How Is Ransomware Delivered?

Different types of ransomware have different traits (target files, encryption type, scrambling speed, etc.), but every variant must slip past security controls to infect a system. While there are many ways to infect a device, most cybercriminals rely on several tried-and-tested methods of ransomware delivery.

Knowing these usual distribution techniques and how an average cybercriminal thinks is vital to your ability to block infection attempts.

This article presents five go-to strategies criminals use to deliver ransomware to target devices. Jump in to learn about the most common infection methods and see whether your ransomware detection and prevention strategies require updating.

Most Common Ways Ransomware Is Delivered

So, how is ransomware delivered? Below is an in-depth look at the most common and most effective ransomware distribution techniques.

Exploit Kits

An exploit kit is a prepackaged bundle of tools criminals use to deliver various types of malware to vulnerable systems. Kits automate the process of finding and exploiting known flaws in software and web browsers.

Here's how an exploit kit typically deploys ransomware:

• A device gets infected with an exploit kit, e.g., via a malicious ad or by visiting an infected website.
• A kit scans the victim's system to identify specific software flaws.
• If the kit detects a fitting vulnerability, it uses a set of weaponized exploits that specifically target the found flaw.
• An exploit delivers the ransomware payload to the victim's system. Most kits rely on various evasion techniques to avoid detection (code obfuscation, anti-debugging mechanisms, using encryption to hide the payload, etc.).
• The payload encrypts the user's files and displays a ransom note.

Criminal groups maintain exploit kits the same way legit companies manage software products. Each kit has a lifecycle during which designers remove outdated and add new exploits.

How to Defend Against Exploit Kits

Here are the most effective ways to counter the threat of exploit kits armed with ransomware payloads:

• Regularly apply the latest patches to all software on your systems.
• Use antivirus and anti-malware software with the latest updates.
• Deploy advanced threat protection that detects and blocks exploit kit activity.
• Use application whitelisting to ensure only authorized and trusted software runs on the system.
• Have as few browser plugins as possible (and delete any you don't use regularly). 
• Boost network security by monitoring traffic for signs of exploit kit activity and analyzing logs to identify potential threats.
• Educate employees on how exploit kits work and ensure everyone understands the risks of suspicious websites and unexpected pop-ups.

Email Phishing

Ransomware phishing occurs when a criminal uses a legitimate-looking or a hacked email address to send a message to trick the victim into one of the two:

• Clicking a malicious URL that redirects the target to a site that triggers the download of malware.
• Opening an attachment that, once clicked or interacted with, delivers a malware payload.

Phishing emails are the cause of an estimated two-thirds of all ransomware infections. Criminals use two distinct phishing tactics to deliver ransomware:

• Spray-and-pray campaigns that send out infected emails to random targets.
• More precise spear-phishing in which a criminal sends a personalized email to each target.

Phishing tactics typically appeal to human greed or fear, so the most common strategies include:

• Offering money, discounts, or prizes.
• Sending fake invoices.
• Informing the target that their checking or PayPal account is frozen or hacked.
• Sending urgent requests to low-ranking employees. 

Another common tactic is to rely on clone phishing (also known as deceptive phishing). The attacker copies a legitimate email that the victim received earlier, changes the attachment or link in the message to a malicious one, and "resends" the message.

How to Defend Against Email Phishing

Phishing attacks work because they exploit human errors and the lack of awareness. Stopping phishing attempts requires high levels of email security and ensuring all potential targets follow good cybersecurity practices, such as:

• Always verify the sender's email address to ensure it matches the official domain of the company they claim to represent.
• Hover over links to see the actual URL before clicking.
• Be cautious of unexpected attachments from unknown sources.
• Avoid providing sensitive info in response to email requests.
• When in doubt, contact the sender or their organization directly on the phone or in person.

Drive-By Downloads

A drive-by download happens when a victim visits a compromised or malicious website that automatically and stealthily delivers malware to the user's device.

Unlike other ransomware distribution techniques that require direct user interaction (e.g., clicking a malicious link or opening an infected attachment), a drive-by download only requires the victim to visit the infected website.

