Preface |
|
ix | |
|
Part I Understanding Ransomware |
|
|
|
1 Introduction to Ransomware |
|
|
3 | (20) |
|
Ransomware's Checkered Past |
|
|
3 | (3) |
|
Anatomy of a Ransomware Attack |
|
|
6 | (1) |
|
|
6 | (2) |
|
|
8 | (2) |
|
|
10 | (1) |
|
|
11 | (1) |
|
|
11 | (1) |
|
|
12 | (1) |
|
|
12 | (3) |
|
System or Browser Locking |
|
|
15 | (2) |
|
The Rapid Growth of Ransomware |
|
|
17 | (1) |
|
|
18 | (1) |
|
Misleading Applications, FakeAV, and Modern CrytpoRansomware |
|
|
19 | (2) |
|
|
21 | (2) |
|
2 Pros and Cons of Paying the Ransom |
|
|
23 | (10) |
|
|
24 | (1) |
|
Knowing What Is Actually Backed Up |
|
|
24 | (1) |
|
Knowing Which Ransomware Family Infected the System |
|
|
25 | (1) |
|
|
26 | (3) |
|
Ransomware and Reporting Requirements |
|
|
29 | (1) |
|
|
30 | (1) |
|
|
31 | (1) |
|
|
32 | (1) |
|
3 Ransomware Operators and Targets |
|
|
33 | (18) |
|
|
35 | (1) |
|
|
35 | (1) |
|
|
36 | (1) |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
39 | (1) |
|
Who Are Ransomware Groups Targeting? |
|
|
40 | (1) |
|
|
40 | (1) |
|
Advanced Hacking Groups Move In |
|
|
41 | (2) |
|
Ransomware as a Service (RaaS) |
|
|
43 | (1) |
|
|
44 | (3) |
|
RaaS Disrupts Security Tools |
|
|
47 | (1) |
|
|
48 | (3) |
|
Part II Defensive Tactics |
|
|
|
4 Protecting Workstations and Servers |
|
|
51 | (24) |
|
Attack Vectors for Ransomware |
|
|
52 | (2) |
|
Hardening the System and Restricting Access |
|
|
54 | (1) |
|
|
55 | (1) |
|
Asset Management, Vulnerability, Scanning, and Patching |
|
|
55 | (2) |
|
Disrupting the Attack Chain |
|
|
57 | (11) |
|
Looking for the Executable Post-Attack |
|
|
68 | (1) |
|
Protecting Public-Facing Servers |
|
|
69 | (2) |
|
Alerting and Reacting Quickly |
|
|
71 | (1) |
|
Honeyfiles and Honeydirectories |
|
|
72 | (2) |
|
|
74 | (1) |
|
5 Protecting the Workforce |
|
|
75 | (14) |
|
Knowing the Risks and Targets |
|
|
75 | (4) |
|
Learning How to Prevent Compromises |
|
|
79 | (1) |
|
Email Attachment Scanning |
|
|
79 | (1) |
|
Tracking Down the Websites |
|
|
80 | (3) |
|
Testing and Teaching Users |
|
|
83 | (1) |
|
Security Awareness Training |
|
|
83 | (1) |
|
|
84 | (2) |
|
|
86 | (1) |
|
|
87 | (2) |
|
6 Threat Intelligence and Ransomware |
|
|
89 | (12) |
|
Understanding the Latest Delivery Methods |
|
|
90 | (2) |
|
Using the Latest Network Indicators |
|
|
92 | (3) |
|
Detecting the Latest Behavioral Indicators |
|
|
95 | (1) |
|
|
96 | (1) |
|
|
97 | (4) |
|
Part III Ransomware Families |
|
|
|
|
101 | (8) |
|
|
102 | (2) |
|
|
104 | (1) |
|
|
105 | (1) |
|
Protecting Against Cerber |
|
|
106 | (2) |
|
|
108 | (1) |
|
|
109 | (18) |
|
|
110 | (1) |
|
|
111 | (2) |
|
Understanding Locky's DGA |
|
|
113 | (1) |
|
|
113 | (1) |
|
|
114 | (1) |
|
|
115 | (1) |
|
|
115 | (3) |
|
Disable Macros in Microsoft Office Documents |
|
|
118 | (1) |
|
Don't Allow JavaScript Files to Execute Locally |
|
|
118 | (2) |
|
|
120 | (3) |
|
Reverse-Engineering the DGA |
|
|
123 | (2) |
|
|
125 | (2) |
|
|
127 | (18) |
|
|
128 | (1) |
|
Advanced Endpoint Protection Versus Sandboxing |
|
|
128 | (2) |
|
|
130 | (2) |
|
|
132 | (2) |
|
Protecting Against CryptXXX |
|
|
134 | (1) |
|
|
135 | (1) |
|
|
136 | (5) |
|
|
141 | (4) |
|
10 Other Ransomware Families |
|
|
145 | (20) |
|
|
145 | (1) |
|
Who Developed CryptoWall? |
|
|
146 | (1) |
|
|
147 | (2) |
|
|
149 | (1) |
|
|
150 | (1) |
|
Protecting Against PowerWare |
|
|
151 | (1) |
|
|
152 | (3) |
|
|
155 | (2) |
|
|
157 | (1) |
|
|
157 | (1) |
|
|
158 | (2) |
|
Ransomware Targeting Medical Devices |
|
|
160 | (1) |
|
|
161 | (2) |
|
|
163 | (2) |
Index |
|
165 | |