Anti-Ransomware: 4 Technologies that Stop Ransomware Attacks

Stages of a Ransomware Attack: Which Tools Can Assist at Every Stage?

Different security tools can help address each stage of a ransomware attack:

• Intrusion stage—typically, a user or device visits an infected website delivered by a targeted or phishing attack or via vulnerable RDP ports. Anti-ransomware tools for this stage include a secure web gateway (SWG) and secure email gateway (SEG) to prevent web-based and email intrusions. Additional techniques like network segmentation can help reduce the impact of the breach. Some organizations use honeypots and other deception techniques to identify and disarm ransomware.
• Compromise stage—the attacker deploys ransomware on devices connected to the target network. Endpoint detection and response (EDR) and endpoint protection platforms (EPP) can help defend against active attacks. Some organizations use managed detection and response services if their in-house team lacks the necessary expertise for EDR.
• Command and control stage—the infected machine receives instructions via a command and control channel. Various network discovery and response (NDR) tools can identify and block this channel, including SWG and DNS security solutions.
• Tunneling stage—the attacker attempts to move laterally within the target network after deploying the ransomware. Organizations can use network segmentation and endpoint firewalls at this advanced attack stage to limit the attacker’s lateral movement. Additional tools include automated vulnerability management and patching systems.

Related content: Read our guide to ransomware prevention.

4 Technologies that Help Block Ransomware Attacks

Here are some of the main anti-ransomware tools and how they work.

1. EDR

Endpoint detection and response solutions work by collecting security events and indicators of compromise (IoC) from endpoint devices. These IOCs are insufficient to identify attacks, but they can let the security know where to look to detect an attack in progress. EDR tools help detect burrowing, where the attack agent quietly collects data such as compromised privileges and accounts.

Once the solution detects an attack, it can take action. EDR tools can isolate endpoints so the incident response team can work on issues without the compromised system affecting the rest of the network. Many extended detection and response (XDR) tools contain EDR capabilities as well.

2. MDR

A managed detection and response solution provides the expertise needed to understand, investigate, and interpret security events and IoCs. An organization might not have a proper security operations center, or its in-house security team might not know how to maintain or operate an EDR solution. MDR allows the organization to leverage EDR benefits via an outsourced service.

3. IPS, NTA, and NDR

Three useful early detection solutions include an intrusion prevention system (IPS), network traffic analysis (NTA), and network detection and response (NDR). These tools can identify command and control traffic and attempts to deploy ransomware.

4. Deception Techniques

Deception tools are useful for identifying sophisticated malware, including ransomware. An example of a deception technique is using fake admin accounts to lure attackers and alert the security team when someone attempts to compromise an account. Other ways to trick attackers include honeypots, which are an effective part of an anti-ransomware strategy.

Supporting Anti-Ransomware Techniques

Tools cannot prevent ransomware attacks alone. Here are important techniques that should be carried out by security teams when dealing with an active ransomware threat:

• Ensure there is a dedicated incident response team with a clear playbook to follow when a ransomware attack occurs.
• Check for regular activities that should be happening, but are suddenly stopped—such as scheduled backups or disabled shadow copies.
• Avoid physical network isolation—pulling the plug may be effective at isolating an infected endpoint, but won’t allow teams to further investigate an incident or carry out remediation actions.
• Beyond isolation carried out by EDR at the device level, teams should isolate infected network segments by disconnecting them from local network switches, virtual private networks (VPNs), network access control (NACs), and Wi-Fi access points.
• Suspicious devices should be isolated based on their hardware-level MAC address. This makes it important to have mature asset management and know exactly which endpoints are running in the organization.

After an attack has taken place, the following steps can help minimize damage:

• Restore data from backup. This includes verifying backup integrity and understanding lost data, if any.
• Try to determine if attackers have exfiltrated sensitive data and plan to expose it or extort the organization.
• Use EPP and EDR solutions as part of a remedial response to neutralize the threat and roll back changes. Take into account that infected systems may be “locked down” and require physical access.
• Verify device integrity and ensure systems are clean before reconnecting networks.
• Update or delete compromised credentials, otherwise attackers can get back into the system.
• Perform a root cause analysis of the attack and identify measures that can prevent similar attacks in the future.

All-in-One Ransomware Protection with Cynet

Cynet 360 AutoXDR is an Advanced Threat Detection and Response platform that provides protection against threats, including ransomware, zero-day attacks , advanced persistent threats (APT), and trojans that can evade signature-based security measures.

Cynet provides a multi-layered approach to stop ransomware from executing and encrypting your data:

• Pre-download—applies multiple mechanisms against exploits and fileless malware, which typically serves as a delivery method for the ransomware payload, preventing it from getting to the endpoint in the first place.
• Pre-execution prevention—applies machine-learning-based static analysis to identify ransomware patterns in binary files before they are executed.
• In runtime—employs behavioral analysis to identify ransomware-like behavior, and kill a process if it exhibits such behavior.
• Threat intelligence—uses a live feed comprising over 30 threat intelligence feeds to identify known ransomware.
• Fuzzy detection—employs a fuzzy hashing detection mechanism to detect automated variants of known ransomware.
• Sandbox—runs any loaded file in a sandbox and blocks execution upon identification of ransomware-like behavior.
• Decoy files—plants decoy data files on the hosts and applies a mechanism to ensure these are the first to be encrypted in a case of ransomware. Once Cynet detects that these files are going through encryption it kills the ransomware process.
• Propagation blocking—identifies the networking activity signature generated by hosts when ransomware is auto-propagating, and isolates the hosts from the network.

Learn more about Cynet ransomware protection