Ransomware

What Is Ransomware?

A caller from 'IT' warns you that an urgent security update is on its way. Minutes later the email arrives with security_update.exe attached, and the antivirus warning looks like one more hurdle. This exercise follows a ransomware attack from that first phone call to the ransom note, then through the response: refusing to pay, taking the machine off the network, spotting the lookalike sender domain, filing an IT ticket, and reporting the phishing email.

What You'll Learn in Ransomware

• Recognize the warning signs of ransomware delivery through email attachments, including unexpected file types and social engineering pressure
• Execute immediate containment steps by disconnecting from the network and isolating the affected device within the first 60 seconds
• Recognize a phone call that primes you to trust a follow-up email, and verify unexpected IT requests through official channels
• Follow your organization's incident response steps for ransomware, including reporting through the IT support portal and flagging the phishing email
• Explain why paying a ransom does not guarantee data recovery and how it funds ongoing criminal operations

Ransomware — Training Steps

1. A Suspicious Phone Call

   It's a typical Monday morning, and Alice is settling into her desk. As she organizes her tasks, her mobile phone rings, displaying 'Unknown' on the caller ID.

2. Urgent Request

   Curious, Alice answers the call. The caller says he is from IT and warns her about an urgent security update. He hangs up quickly, leaving her with a sense of urgency to comply.

3. Checking the Email

   After the call, Alice opens her email client to check for the promised message. In her inbox she notices an email from 'IT Support' with the subject line 'Urgent: Security Update Required.' The urgent tone stands out, and Alice recalls the phone call, believing it's the legitimate update she was told about.

4. Reading the Email

   The email looks professional, and it says exactly what the caller said it would: a security update, to be installed today. Trusting the source, Alice decides to proceed.

5. Antivirus Warning

   Alice clicks to download the attachment, and 'security_update.exe' appears in her file manager. A brief antivirus warning pops up, suggesting the file might be suspicious. Reassured by the phone call and email's urgency, Alice dismisses the warning, thinking it's a routine update from Nexlify Solutions' IT team.

6. The Ransomware Attack

   As soon as Alice runs the file, her screen flickers, and a menacing message appears: 'All your files have been encrypted. To receive the decryption key, transfer 1 BTC. Do not attempt to decrypt files yourself, contact authorities, or modify encrypted files.' Alice's heart sinks as she realizes she's fallen victim to a ransomware attack. Her critical work files are now inaccessible, and she feels panic and regret.

7. Resisting the Ransom

   Alice takes a moment to collect herself. She recalls a Nexlify Solutions training session advising against paying ransoms, as it doesn't guarantee file recovery and funds cybercriminals. Determined not to give in to Bob's demands, she decides to follow proper protocol to address the situation.

8. Disconnecting from the Network

   To stop the ransomware spreading to other Nexlify Solutions systems, Alice has to get her machine off the network right now. The first choice is always to cut the network link and leave the machine running: volatile memory can hold forensic evidence and, occasionally, encryption keys. But Alice's workstation is on Wi-Fi only, with no cable to pull, and the ransom note has locked the screen, so she cannot reach the Wi-Fi switch. When there is no other way to isolate a machine, powering it down is the accepted fallback.

9. Spotting the Warning Signs

   Still shaken, Alice switches to her second PC and reopens the email to work out what went wrong. Read calmly, it gives itself away in several places.

10. Internal Support System

    Alice knows she must inform Nexlify Solutions' IT department promptly. She uses the web browser to open the company's internal IT support ticketing system and signs into her account.