It might be difficult to keep track of the many ransomware strains as new ransomware versions emerge on a regular basis. While each of these malware variants is unique, they all employ similar techniques to exploit people and keep encrypted data hostage.

The top ten most popular ransomware strains

• Rabbit with a bad reputation
• Cryptolocker
• GoldenEye
• Jigsaw
• Locky
• Maze
• NotPetya
• Petya
• Ryuk
• Wannacry

Ransomware comes in a variety of forms.

Although there are many different varieties of ransomware, they mostly fall into two categories. Crypto-ransomware and locker ransomware are the two types of ransomware.

What is Crypto ransomware, and how does it work?

Crypto ransomware encrypts important files on a computer, rendering them useless. Cyber criminals that use crypto-ransomware assaults make money by encrypting information and asking that victims pay a ransom to get their contents back.

What is Locker ransomware and how does it work?

Locker ransomware, unlike crypto-ransomware, does not encrypt data. Instead, it takes it a step further by locking the victim out of their device. Cybercriminals will demand a payment to unlock the device in these sorts of assaults.

Users may be left with no other choice to return to normal in both sorts of attacks. As a result, it’s critical to take steps to prepare your systems so that they can recover without falling prey to cyber criminals.

How to Defend Yourself Against Ransomware

Ransomware is one of the most serious problems MSPs face today, and certain strains, like as Wannacry, take advantage of unpatched or out-of-date workstations. Others, on the other hand, are triggered by human connection. It’s critical to follow security best practices to reduce your chances of being a victim of ransomware. MSPs can safeguard and restore computers if they are infected with ransomware by utilizing Datto’s capabilities.

Bad Rabbit is one of the most common ransomware strains.

A ransomware outbreak that has affected Russian and Eastern European organizations. On infected websites, Bad Rabbit spreads via a bogus Adobe Flash update. When the ransomware infects a computer, it redirects users to a payment website where they must pay.05 bitcoin.

Cerber

Cerber uses a sophisticated phishing effort to target cloud-based Microsoft 365 subscribers, affecting millions of people. This form of virus highlights the rising need of cloud backup in addition to on-premises backup.

CryptoLocker Ransomware

 has been circulating in some form or another for the previous two decades, but CryptoLocker was the first to get widespread attention in 2013. The first CryptoLocker botnet was shut down in May 2014, but not before extorting roughly $3 million from victims. Since then, hackers have frequently imitated the CryptoLocker method, however the current iterations are unrelated to the original. CryptoLocker has become nearly synonymous with ransomware, much like Xerox and Kleenex in their respective spheres.

CryptoWall

Following the demise of the first CryptoLocker, CryptoWall rose to prominence. CryptoBit, CryptoDefense, CryptoWall 2.0, and CryptoWall 3.0 are some of the variations that have surfaced since its first release in early 2014. CryptoWall, like CryptoLocker, is spread by spam or exploit kits.

Crysis

Crysis ransomware uses a powerful encryption method to encrypt files on fixed, removable, and network devices, making it impossible to decrypt in a reasonable length of time. It’s usually disseminated by emails with attachments that have a double-file extension, making the file appear to be non-executable. It may also be disguised as a legitimate application installer, in addition to emails.

CTB–Locker

CTB-perpetrators Locker’s adopt a unique technique to malware propagation. These hackers, like Girl Scout Cookies and Mary Kay Cosmetics, outsource the infection process to partners in exchange for a portion of the earnings. This is a tried-and-true method for rapidly infecting huge numbers of computers with malware.

GoldenEye

GoldenEye is a ransomware variant of the well-known Petya malware. Hackers used a large campaign targeting human resources departments to disseminate the GoldenEye malware. After the file is downloaded, a macro is run that encrypts the computer’s files. GoldenEye appends a random 8-character extension to each file it encrypts. The malware then replaces the MBR (Master Boot Record) on the user’s hard disk with a modified boot record.

