Paying the Ransom

Abstract

Regardless of all mitigation measures or prevention strategies already described in this book, no organization or individual can be 100 percent immune to ransomware infection. This makes having a solid backup and recovery plan important to counter successful ransomware attacks. So, the most important question is, what should you do if you do not have the appropriate backup to restore operations after a ransomware infection? Let's imagine a scenario where ransomware infects the victim's backup data also. What you can do in such a situation? In such a horrible situation, you are limited to one of these options: • Remove the infection and try to decrypt the infected data. • Do nothing. Wipe the infected machine's software and install a clean OS and applications. • Pay the ransom. The first option, removing the ransomware infection using special decryption tools, will be the subject of the next chapter; however, this option depends on the existence of a decryption utility for the specific ransomware. The second option is to do nothing; in this scenario, you lose all your infected data and start from zero. The third option, which is paying the ransom, is the subject of this chapter. In this chapter, I show how to evaluate whether to pay a ransom. This is a tough question because it largely depends on each case. I also talk about the anonymous payment methods employed by ransomware owners when receiving money from their victims. Obviously, having a secure, anonymous payment system in place that cannot be traced is a key element in the ransomware attack model.