The Basics of Ransomware Countermeasures That You Can't Ask About Now

Dangerous if you don't know! Essential measures to protect your company from ransomware.

■By the time you realize it, it's too late: The Active Directory server is the first target of attackers. Recently, there have been numerous significant security incidents that greatly impact business continuity for companies. Traditional ransomware would encrypt files and demand a ransom for decryption. However, the new type of ransomware has evolved to first extract information and then encrypt files, publicly disclosing some of the extracted information on the dark web, threatening to release all information unless a ransom is paid. Specifically, these attacks target a large number of organizations indiscriminately, with hackers infiltrating organizations through vulnerabilities or misconfigurations. After taking over the network, they steal a large amount of confidential information. Subsequently, they introduce ransomware, causing large-scale system failures that lead to business shutdowns, or they threaten to publish the stolen information on the dark web to extort ransom. In these incidents, it is often the case that attackers gain administrative privileges over the AD server, which is the core of the system, at an early stage, taking over the network without the affected companies realizing it, preventing them from avoiding business shutdowns or significant damage.

Other security