Jigsaw

Jigsaw encrypts data and deletes them one by one until a ransom is paid. After the first hour, the ransomware deletes a single file, then more and more each hour until all remaining files are erased at the 72-hour point.

KeRanger

The KeRanger malware was spotted on a major BitTorrent client, according to ArsTechnica. KeRanger isn’t widely disseminated, yet it’s largely regarded as the first fully functional ransomware for Mac OS X.

LeChiffre

Le Chiffre is the major villain in James Bond’s Casino Royale novel, and his name originates from the French word “chiffrement,” which means “encryption.” He kidnaps Bond’s love interest in order to lead him into a trap and take his money. Unlike earlier variations, hackers must manually launch LeChiffre on the infected system. Cybercriminals automatically scan networks for vulnerable remote workstations, signing in remotely and manually infecting them with the malware.

LockerGoga

Norsk Hydro was among the European manufacturing businesses attacked by this ransomware strain. The ransomware infiltrated the company via a phishing email, resulting in a global IT outage and the need to order hundreds of new computers.

Locky

The method used by Locky is identical to that used by many other varieties of ransomware. The virus is sent by email in the form of an invoice. When the invoice is opened, it is scrambled, and the victim is told to allow macros in order to understand it. Locky begins encrypting a wide range of file formats using AES encryption once macros are enabled.

The ransomware Maze

In 2019, it was discovered. Maze ransomware has swiftly gained notoriety for releasing data belonging to victims, mostly in the healthcare industry. Companies like Xerox Corporation, on the other hand, were recently targeted by the Maze ransomware perpetrators, who took over 100GB of data.

NotPetya

According to early reports, NotPetya is a variation of Petya, a ransomware strain first discovered in 2016. NotPetya, on the other hand, is now thought to be a wiper virus, which has the primary objective of deleting data rather than extracting a ransom.

Petya

Petya encrypts whole computer systems, unlike some other varieties of ransomware. The master boot record is overwritten by Petya, rendering the operating system unbootable.

Ryuk

Throughout 2020, the Ryuk ransomware has been spreading havoc on unsuspecting victims. According to reports, Ryuk ransomware has been responsible for more than a third of all ransomware assaults in 2020, indicating that it is growing traction. Ryuk has been used in assaults on businesses, hospitals, and government entities. Ryuk encrypts mission-critical information and demands a large ransom, usually in the millions of dollars.

Spider

A kind of malware that spread across Europe via spam emails. Spider ransomware is concealed in Microsoft Word documents, which when downloaded, install the infection on the victim’s machine. Malicious macros are embedded in the Word document, which is disguised as a debt collection note. When these macros are run, the ransomware begins downloading and encrypting the data of the victim.

TeslaCrypt

TeslaCrypt, like the majority of the other examples here, encrypts data with the AES algorithm. It’s usually spread using the Angler exploit kit, which targets Adobe vulnerabilities. TeslaCrypt installs itself in the Microsoft temp folder if a vulnerability is exploited.

TorrentLocker

TorrentLocker is primarily spread via spam email campaigns and is geographically targeted, with email messages sent to certain locations. TorrentLocker is also known as CryptoLocker, and it encrypts files with the AES technique. TorrentLocker is unusual in that it not only encrypts files but also gathers email addresses from the victim’s address book in order to disseminate malware beyond the afflicted machine.

WannaCry

WannaCry was a global ransomware attack that hit businesses all over the world. Over 125,000 organizations in over 150 countries were affected by the malware. Through a Microsoft exploit known as EternalBlue, the ransomware strain infected Windows PCs.

ZCryptor

ZCryptor is a self-propagating malware strain that behaves like a worm, encrypting files and infecting external disks and flash drives to spread to new systems.

Check out Datto’s State of the Channel Ransomware Report to learn more about ransomware and what MSPs can do to combat it and safeguard the world’s small and medium companies. New figures and projections on ransomware and its impact on organizations, as well as the major types, best practices for ransomware security, and more, are included in the research.