India hit by 34 ransomware attacks

India hit by 34 ransomware attacks

(CERT-In has advised remedial steps to contain damage)

Context: A total of 34 incidents of infections from the two global ransomware attacks, WannaCry and Petya, were reported to the Indian Computer Emergency Response Team (CERT-In) by organizations and individuals in the country.

Introduction:

• WannaCry and Petya infected thousands of computers worldwide in May and June respectively.
• The attackers in both cases had sought about $ 300 in Bitcoin as ransom.
• Ransomware is a type of malicious software that infects a computer and restricts user’s access to affected files by encrypting them until a ransom in paid to unlock it.

Key point:

• Parliament was informed that “as per the information reported to and tracked by CERT-In,” a total of 44,679, 49,455, 50,362 and 27,482 cybersecurity incidents were observed during the years 2014,2015, 2016 and 2017(till June) respectively.
• These incidents included phishing, scanning/probing, website intrusions and defacements, virus/malicious code, ransomware and denial of service attacks.
• The data from National Crime Records Bureau (NCRB) to state that a total of 9,622 and 11,592 cyber crime cases were registered during 2014 and 2015 respectively.
• This includes cases registered under the IT Act, 2000 and related sections of Indian Penal Code and special and local laws involving computer as a medium/target

What is Ransomware?

• Ransomware is a type of malicious software that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid.
• Ransomware attacks are typically carried out using a Trojan that is disguised as a legitimate file that the user is tricked into downloading or opening when it arrives as an email attachment.
• Starting from around 2012 the use of ransomware scams has grown internationally in June 2013, security software vendor Mc Afee released data showing that it had collected more than double the number of samples of ransomware that quarter than it had in the same quarter of the previous year.

How does it work?

• When a computer is infected, the ransomware encrypts important documents and files and then demands a ransom, typically in Bitcoin, for a digital key needed to unlock the files. If victims don’t have a recent back-up of the files they must either pay the ransom or face losing all of their files

What should you do if you are affected by the ransomware?

• The ransomware infects computers and then waits for about an hour before rebooting the machine.