The rise of ransomware decryptors: it’s still not game over for ransomware, says Databarracks

Another major step in the fightback against ransomware, but decryptors will slow the growth rather than stop it altogether

In recent weeks, cybersecurity firms have released a host of new ransomware decryptors, offering victims the chance to recover their compromised data at no cost. While a significant development in the growing ransomware arms race, decryptors won’t end the threat completely. This is according to Databarracks.

Peter Groucutt, Managing Director at Databarracks, said: “Ransomware has been growing rapidly because there was nothing to stop it: governments weren’t doing much to counteract the threat, and insurance firms were often covering the costs of ransoms.

“Since governments started taking a more active role in combating threat actors and insurers set more stringent requirements for cover, growth in ransomware has slowed. Cybercriminals recognise the risk is higher than before and the chance of a pay-out is decreasing.

“The rise of readily available decryption software adds another string to the anti-ransomware bow, but it’s not the end of the road by any means. The war on ransomware will continue as more of a chess-like battle, where both sides show cunning either to carry out new attacks or mitigate their impact.”

As this arms race evolves, Groucutt believes there are other steps organisations should take to protect themselves, particularly when it comes to guarding backups of their data.

He added: “Cybercriminals know they need to compromise a company’s backups to force a ransom payment. One way to prevent this is to use immutable storage, where data is stored in a Write Once Read Many (WORM) state and cannot be deleted for a pre-specified period. This means policies can be set in backup software or at the storage level, and backups can’t be changed or encrypted.

“Another way is to add an ‘air gap’, which means separating backups from your production data so there is no way for an attack to spread from one to the other. This could mean physically separating your backups by storing them elsewhere (such as on tapes) or doing it logically by keeping data storage accounts separate from one another.

“A third option is to restrict access to your backup software. In a successful ransomware attack, your production environment has been compromised, so it’s possible that key-loggers may have been used to access backup accounts. Using strong passwords and multi-factor authentication for backup administrator accounts helps keep them ringfenced.

“Finally, backup vendors are now adding innovative features to detect and prevent attacks. These include monitoring both backups and production storage for sudden changes in data, which can indicate a ransomware attack.”

Groucutt concluded: “The growth of decryptors is welcome, but no-one should assume you can rely on one to recover from an attack. Organisations should focus on what  they can control to defend themselves, to identify, protect, detect respond and recover.”

 

ENDS

About Databarracks

Databarracks is the UK's specialist business continuity and IT disaster recovery provider. From the launch of the UK's first managed online backup services over 15 years ago, to our leading Disaster Recovery as a Service, we've been making enterprise-class continuity, security and resilience accessible for organisations of all sizes.

For more information, please visit: www.databarracks.com  

Press contacts

Avinash Nandra/Alex Henderson

Spreckley Partners Ltd

Email: databarrackspr@spreckley.co.uk

Tel: +44 (0) 207 388 9988