sectors, such as the “Project Melissa” initiative, are vital in addressing this rising challenge​. (These conclusions came from the following reports: Jaarbeeld Ransomware 2023 & Cyber Security Assessment Netherlands 2023)

You need to be prepared for these risks:  

• Data breaches: Sometimes attackers threaten to release sensitive data if a ransom is not paid. This can lead to data breaches, fines and legal liability for the affected company. 

• Financial damage: Ransomware attacks can affect individuals, companies and organizations financially, as they are often forced to pay a ransom to regain access to their files. Caution: There is no guarantee that the decryption key will be released or that the decryption will actually work, even if the ransom is paid. 

• Disruption and loss of time: Ransomware attacks can significantly disrupt operations, resulting in downtime, loss of productivity and image reputational damage. 

• Rapid spread: Ransomware can spread fast across networks and devices, infecting multiple systems within an organization or between different companies. It can affect companies, countries and critical infrastructures worldwide and cause widespread disruption. 

Some examples of how ransomware infects computers are malvertising (malicious advertising on legitimate websites), phishing emails (with dangerous links or attachments) or exploit kits that automatically exploit vulnerabilities in software, operating systems or network services. There are also drive-by downloads (compromised websites that automatically download ransomware onto the systems of website visitors).

What types of ransomware exist? 

There are various forms of ransomware that differ in the nature of their attack vectors and behaviors: 

• Locker ransomware: With this lock screen type, access to the computer or special functions of the operating system is blocked. 

• Encrypting ransomware: Files are encrypted on the infected system using strong encryption algorithms. 

• Master Boot Record (MBR) ransomware: It infects the MBR of a computer, which can lead to the operating system no longer starting properly. 

• Mobile ransomware: This malware targets mobile devices such as smartphones and tablets. It can distribute itself via infected apps, malicious links or drive-by downloads, encrypting personal data and blocking access. 

• Network ransomware: It spreads within a network and infects multiple computers or servers. Shared network resources, vulnerabilities in network protocols or unsecured remote desktop connections are the gateway for hackers. 

• Dox or leakware: Attackers threaten to publish stolen or encrypted victim data if no ransom is paid. This form of ransomware aims to blackmail victims by publishing sensitive information instead of just denying access to files. 

• Ransomware as a Service (RaaS): Cyber criminals even offer ransomware kits as a subscription. Using ready-made tools, even technically inexperienced people can initiate ransomware attacks.

How do you identify and combat ransomware? 

Early detection of ransomware is crucial to minimize the impact on your system and your data. 

You should pay attention to the key points here: 

• Use reliable antivirus and anti-malware software! 

• Use behavior-based detection: There are behavior-based detection techniques that identify ransomware based on its actions rather than its signature. This includes monitoring system behavior for unusual file encryption patterns or attempts to change system settings. 

• Educate employees about the risks of ransomware and sensitize them to report suspicious activity on their systems. This will enable IT and security teams to respond more quickly to potential ransomware infections and reduce the impact. 

• Use mechanisms to identify anomalies. This could be a sudden increase in file encryption activity, unauthorized access attempts or unusual network traffic patterns. 

• Use file integrity monitoring tools to track changes to files and directories. 

• Analyze network traffic for signs of ransomware communication, such as connections to known command and control servers used by ransomware operators. Intrusion Detection and Prevention Systems (IDPS) help to block suspicious connections in real time. 

• Monitor user activity on your network to identify unusual actions. 

• Deploy Endpoint Detection and Response (EDR) solutions that provide real-time visibility into endpoint activity and enable rapid response to potential threats. 

• Implement SIEM solutions that collect and analyze security event data from multiple sources across your network. SIEM platforms can be used to correlate events, identify potential security incidents and facilitate response to ransomware attacks.

Read more about our Cyber Defense Service here.

SITS | Traxion is part of the SITS Group. With over 700 employees, SITS Group combines the experience, expertise, resources and services of a top-class IT security provider to form a comprehensive whole. Read more here