Ransomware encrypts files on computers and servers and demands money to unlock them. It often steals data first and threatens to publish it. Small businesses are targeted too, because their defences are often weaker and the attacks are largely automated.
How ransomware gets in
- Phishing e-mail. An attachment or link that installs malware or steals a password.
- RDP or VPN exposed to the internet without MFA. Attackers constantly try passwords automatically. One weak or leaked password is enough.
- Unpatched devices. Known vulnerabilities in the firewall, VPN gateway, server or an old Windows version. Firewall firmware needs updating too.
- Stolen accounts. Passwords leaked from other services are tried against your systems.
The attacker is often inside the network for days or weeks before encrypting anything, looking for administrator accounts and backups so they can destroy them first.
The first hour: what to do
- Isolate infected devices. Unplug the network cable and turn off Wi-Fi. If the spread is wide, disconnect the whole office from the internet.
- Do not wipe or reinstall anything. The devices hold traces that show how the attacker got in and what they did. A quick reinstall destroys them and leaves the same hole open.
- Protect your backups. Disconnect external drives and the NAS if they are still untouched.
- Do not pay in a hurry. Paying does not guarantee you get your data back or that stolen data will not be published. First find out whether you can restore from backup.
- Call for help and keep notes. Photograph the ransom note and write down times and observations. Incidents can be reported to CERT-EE. If personal data was leaked, you may have to notify the Data Protection Inspectorate.
- Change passwords from a clean device, especially administrator, e-mail and banking passwords.
How a small business protects itself
- Offline or immutable backups. At least one copy must be out of the attacker's reach: a disconnected drive, immutable cloud storage, or a backup system with separate credentials. Test restores regularly; an untested backup is only a hope.
- MFA everywhere. E-mail, VPN, remote desktop, administrator accounts and cloud services.
- Patching. Windows, applications, servers, and firewall and VPN firmware. Devices that no longer receive vendor updates must be replaced.
- Least privilege. Daily work is done with a standard user account. Administrator rights go only to those who really need them, on a separate account.
- EDR or proper antivirus on all computers and servers, with central monitoring so that someone actually sees the alerts.
- No RDP open to the internet. Remote access goes through VPN with MFA.
- Staff training. A person who recognises a suspicious e-mail and reports it immediately is a good layer of defence.
Quick checklist
| Question | Good answer |
|---|---|
| When did you last restore a file from backup? | Within the last couple of months |
| Is any backup protected from an attacker? | Yes, offline or immutable |
| Do VPN and e-mail have MFA? | Yes, for every user |
| Is the firewall firmware up to date? | Yes, and vendor support is valid |
| Do users work with administrator rights? | No |
When to call a professional
If files are already encrypted, call a specialist straight away, before you start restoring or reinstalling anything. For prevention, an annual IT audit that checks backups, MFA and patching is worth it. ITABIKS can help in both cases, phone +372 53 888 229.