Ransomware is a type of cybersecurity incident where files on one or more computers are encrypted by a malicious actor who only decrypts the files when a ransom has been paid.
Ransomware has become one of the most damaging forms of malicious activity (also known as cybercrime) in the past decade. It exploits the asymmetry where an organization’s data is very valuable to that organization itself but has often very little value to others. It is thus far more attractive for most adversaries to engage in ransomware than in information theft.
Ransomware is almost always executed with the goal of financial gain; its operators are often cybercriminals, though occasionally they have operated on behalf of nation states. Leaks from ransomware groups have shown a great level of professionalism and organizational sophistication, often similar to that of tech companies.
Both small and large organizations have fallen victim to ransomware and many cases go unreported. Some prominent cases that did become public include attacks on the government of Costa Rica, the Irish publish health system, the Colonial Pipeline oil pipeline system and a mental health startup in Finland.
Many NGOs have been affected by ransomware, too, either directly through the targeting of their systems or indirectly because one of their suppliers was hit with ransomware. This short document provides guidance for NGOs who are concerned about ransomware, want to reduce their risk of being affected, and want to be as well prepared as possible in case they do get hit.
Organization-wide vs single-device ransomware
When ransomware became a major problem around 2013, initially it would only affect files on a single device and the ransom asked (typically to be paid in Bitcoin) was around 300 US dollars. While not ideal, such an incident was no worse than a device getting lost or stolen.
However, threat actors quickly discovered that they could make a lot more money by encrypting data on many computers all at once. This is what happens in all major ransomware incidents these days and this is what this guide largely focuses on.
One case in which an organization might still come across ransomware targeting a single device is if a user downloads pirated software, as some ransomware is known to spread through ‘cracked’ versions of games or other kinds of software.
Ransomware and NGOs
Because of the financial motive behind the attack, a ransomware incident is almost always opportunistic. Attackers choose a target organization not because of who they are but because they happen to be an easy target, because of a weakness of some kind (more on that later) or because they are believed to have the financial resources to pay the ransom.
These attacks often require significant manual effort by attackers to ensure the operation is successful from their point of view—hence the name “human-operated ransomware.”
There is no indication that certain NGOs are specifically targeted for ransomware because of their activities or their political stance. The fact that many NGOs have limited financial resources may make them less attractive targets, although several larger NGOs have been hit with ransomware.
In some cases, ransomware actors have been known to be lenient because of the activities of the targeted organization or the public outcry caused by the incident. This was the case of the ransomware incident affecting Ireland’s national health service, where a decryption key was provided for free. However, you should not count on this being the case, and this does not mean all problems are solved: even with the decryption key, it took months for the health service to restore all of its systems.
We spoke to Ford grantees between August 2021 and June 2022 about the ransomware risks they face. For many, ransomware was only a minor concern. Their cybersecurity efforts focused on security incidents in general rather than ransomware in particular. Especially for smaller organizations, this is not unjustified, and the purpose of this guide is not to make NGOs more concerned than they should be.
Rather, we hope to provide guidance on ransomware that should be helpful against other kinds of cybersecurity incidents, too, while also explaining some ways in which NGOs can be affected by ransomware and how these impacts can be mitigated.
Timeline of a typical ransomware operation
A typical ransomware incident starts with a malicious actor obtaining a ‘foothold’ within the affected organization. This can happen because of a vulnerability in a public-facing part of the network, such as a VPN server, or because of obtained credentials, most commonly because the same credentials were used on other systems. Another way for an adversary to obtain a foothold is through a malicious email where a user opens an attachment or clicks on a malicious link, activating the malware.
This foothold is then used by a ransomware actor — often a different attacker, since access to internal networks are frequently sold in the cybercriminal underground — to move around the organization’s network. The actor tries to obtain access to an account on the network with high privileges, for example a Domain Administrator within an Active Directory network.
Obtaining such access sometimes requires a long time and a lot of manual work by the ransomware actor. In some cases, it can take weeks to lead to the kind of privileged access required for a successful ransomware attack. However, do note that this escalation of privileges happens on an internal network; these are often less well protected than external facing systems.
This privileged access is then used to roll out ransomware throughout the organization. The goal of the actor is to encrypt as much data as quickly as possible, while also preventing the organization from stopping the incident as it happens. This is why many ransomware incidents happen outside normal office hours.
A ransomware attack is hard to miss, since users of affected systems are presented with a ransom note which includes ways to contact the actor and pay the ransom. Some ransomware actors even have professional support systems to help affected organizations pay the ransom and then recover their systems.
How each incident is resolved varies between organizations. Some decide to pay the ransom, while others don’t pay as a matter of principle or because they can restore their systems from backups. However, it is important to note that many ransomware actors have shifted to what is called ‘double extortion’ schemes where data is exfiltrated before it is encrypted. This allows the actor to threaten to publish the data if no ransom is paid. In many incidents, this threat has indeed been followed through.
