39.3 Ransomware Deep Dive – Raja-Rani Traders
Encryptor ransomware: files encrypted, ransom note asks for payment (often crypto). Locker: locks desktop/UI more than deep crypto (still bad). Double extortion: steal data first, then encrypt – "pay or we leak". Sometimes triple (DDoS / call customers) – public reporting describes variants; exact names change fast.
Fictional Raja-Rani Traders, Kolhapur/Nashik style SMB: 1 file server, 15 PCs, accounts Zoya, sales Salman, owner Rani. Backup = same disk shelf as server → ransomware sobat encrypt. Classic mistake.
Blue recovery pillars:
- 3-2-1 idea: multiple copies, different media, one offsite / offline / immutable
- Test restore monthly (backup that never restored = hope, not plan)
- Immutable / object-lock style storage where budget allows (cloud or appliance)
- Least privilege so one user session cannot encrypt every share
- Isolate first (pull cable / disable switch port), then IR – do not power-wash without evidence plan
Payment advice in class: never teach "how to pay"; teach restore + report. Law/insurance/CERT guidance varies – verify with counsel; CEH exam modules stress prevention and response mindset.
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Phish → foothold → domain/local admin → encrypt shares + delete shadows | EDR ransomware behaviour (mass file rename/encrypt); Protected folders; VSS protections; least privilege |
| Steals files before encrypt (double extortion) | DLP egress alerts; unusual archive+upload; MFA; segment file servers |
| Targets backups on same network share | Offline / immutable backups; separate backup admin account; restore drills |
Ravindra Bagale's Tip
Students "backup aahe" mhantat – restore kadhi try kela? Interview madhe bola: last successful restore date, offline copy, who has backup admin rights. Raja-Rani example: Rani weekly USB home nete – USB pan encrypt hoil jar machine infected asel tevha plug kela. Offline copy = machine band asatana liha.
Lab
Lab Windows VM (snapshot aadhi): folder C:\lab_docs with 5 dummy .txt. Write a benign PowerShell that only creates README_RESTORE_DRILL.txt (fake note text) – no encryption API, no file wipe. Document: "This is a marker, not ransomware." Mag Defender on kara, Controlled folder access try kara, re-run – blocked/alert? Notes liha. Real encryptor kadhi nako.
Real incident: Colonial Pipeline ransomware (2021)
Public reporting described a ransomware incident affecting Colonial Pipeline that led to operational shutdown decisions and wide news coverage; recovery involved IR firms and law enforcement engagement (reported). Weakness theme often discussed publicly: VPN/account access paths and the business impact of ransomware beyond pure IT. Defence mindset: MFA everywhere remote, segment OT/IT, tested backups, IR retainers. Source: CISA / company public statements and major news (verify; do not invent loss figures).