Ransomware demonstration: How ransomware infects a system

Infosec Principal Security Researcher Keatron Evans shows how a ransomware attack works in this ransomware demo.

0:00 - How ransomware attacks work
0:28 - Running a ransomware exploit
1:35 - Finding and encrypting data
2:50 - How ransomware affects the victim
4:40 - How did the ransomware actor gain access?
6:29 - How the attacker can decrypt the data
7:58 - Share how ransomware works

About Infosec

[hugon]

Very well explained demonstrated and everything! Congrats!

[paulperkins]

To prevent access your external connectivity needs to be tightened up to stop direct access to your internal network. The exploit used in this demo pulled the logged in administrator access key from the system memory. Disable default administrator accounts, setup non standard named accounts. But above all prevent ingress to your network

[fwiii]

Hey, I have a question: How can it be that a ransomware 1. prevents me from getting rid of it after I re-installed windows and 2. locks all external hard drives ?

Can you give an answer to both questions?

[michelebullock]

If the key is how did they get into the environment, how do you secure against that?

[johnlysic]

Very helpful background info - I assume backup, backup, backup is the key to getting around these nasty hackers if/when they strike

[charliegirlify]

What's to keep the cyber thief from doing this to you all over again? *AFTER* you've already paid the "ransom" once?