Synthesis of Evidence on Existing and Emerging Social Engineering Ransomware Attack Vectors

Abstract

As the threat landscape continues to evolve, users are becoming less aware, ignorant, or negligent, putting their confidential data at risk. Users easily fall prey to socially engineered ransomware attacks that encrypt and lock a computer or mobile device, holding it hostage unless a ransom is paid. The cryptoware encrypts data securely, making it almost impossible for anyone except the hacker to unlock the device. This research conducts a systematic review to identify methods for executing socially engineered ransomware attacks. Using a CRI framework, 122 studies were synthesized from 3209 research articles highlighting gaps in identifying and analyzing attack vectors, as well as the need for a holistic approach to ransomware with behavioural control as part of the solution. Human vulnerability was found to be a critical point of entry for miscreants seeking to spread ransomware. This review will be useful in developing control models that will educate organisations and security professionals to focus on adopting human-centered solutions to effectively counter ransomware attacks.

Examining Windows File System IRP Operations with Machine Learning for Ransomware Detection

“…The trend towards using ransomware to exfiltrate and threaten the release of sensitive data, rather than just encrypting it, marked a significant evolution in ransomware's impact on data privacy and security [52], [53], [54]. Studies also noted the increasing use of social engineering tactics to facilitate ransomware infection, emphasizing the sophistication of attack methods [21], [55], [56]. The diversification of payment demands, including cryptocurrencies, was identified as a factor complicating the tracking and mitigation of ransomware incidents [1], [3].…”

Ransomware Detection with Opcode Analysis and GAN-Based Unsupervised Learning

“…Extensive studies have been conducted on various features of ransomware. One key aspect analyzed is the use of sophisticated fingerprinting methods by ransomware, which include time, date, language, and geolocation data, to tailor social engineering attacks [11,12]. For example, ransomware variants like Reveton and Cerber have been noted for customizing ransom notes in the victim's language, enhancing the efficacy of the scam [13,14,15,16].…”

Semantic Analysis of Phishing Emails Leading to Ransomware with ChatGPT

“…These attacks manifest in two primary forms: cryptographic ransomware, which encrypts a victim's data and demands a ransom for its decryption [3], and data theft ransomware, involving the exfiltration of sensitive information, often coupled with threats of public release or further extortion [4,5]. Historically, these forms of ransomware have led to significant financial losses, operational disruptions, and severe breaches of privacy and data security [6,7]. Phishing emails have emerged as one of the most prevalent avenues for ransomware attacks (Figure 1) [8,9,10].…”

“…By intercepting these emails, cybersecurity professionals have a unique opportunity to analyze and understand the diverse and continuously evolving strategies employed by attackers [16]. This analysis is crucial in grasping the subtle and intricate tactics used, enabling the formulation of stronger defenses against the dual threats of encryption-based and data theft ransomware [7,4].…”