How Do I Know if My Network is Infected With Ransomware?

With one in two British businesses suffering a ransomware attack in the past year, it’s time to assume you’ve been infected. What, asks Nik Rawlinson, can you do about it?

- Nik Rawlinson

One in three businesses has suffered a ransom ware attack.The exact number, turned up last summer by Malware bytes research in the US, Canada, Germany and the UK, was 39%, but that figure hides amore worrying statistic: the UK was the hardest hit, with 54% of companies surveyed targeted in the previous 12 months.

Ransom ware is a growing problem, but it isn’t new. The first examples cropped up in 2005, with GPCode something of a pioneer. It set a pair of Registry keys that it would launch at boot, and proceeded to encrypt documents on infected machines, dropping a plain text ransom note into every folder it encountered. If those affected wanted their files back, they’d have to pay between $100 and $200 for the decryption key.

“But the real boom happened in the last five or six years,” said Bart Parys, threat intelligence analyst at PwC UK. “Awhile back there was some open source [ransom ware] code that … people could literally copy and paste, so there are many new strains of ransom ware now. In 2016 alone there were over 113 new strains and at least 60 new families. When you have a new family of ransom ware you have variants in there, too. And this story won’t end soon; as people continue paying the ransom there will be more ransom ware because it’s confirming that the technique [works].”

It should be no surprise that PwC, one of the “big four” accountancy firms, has an interest in ransom ware, as 51% of financial businesses came under attack in the past 12 months (second only to healthcare, on 53%). It’s a form of malware to which PwC’s customers are especially susceptible.