Ransomware

What Is Ransomware?

Ransomware attacks cost organizations an average of $4.54 million per incident according to the 2023 IBM Cost of a Data Breach Report, and the median time between initial access and encryption deployment has dropped to under 24 hours. This simulation places you at the exact moment a ransomware attack begins, starting with a suspicious email attachment that triggers a chain of events across your network. You open what appears to be a routine invoice or HR document. Within seconds, you notice unusual system behavior: files renaming themselves with unfamiliar extensions, programs becoming unresponsive, and a ransom note appearing on your screen. The exercise forces you to make rapid decisions under pressure. Do you disconnect from the network immediately? Do you shut down your machine? Do you call IT, or do you try to close the file and hope for the best? Each choice you make in the simulation reveals how ransomware propagates through shared drives, exploits open network connections, and encrypts data both locally and across mapped resources. You will learn to identify the warning signs that precede encryption, including unexpected file type changes in email attachments, unusual CPU and disk activity, and disabled security software. The exercise also covers what to do after the fact: isolating the infected machine, preserving forensic evidence, and following your incident response plan rather than paying a ransom that funds criminal operations and offers no guarantee of data recovery.

What You'll Learn in Ransomware

• Recognize the warning signs of ransomware delivery through email attachments, including unexpected file types and social engineering pressure
• Execute immediate containment steps by disconnecting from the network and isolating the affected device within the first 60 seconds
• Identify how ransomware propagates laterally through shared drives, open SMB connections, and mapped network resources
• Follow your organization's incident response plan for ransomware, including evidence preservation and proper escalation procedures
• Explain why paying a ransom does not guarantee data recovery and how it funds ongoing criminal operations

Ransomware — Training Steps

1. A Suspicious Phone Call

   It's a typical Monday morning, and Alice is settling into her desk. As she organizes her tasks, her mobile phone rings, displaying 'Unknown' on the caller ID.

2. Urgent Request

   Curious, Alice answers the call. The caller introduces himself as Bob from IT. 'Hello, Alice. We're rolling out a critical security update today. You'll receive an email with instructions to install it immediately. Please follow them promptly.' Alice thanks the caller and hangs up, feeling a sense of urgency to comply.

3. Checking the Email

   After the call, Alice opens her email client to check for the promised message. Among her inbox, she notices an email from 'IT Support' with the subject line 'Urgent: Security Update Required.' The email stands out due to its urgent tone, and Alice recalls the phone call, believing it's the legitimate update she was told about.

4. Reading the Email

   Alice opens and reads the email. The email appears professional, and the attachment seems consistent with the phone call. Alice, trusting the source, decides to proceed.

5. Antivirus Warning

   Alice clicks to download the attachment, and 'security_update.exe' appears in her file manager. A brief antivirus warning pops up, suggesting the file might be suspicious. Reassured by the phone call and email's urgency, Alice dismisses the warning, thinking it's a routine update from Nexlify Solutions' IT team.

6. The Ransomware Attack

   As soon as Alice runs the file, her screen flickers, and a menacing message appears: 'All your files have been encrypted. To regain access, pay 1 BTC. Do not attempt to remove this software, or you will lose your files forever.' Alice's heart sinks as she realizes she's fallen victim to a ransomware attack. Her critical work files are now inaccessible, and she feels panic and regret.

7. Resisting the Ransom

   Alice takes a moment to collect herself. She recalls a Nexlify Solutions training session advising against paying ransoms, as it doesn't guarantee file recovery and funds cybercriminals. Determined not to give in to Bob's demands, she decides to follow proper protocol to address the situation.

8. Disconnecting from the Network

   To prevent the ransomware from spreading to other Nexlify Solutions systems, Alice immediately turns off her PC and disconnects it from the network. She knows ransomware can propagate across shared drives, potentially causing more damage. By isolating her device, she limits the attack's impact.

9. Recognizing the Fake Email Address

   Still shaken, Alice uses her second PC and reopens the malicious email to understand what went wrong. She notices the sender's address, 'itsupport@nexlifysolution.com', is slightly off from the legitimate Nexlify Solutions domain, 'itsupport@nexlifysolutions.com'.

10. Internal Support System

    Alice knows she must inform Nexlify Solutions' IT department promptly. She uses the web browser to open the company's internal IT support ticketing system and signs into her account.