What is Ransomware

In this globalized and completely computerized society, criminals and opportunists have found New sources of money in exchange for the effort - and fear - of others. Although express kidnappings continue to be a scourge in many less developed countries, in the countries of the so-called "Society 2.0" a new range of kidnappings - less bloody, less dangerous but equally harmful - has become established with more than palpable results: we are talking about the information hijacking o ransomware.

What is it about?

Type viruses ransomware are malicious programs created for the purpose of encrypting (although the correct term would be “ciphering”) all the data on a computer and then ask for a ransom for the decryption key that allows us to access our information again. It is usually transmitted through Internet services such as email or virtual repositories such as Dropbox, although it can also be infected in the “traditional” way through USB sticks or external disks. Once infected, the system will begin to encrypt our files and will subsequently display an alarming message indicating that we will have to pay a certain amount of money to obtain the decryption key, usually through untraceable means such as payment in bitcoins or other cryptocurrencies.

How to avoid infection

Prevention is the best tool to avoid these types of attacks, since once the computer is infected it can be very difficult - in some cases impossible - to recover the information. A series of basic guidelineswill prevent the virus from sneaking into our systems:

First of all, we will avoid Open “suspicious” attachments in our emails. At the slightest doubt (whether due to the sender of the email, its content, whether it is in “Google Translate” Spanish or in another language) we should immediately delete the email without opening or previewing the attachment.
Even if the email comes from a trusted sender, we will always avoid opening it. files with executable extensions , the exe o Beat, although nowadays viruses can infect systems from practically any type of file, regardless of its extension.
If you receive a link Check where it points before clicking on it. If it differs from the text or points to unknown domains or foreign countries, delete the message immediately.
Above all, be very careful with “fun” PowerPoint presentations; they are a great vehicle for infecting us.

Steps to take once infected

If despite all our precautions the fateful message appears on our screens, the first thing to do is turn off the equipment immediately, if necessary even by physically unplugging it. The message may have been displayed at the beginning of the encryption process and we may be able to save a lot of the information contained on our disks. If the computer is connected to a network, it is more than possible that the rest of the machines on the network have been compromised: they must be turned off as well, even if they do not show signs (yet) of being infected. In this case, saving a few hours of work can risk losing months or even years of work. If the infection occurs in a company, it is necessary to call the customer service center to give immediate notice, even if it is a decentralized SME (since it could be a global attack like the well-known WannaCry). In no case should you give in to blackmail and pay. Firstly, because it opens the door for further attacks on the company that has already paid once, and secondly, because it rarely serves any purpose: once they have the money in their possession, they will be very careful about contacting the victim to send them the key, since this action could be used to track them down. There are antivirus programs capable of dealing with specific versions of these malware. malwares, but their radius of action is very limited and these malicious programs constantly evolving So we can't rely on them to solve our problems. However, with these basic tips you will surely never need them.