No Stone
Unturned: Fighting
Ransomware on
Workstations
and Servers Alike

www.kaspersky.com

2

No Stone Unturned: Fighting Ransomware on Workstations and Servers Alike
Ransomware is one of the fastest growing classes of malicious software.
Attackers don’t even have to bother stealing and selling the data thatyou or your business relies on – they just encrypt it and demanda ransom. Over the years, ransomware has evolved from simple screen
blockers demanding payment to a huge wave of far more dangerous
software. You cannot afford to leave any stone unturned in the fightagainst crypto-locker attacks.

Why is ransomware sucha problem?
How does ransomware work, and why is it so lethal? This malware class isnow based on cryptors – Trojans which infiltrate as you open a malicious
e-mail attachment or innocently follow the link to a specially craftedwebsite. The module then quietly encrypts any data it finds that could beof value to you. This might include personal photos, archives, documents,databases, diagrams, etc. The crypto-lockers then demand payment –often a significant sum – to decrypt these files again.
Clearly, anonymity at all times is important to the attackers. So payment
may be demanded in Bitcoin, and the attackers’ command and control
servers may be hidden in the anonymous Tor network. If traffic isintercepted between the Trojan and its server, the use of unorthodox
cryptographic schemes, such as using Tor or customary encryption
algorithms, makes file decryption impossible (Trojan-Ransom.Win32.
Onion, for example, uses all these techniques).
Nowadays, some crypto-lockers demand payment not only fordecrypting the users’ data but also for some additional “services”.
For example, the attacker may ‘up the stakes’ through blackmail: “Pay up,or we may be forced to mail your browsing history to all your contacts”.

3

No Stone Unturned: Fighting Ransomware on Workstations and Servers Alike

How widespread isransomware?
Ransomware detected (usingKaspersky Security Network)2014

1212382015448430Grand Total554267

During 2015, the total number of ransomware attacks detected byus using the Kaspersky Security Network was almost four times higher
than in 2014: nearly four hundred and fifty thousand detections
in total. There are a whole raft of different types and families, such
as CryptoWall, TeslaCrypt, TorrentLocker and Locky. CTB-Locker,
ACCDFISA and GpCode were among the most notorious. Data from
Kaspersky Security Network (below) gives an idea of the scale ofdifferent ransomware attacks throughout the European Union in 2015:
2015

Kaspersky Lab verdict

Unique users(KSN)

Unique users(KSN), combined

Other known aliases
for this malware

Trojan-Downloader.JS.Cryptoload+ Trojan-Ransom.Win32.Bitman

80017
1163

81180

TeslaCrypt

Trojan-Ransom.NSIS.Onion+ Trojan-Ransom.Win32.Onion

16491
8571

25062

CTB-Locker

Trojan-Ransom.Win32.Cryptodef

7346

7346

CryptoDefense (earlyversions), CryptoWall(later versions)

Trojan-Ransom.Win32.Snocry

4998

4998

Trojan-Ransom.Win32.Cryakl

4955

4955

Trojan-Ransom.Win32.Crypren

1681

1681

Trojan-Ransom.Win32.Shade

1390

1390

Trojan-Ransom.Win32.Crypmod

1173

1173

Trojan-Ransom.Win32.Rack

717

717

Trojan-Ransom.Win32.CryFile

395

395

TorrentLocker

4

No Stone Unturned: Fighting Ransomware on Workstations and Servers AlikeLocky, which may have been used in the recent ransomware attack on
Hollywood Presbyterian Memorial Hospital, surfaced in mid-February
this year, and has already emerged as one of the top ransomware tools incirculation.
TeslaCrypt, samples were first detected in February 2015, and theransomware variant constantly mutates in its efforts to evade detection.
TeslaCrypt has been widely portrayed in the media as the ‘curse’ of computer
gamers because it targets many game-related file types (game saves, user
profiles, etc.). The Trojan targets the US, Germany, Spain and other countries.

Security solutions
Despite all the advanced mechanisms implemented in malware
nowadays, you can readily mitigate the threat of ransomware to you andyour business. Kaspersky Lab’s anti-ransomware strategy uses a numberof crypto-malware countermeasures.
Your security solution should be turned on at all times and with as many
security layers enabled as possible. The solution should also be up to date.
It is currently impossible to decipher files properly encrypted by modern
crypto-malware, so the only way to save your data from a successful
attack is through some form of file backup. But a general backup(for example with Acronis or other specialized products), even conducted
regularly, is not enough, because it leaves recently changed files
unprotected, and risks overwriting by encrypted ones.