Whether or not an affected organization should pay a ransom is beyond the scope of this guide, but it should be obvious that there is no guarantee that a cybercriminal group will follow through on any promises it makes, even if they have a reputation of being “honest.”
Ransomware and the cloud
Many smaller organizations, including many NGOs, rely heavily on cloud providers to store email and other important documents. With cloud providers, it is typically possible to undo changes that have been made, for example to a document, and to roll back to previous versions. That makes them less attractive to ransomware actors. After all, an organization is unlikely to pay a ransom to recover encrypted or deleted documents if they can simply retrieve the unencrypted version of the document.
However, a security company recently found weaknesses in some cloud providers that could be exploited by ransomware actors. It is best to speak to your cloud providers and ask them explicitly about these kinds of weaknesses.
Indirect exposure to ransomware
In 2021, a vulnerability in the Kaseya software company was exploited to target managed service providers (MSPs) with ransomware. MSPs (as well as managed security service providers, or MSSPs) manage software for their clients, many of whom are NGOs, and thus need to have access to their clients’ networks and devices. Many of these clients may not have been attractive ransomware targets themselves due to their size, but they were still affected.
This, and related data leaks, are something that NGOs should be mindful of, even if they may rightfully decide that direct ransomware incidents are unlikely going to affect them.
12 tips to limit the risk to ransomware
What follows are twelve ways to greatly limit the risk of ransomware incidents, while also helping organizations recover more quickly when an incident occurs. Most of these also limit the impact of other kinds of cybersecurity incidents, including those from highly skilled adversaries.
-
Use multi-factor authentication, particularly on all public-facing accounts. Many ransomware incidents start with stolen (or, occasionally, very weak) credentials that allow actors to log in to a device on the edge of an organization’s network, such as a VPN server. Requiring a second factor before granting access greatly reduces the likelihood of such incidents.
-
Always install patches as soon as they become available and don’t run software beyond its end of life (the date after which it stops being supported). This is again particularly important for devices on the edge of an organization’s network, since many ransomware incidents start with the exploitation of a vulnerability in such a device. In almost all cases, a patch for these vulnerabilities has already been made available at the time of the attack.
-
Use good email security and understand how email-based malware works. Email is another common infection vector that is commonly used by ransomware actors. On fully patched systems, it is very rare for malware to be installed by just opening an attachment or clicking a link. Instead, some manual interaction by an individual is usually required. Organizations may want to consider tailoring security training towards those risks. Even more effective is limiting the amount of harm that people can cause, such as by blocking Office macros organization-wide.
-
Protect the internal network. For convenience, many organizations make it relatively easy for people on the network to access many resources, including those they don’t directly need. This access is exploited by ransomware actors after they have obtained a foothold. Make it particularly hard to access privileged accounts and consider using multi-factor authentication for such accounts, even for internal access.
-
Always install software from their official sources and avoid pirated software. Though using pirated software sounds attractive for cash-strapped NGOs, it is common for such software to include malware, including ransomware. There are various programs that make legitimate commercial software available at a big discount (and sometimes even free) for NGOs. Open-source software may also be an alternative.
-
Have a cybersecurity consultant on call who will be available to quickly assist in case of a ransomware incident; this can be a company or an individual. Dealing with a ransomware incident is complicated and something you are unlikely to be able to handle on your own. Such a consultant can also provide guidance on cybersecurity improvements your organization can put in place.
-
Understand your exposure to third party systems in case they get affected by ransomware. This is particularly relevant for managed (security) service providers. Don’t be afraid to ask your MSP (if you have one) about the risks of ransomware and to seek external guidance on this, for example by asking the consultant on call.
-
Speak to your cloud providers to understand how their systems can be exploited by ransomware actors, or how their backups actually limit the risk. Again, you may want to seek external guidance here.
-
Limit the amount of data that you keep. Any data that isn’t stored can’t be held for ransom or leaked to the public. A lot of modern office suites help enforce data retention policies.
-
Make sure you make backups often, store them outside your organization’s network, and test them regularly to ensure they can be relied upon.
-
Hold regular tabletop exercises that focus particularly on direct and indirect ransomware incidents. Such exercises help an organization identify weaknesses, both in preventing ransomware incidents and in handling incidents if they do occur. They also help start the conversation on ransomware and cybersecurity in general within your organization.
-
Consider cybersecurity insurance. Insurance not only helps organizations cover the cost of cybersecurity incidents, including ransomware, but many policies require certain steps to be taken, including some listed in this guide. This can often be used as a ‘stick’ to enforce policy changes that are necessary for cybersecurity but may be unpopular among staff.
Finally, as a bonus, organizations are encouraged to leverage the Cybersecurity Advisory Tool that we developed to better understand areas where they can improve.