Ransomware

How it works

• It arrives through phishing, a stolen login or an unpatched system.
• It encrypts files on the computer and on any drive it can reach, including shared folders and backups.
• Many attackers also steal the data first and threaten to publish it.
• Recovery depends on a clean backup the attacker could not reach.

What can go wrong (example scenario)

A six-person manufacturing shop lost its quoting system, drawings and accounting files on a Friday night. The backup was a USB drive plugged into the same server, encrypted along with everything else. They were down for eleven days.

How WILDCARD handles it

Workstation Defender fights ransomware on the computer by catching the encryption behaviour and stopping it. Unified Backups keeps a separate copy to recover from. Patch Management closes the open doors it comes through, and Email Security filters the mail it arrives in.

• A dental office's practice management server is encrypted and patient charts are unreachable.
• A law firm receives a note threatening to publish client files unless paid.
• A contractor loses every drawing and invoice on a shared drive the week before a big job.

Example scenario: A small accounting practice's EDR caught a process renaming files at speed on a Sunday evening and stopped it after a few dozen documents. The affected files were restored from backup on Monday morning. The staff member's password had been phished, and that was reset too. Total downtime: one hour.

A question owners ask

Should I pay the ransom?

That is a decision for you, your insurer and your lawyer, and the best time to make it is before an incident. Good backups and detection are what make “no” a comfortable answer.