Criminals set up drive-by downloads in several different ways, including the following methods:

• Compromising legitimate websites with vulnerabilities in their backend.
• Creating new malicious websites for the sole purpose of performing drive-by downloads.
• Exploiting vulnerabilities in web browsers or their plugins (typically Adobe Flash or Java).
• Setting up malicious ads that pop up on legitimate websites.
• Using redirects or iframe injections to get the victim to a malicious website.

When the victim visits an infected website, the drive-by download occurs automatically. Malicious code enters the system and executes without any warning or indication of what's happening.

How to Defend Against Drive-By Downloads

Here's how to protect yourself and your workforce from drive-by downloads:

• Keep browsers, plugins, and OSes up to date with the latest security patches.
• Delete unnecessary browser plugins.
• Enable built-in security features of your browser (e.g., pop-up blockers, anti-phishing filters, safe browsing settings, etc.).
• Set up a Web Application Firewall (WAF), a type of firewall that blocks malicious web traffic and prevents access to compromised websites.
• Implement a content security policy (CSP) to prevent the execution of unauthorized scripts on web pages.
• Configure browsers to enable click-to-play for plugins such as Adobe Flash and Java. That way, you ensure plugins only run when explicitly allowed by the user.
• Use antivirus and anti-malware software to detect and block malicious downloads.

RDP Exploits

Exploiting the Remote Desktop Protocol (RDP) is another common ransomware distribution technique. RDP is a Microsoft communications protocol that enables users to connect to and remotely control another computer over a network.

Cybercriminals use an automated tool to scan the internet for systems with open RDP ports (by default, RDP receives connection requests through port 3389). Once they identify a potential victim, criminals attempt to gain access to the target system.

Brute-force attacks and credential stuffing are standard techniques for gaining unauthorized access. Alternatively, criminals sometimes try to trick people into handing over remote access via social engineering attacks (phishing, pretexting, scareware, etc.).

Once an attacker gains access to the target system, they deploy the ransomware payload. The ransomware encrypts files on the system and, in some cases, spreads laterally across the network to infect other devices.

How to Defend Against RDP Exploits

Preventing criminals from using RDP to deliver ransomware requires the following precautions:

• Always change the default RDP port.
• Keep the operating system and RDP software up to date with the latest patches to avoid zero-day exploits.
• Implement robust monitoring to detect and block suspicious RDP login attempts.
• Restrict RDP access to specific IP addresses.
• Implement two-factor authentication (2FA) for all remote desktop sessions.
• Set up account lockouts to prevent brute-force attacks.
• Enforce the use of unique and strong passwords for RDP accounts.

Microsoft Macros

Microsoft macros are small programs or scripts that automate tasks within Office apps (Word, Excel, PowerPoint, Outlook, etc.). While macros are helpful to users, criminals often use macros to deliver malicious payloads.

Criminals create an Office file (typically either an Excel or Word file) and include a malicious macro. Then, they use social engineering to trick users into opening the file and activating the macro.

If the user activates the macro in the infected file, the embedded code executes, and the macro either:

• Downloads ransomware payload from a remote server.
• Executes the ransomware code already present within the document.

Once ransomware executes, malicious code begins encrypting target files on the system, and the victim gets a note demanding a ransom in exchange for the decryption key.

How to Defend Against Microsoft Macros

Here are a few precautions that lower the risk of suffering ransomware via a file containing an infected macro:

• Enable macro security warnings in Microsoft Word.
• Never ignore warnings that pop up when a document contains macros.
• Leave macros disabled if you do not require them for daily tasks (which is the default Microsoft setting). Only enable macros when you need them and when the document arrives from a trusted source.
• Use email filters to block suspicious documents.
• Keep Microsoft Office software up to date with the latest security patches.
• Educate employees about the risks of enabling macros and the importance of being cautious when working with suspicious documents.

Most Common Ransomware Encrypted File Extensions

When ransomware encrypts data, malicious code changes the file extension. In most cases, the extension reveals what variant infected the system. The table below presents an extensive list of the most common file extensions that indicate a ransomware infection.

Important note: Ransomware criminals are not known for politeness or sophistication, so the table below contains some highly graphic language. Reader discretion is advised.

Stay a Step Ahead of Would-Be Cybercriminals

Like all criminals, ransomware groups prefer going after low-hanging fruit. Victims unaware of the go-to infection methods are primary targets for ransomware attacks, so ensure your security team is up to date with all common attack vectors when creating your anti-ransomware strategy.