Section outline

    • Ransomware is a type of cybersecurity incident where files on one or more computers are encrypted by a malicious actor who only decrypts the files when a ransom has been paid.

      Ransomware has become one of the most damaging forms of malicious activity (also known as cybercrime) in the past decade. It exploits the asymmetry where an organization’s data is very valuable to that organization itself but has often very little value to others. It is thus far more attractive for most adversaries to engage in ransomware than in information theft.

      Ransomware is almost always executed with the goal of financial gain; its operators are often cybercriminals, though occasionally they have operated on behalf of nation states. Leaks from ransomware groups have shown a great level of professionalism and organizational sophistication, often similar to that of tech companies.

      Both small and large organizations have fallen victim to ransomware and many cases go unreported. Some prominent cases that did become public include attacks on the government of Costa Rica, the Irish publish health system, the Colonial Pipeline oil pipeline system and a mental health startup in Finland.

      Many NGOs have been affected by ransomware, too, either directly through the targeting of their systems or indirectly because one of their suppliers was hit with ransomware. This short document provides guidance for NGOs who are concerned about ransomware, want to reduce their risk of being affected, and want to be as well prepared as possible in case they do get hit.

      Organization-wide vs single-device ransomware

      When ransomware became a major problem around 2013, initially it would only affect files on a single device and the ransom asked (typically to be paid in Bitcoin) was around 300 US dollars. While not ideal, such an incident was no worse than a device getting lost or stolen.

      However, threat actors quickly discovered that they could make a lot more money by encrypting data on many computers all at once. This is what happens in all major ransomware incidents these days and this is what this guide largely focuses on.

      One case in which an organization might still come across ransomware targeting a single device is if a user downloads pirated software, as some ransomware is known to spread through ‘cracked’ versions of games or other kinds of software.

      Ransomware and NGOs

      Because of the financial motive behind the attack, a ransomware incident is almost always opportunistic. Attackers choose a target organization not because of who they are but because they happen to be an easy target, because of a weakness of some kind (more on that later) or because they are believed to have the financial resources to pay the ransom. 

      These attacks often require significant manual effort by attackers to ensure the operation is successful from their point of view—hence the name “human-operated ransomware.”  

      There is no indication that certain NGOs are specifically targeted for ransomware because of their activities or their political stance. The fact that many NGOs have limited financial resources may make them less attractive targets, although several larger NGOs have been hit with ransomware.

      In some cases, ransomware actors have been known to be lenient because of the activities of the targeted organization or the public outcry caused by the incident. This was the case of the ransomware incident affecting Ireland’s national health service, where a decryption key was provided for free. However, you should not count on this being the case, and this does not mean all problems are solved: even with the decryption key, it took months for the health service to restore all of its systems.

      We spoke to Ford grantees between August 2021 and June 2022 about the ransomware risks they face. For many, ransomware was only a minor concern. Their cybersecurity efforts focused on security incidents in general rather than ransomware in particular. Especially for smaller organizations, this is not unjustified, and the purpose of this guide is not to make NGOs more concerned than they should be.

      Rather, we hope to provide guidance on ransomware that should be helpful against other kinds of cybersecurity incidents, too, while also explaining some ways in which NGOs can be affected by ransomware and how these impacts can be mitigated.

      Timeline of a typical ransomware operation

      A typical ransomware incident starts with a malicious actor obtaining a ‘foothold’ within the affected organization. This can happen because of a vulnerability in a public-facing part of the network, such as a VPN server, or because of obtained credentials, most commonly because the same credentials were used on other systems. Another way for an adversary to obtain a foothold is through a malicious email where a user opens an attachment or clicks on a malicious link, activating the malware. 

      This foothold is then used by a ransomware actor — often a different attacker, since access to internal networks are frequently sold in the cybercriminal underground — to move around the organization’s network. The actor tries to obtain access to an account on the network with high privileges, for example a Domain Administrator within an Active Directory network.

      Obtaining such access sometimes requires a long time and a lot of manual work by the ransomware actor. In some cases, it can take weeks to lead to the kind of privileged access required for a successful ransomware attack. However, do note that this escalation of privileges happens on an internal network; these are often less well protected than external facing systems.

      This privileged access is then used to roll out ransomware throughout the organization. The goal of the actor is to encrypt as much data as quickly as possible, while also preventing the organization from stopping the incident as it happens. This is why many ransomware incidents happen outside normal office hours.

      A ransomware attack is hard to miss, since users of affected systems are presented with a ransom note which includes ways to contact the actor and pay the ransom. Some ransomware actors even have professional support systems to help affected organizations pay the ransom and then recover their systems.

      How each incident is resolved varies between organizations. Some decide to pay the ransom, while others don’t pay as a matter of principle or because they can restore their systems from backups. However, it is important to note that many ransomware actors have shifted to what is called ‘double extortion’ schemes where data is exfiltrated before it is encrypted. This allows the actor to threaten to publish the data if no ransom is paid. In many incidents, this threat has indeed been followed through.

      Whether or not an affected organization should pay a ransom is beyond the scope of this guide, but it should be obvious that there is no guarantee that a cybercriminal group will follow through on any promises it makes, even if they have a reputation of being “honest.”

      Ransomware and the cloud

      Many smaller organizations, including many NGOs, rely heavily on cloud providers to store email and other important documents. With cloud providers, it is typically possible to undo changes that have been made, for example to a document, and to roll back to previous versions. That makes them less attractive to ransomware actors. After all, an organization is unlikely to pay a ransom to recover encrypted or deleted documents if they can simply retrieve the unencrypted version of the document.

      However, a security company recently found weaknesses in some cloud providers that could be exploited by ransomware actors. It is best to speak to your cloud providers and ask them explicitly about these kinds of weaknesses.

      Indirect exposure to ransomware

      In 2021, a vulnerability in the Kaseya software company was exploited to target managed service providers (MSPs) with ransomware. MSPs (as well as managed security service providers, or MSSPs) manage software for their clients, many of whom are NGOs, and thus need to have access to their clients’ networks and devices. Many of these clients may not have been attractive ransomware targets themselves due to their size, but they were still affected.

      This, and related data leaks, are something that NGOs should be mindful of, even if they may rightfully decide that direct ransomware incidents are unlikely going to affect them.

      12 tips to limit the risk to ransomware 

      What follows are twelve ways to greatly limit the risk of ransomware incidents, while also helping organizations recover more quickly when an incident occurs. Most of these also limit the impact of other kinds of cybersecurity incidents, including those from highly skilled adversaries. 

       

       

       

       

       

       

       

       

       

       

       

       

      Finally, as a bonus, organizations are encouraged to leverage the Cybersecurity Advisory Tool that we developed to better understand areas where they can improve.