How Should Companies Handle a Ransomware Attack?

What Are the Signs of a Ransomware Attack?

A ransomware attack can have a devastating impact on a company. There are the mitigation costs, including potentially having to pay a ransom to free up systems. There are also costs of assessing and cleaning up any damage, communicating to customers and employees, and addressing any cybersecurity gaps that led to the attack.

How should companies handle a ransomware attack? It starts with knowing the signs of a ransomware attack, how to handle them, and how to reduce risk.

Here are some of the common early signs that your company may be being hit by a ransomware attack:

• Increased Phishing and Spam Attacks. Phishing and other malware attacks, usually precipitated over email, look to obtain access to login credentials. A rise in these types of attacks, purportedly coming from a trusted source such as a company official, credit card company or bank, should be reported and evaluated
• Suspicious Login Attempts. Failed logins often happen for innocent reasons, such as a forgotten password. However, a spike in failed logins could indicate someone is trying to break in to your system
• Use of RDP. Microsoft’s Remote Desktop Protocol (RDP) is frequently used by attackers to deploy ransomware. It’s becoming more common as more users work from home, using RDP to access shared files
• Known Tools Present. If your system defenses detect GMER, IOBIT Uninstaller, Microsoft Process Explorer, MimiKatz, PC Hunter or Process Hacker, which are used to steal credentials or disable security tools, you could be under imminent threat

How Should Companies Handle Ransomware?

One of the most important things to do if there’s a ransomware attack is to remain calm. With the right strategies and plans in place, you can remove or mitigate the impact.

You should never pay the ransom. There is no guarantee that after payment the attackers will relinquish control. It also encourages hackers to continue launching these attacks.

There are many phases to addressing a ransomware attack, from identification to decryption to data recovery.

Here are the key steps to take:

1. Isolate the Attack. Ransomware often spreads gradually. Disconnect infected systems and trace back the attack
2. Keep the Status Quo. Do not reboot systems, install updates or do other system maintenance
3. Don’t Launch Backups
4. Notify Key Stakeholders and Law Enforcement
5. Remove the Ransomware from Infected Systems
6. Decrypt the Files
7. Install Anti-Malware Software
8. Reformat and Reinstall Systems
9. Restore Using Backups

How Can Companies Lower the Risk of a Ransomware Attack?

Prevention is the most critical step companies can take. Here are some of the most important preventative measures:

• Keep Software Patched and Updated
• Use Strong Antivirus and Anti-Malware Software
• Educate Employees about their Role in Preventing Attacks
• Schedule and Run Data Backups Regularly
• Install System and Network Monitoring Tools with Automated Alerts
• Allow Access on a Need-to-Use Basis

If you’re concerned about your company’s preparedness to prevent a ransomware attack, ConsultNet is here to help. Our cybersecurity services include disaster recovery, managed security, computer or server maintenance, employee training and awareness, and so much more. To learn more about how to prevent a cyberattack at your company, contact ConsultNet today.