New ransomware research has been released by CyberArk Labs. More than 23,000 real-world samples from common ransomware families were tested to gain insight into typical ransomware behaviour and identify potential ways for mitigating the impact of ransomware attacks.
The IT secuirty firm says that ransomware poses an increasingly prevalent and critical threat to enterprises. In 2015, there were nearly 407,000 attempted ransomware infections and more than $325m extorted from victims, it’s estimated; these numbers are expected to rise. CyberArk Labs tested ransomware samples from more than 30 prevalent malware families, including Cryptolocker, Petya and Locky, to better understand common infection, encryption and removal characteristics.
Testing done by CyberArk Labs demonstrated that application control, including grey-listing, with the removal of local administrator rights was 100 percent effective in preventing ransomware from encrypting files. This approach was compared to the effectiveness of other mitigation strategies, including the use of traditional anti-virus software, which relies on known blacklists.
The research also found that while many strains of modern malware require local administrator rights to properly execute, many strains of ransomware do not require these rights. While 70 percent of ransomware attempted to gain local administrator rights, only 10 percent of ransomware would fail to execute if these rights were not attained. Because ransomware behaves differently, organisations need to combine the removal of local administrator rights with application control to prevent file encryption.
Chen Bitan, general manager, EMEA and APJ, CyberArk said: โRansomware has emerged as a credible and opportunistic tactic for attackers, leaving infected organisations with the difficult choice of abandoning hijacked data or paying cybercriminals for the chance to retrieve their files. By analysing how ransomware typically behaves, weโve been able to gain critical insight into how to help protect against these attacks. Moving beyond traditional anti-virus solutions, which are not effective in blocking ransomware, and adopting a proactive approach to endpoint and server security is an important step in protecting against this fast-moving and morphing malware.โ
Download the full report, โCyberArk Labs: Analysing Ransomware and Potential Mitigation Strategies,โ at: http://www.cyberark.com/resource/cyberark-labs-ransomware/.