Host-based security
This is one reason why Kaspersky Lab products feature Kaspersky
System Watcher technology. The host-based Kaspersky System
Watcher analyses relevant system event data, including informationon the modification of files. On registering a suspicious application
attempting to open a user’s personal files, it immediately makes a local
protected backup copy. If the application is found to be crypto-malware(or otherwise malicious), Kaspersky System Watcher automatically rolls
back the unsolicited changes. All you see are notifications that this ishappening – there is no disruption, and no action need be taken.
Kaspersky System Watcher keeps users’ data safe, and stops the indirect
funding of cybercriminals through ransom payments, which feed
the industry and prompt the creation of even more malicious software.
Another host-based Kaspersky Lab approach to mitigating the risk from
crypto-lockers is through creating Application Startup Control rules
which prevent unauthorized applications from launching.

5No Stone Unturned: Fighting Ransomware on Workstations and Servers Alike

Server based anti-ransomware solution
Some hosts inside the security perimeter may use shared SMB/CIFS
folders on corporate servers. And not every host has System Watcher
enabled. Some could be even unprotected, or secured by othersoftware which lacks anti-ransomware functionality. If so, any cryptor
penetrating via email or a vulnerable browser will also affect sharedfolders on corporate servers. Under this scenario, only server-side
security software can defend the data.
Kaspersky Lab anti-ransomware functionality is provided not just forendpoints, but is also for Windows servers. Our Kaspersky Security
for Windows Server solution incorporates a new layer of defense,
specifically developed to protect against cryptor threats. Watchingover selected data folders – including file shares, it compares thecontents of every file before and after any access attempt. Of course,
the crypto-lockers’ work changes the file contents dramatically – it isencrypted! So this mechanism will almost invariably detect the presenceof ransomware and block its further execution.

System Watcher

Kaspersky
Security forWindowsServerRollbackRansomware

Untrusted
Host Blocker

Anti-CryptorEngineIn addition to detection, there is a prevention mechanism in Kaspersky
Security for Windows Server. While SMB/CIFS protocols can’t give us
information about the process on the ransomware’s host, we can obtain
the host’s IP address. Host Blocker technology can then prevent thisinfected host from engaging in any further activity with shared folders.
Encrypting folders on some servers can be a legitimate part ofthe organization’s security perimeter. Kaspersky Security for Windows
Server allows the administrator to add exceptions for directories wheresuch encryption is implemented.

6

No Stone Unturned: Fighting Ransomware on Workstations and Servers Alike

Leaving no stone unturned – security against
ransomware with Kaspersky Lab
The threat landscape is constantly developing, and Kaspersky Lab
is committed to keeping pace with every new threat generation,
providing multi-layered security to protect our customers. We are readyto mitigate the issue of ransomware both on workstations (KasperskySystem Watcher) and server-side (anti-ransomware technology
implemented in the Kaspersky Security for Windows Server).
Kaspersky Lab constantly renews its arsenal of technologies poweredby our proven Security Intelligence. And we also offer proof of ourperformance claims through of independent test results and the viewsof analytical agencies (TOP3).

100%

80%

Score of TOP 3 places

In 2015 Kaspersky Lab products participated in94 independent tests and reviews. Our products wereawarded 60 firsts and achieved 77 top-three finishes.

Kaspersky LabESETAvira

Bitdefender

60%

Symantec

40%

SophosQuick HealAvastBullGuard
Panda Security
0%

Trend Micro

AVG20%20

G DATAIntel Security (McAfee)

F-SecureMicrosoft40

N of independent tests/reviews
60

80

100

See full information about TOP3 metrics here www.kaspersky.com/top3

1Twitter.com/
Kaspersky

Kaspersky Lab, Moscow, Russia
www.kaspersky.com

Facebook.com/
Kaspersky

All about Internet security:
www.securelist.com

Youtube.com/
Kaspersky

Find a partner near you:www.kaspersky.com/buyoffline© 2016 Kaspersky Lab. All rights reserved. Registered trademarks and service marks are the property of their respective owners.
Lotus and Domino are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide.
Linuxis the registered trademark of Linus Torvalds in the U.S. and other countries. Google is a registered trademark of Google, Inc.