Understanding Ransomware | Stay Safe Online With Netsafe

What is ransomware?

Ransomware is a type of malicious software designed to block access to your files or computer system until a ransom is paid. It can target anyone, from individuals and small businesses to large organisations like government departments and hospitals. By encrypting (scrambling) your files, ransomware makes them unreadable. The attacker then demands a ransom, often in an online currency like Bitcoin, which is harder to trace than conventional cash.

Types of ransomware

Crypto-ransomware: Encrypts files with a randomly generated password, making them inaccessible until the ransom is paid.
Lock-screen ransomware: Locks your computer or files, displaying a message demanding a ransom and preventing access to the desktop, apps, and files.

How ransomware infects your computer

Visiting unsafe or suspicious websites.
Opening emails or files from unknown senders.
Clicking on malicious links in social media posts.

Signs of a ransomware attack

The first indication of a malicious software attack is usually a pop-up text file, an email, or a new background screen on your computer informing you that you've been targeted. Alternatively, you might find yourself unable to access or open any of your files.

The attacker will then demand a 'ransom' payment to restore access to your files or system.

There are no guarantees:

Paying the ransom does not guarantee data recovery.

Often, attackers take the payment and leave files encrypted.

Preventing ransomware attacks

Follow these steps to help avoid being the target of a ransomware attack:

Update software: Always keep your operating system and apps updated. Enable automatic updates for Windows and other applications like Office.
Regular backups: Regularly back up your files on all devices. Use:
- Offline (cold) backups: Save data to an external hard drive and then disconnect it.
- Cloud backups: Use services like Dropbox for online storage.
Antivirus and anti-ransomware software: Install and regularly update anti-virus(/online-safety-at-home/anti-virus-software) and anti-ransomware software.
Firewalls: Install a firewall to block untrustworthy traffic.
Disable macros: Do not enable macros in Microsoft Office. Learn how to disable macros(https://support.microsoft.com/en-us/office/enable-or-disable-macros-in-microsoft-365-files-12b036fd-d140-4e74-b45e-16fed1a7e5c6).

What to do if you're affected by ransomware

Restore from backup: Use your most recent backup to restore your system.
Reinstall OS: If no backup is available, reinstall your operating system. Note, this may erase all files.
Seek professional help: Contact an IT support professional or local computer services company to:
- Verify if it's real ransomware.
- Attempt to remove the ransomware.
- Restore your computer to factory settings if necessary, which may erase all files.
- Advise on future security measures and install protection.
Report ransomware attacks: Report the incident to CERT NZ(https://www.cert.govt.nz/) (Computer Emergency Response Team New Zealand).