Ransomware not the scary beast it’s rumoured to be, French analysts say

Researchers claim that the sophisticated and somewhat scary reputation of ransomware has been wildly exaggerated.

The verdict comes from a study conducted by France’s Symantec Research Labs and Institut Eurecom, along with the US’ Lastline Labs and Northeastern University. A number of commentators, however, are questioning the researchers’ findings.

The study took 1,359 samples from 15 ransomware ‘families’ collated between 2006 and 2014.

The report stated:

“Our results show that, despite a continuous improvement in the encryption, deletion and communications techniques in the main ransomware families, the number of families with sophisticated destructive capabilities remains quite small.”

The report, titled ‘Cutting the Gordian Knot: A Look Under the Hood of Ransomware Attacks’ was recently introduced in Milan at the 12th Conference on Detection of Intrusions and Malware & Vulnerability Assessment.

In most instances, ransomware only either tries to lock a victim’s terminal, or delete or encrypt files with superficial techniques. Just 5.3% of samples evaluated in the study employed file encryption in their attack, with the remainder instead erasing key files or locking computers.

As a result, combatting attacks by ransomware is not the complicated process often suggested. By keeping a close eye on irregular activity of file systems, even large quantities of attacks can be stopped, regardless of any advanced encryption capabilities.

Ransomware, however, is only one threat to both individuals and businesses employing computers. Businesses, certainly, would be naïve to think that the recent report means that all is okay in the world of cybercrime. More than ever, UK SMEs need to open cyber security jobs to those with the ability to stop and prevent any attacks on their system.