How can ransomware spread through a USB stick or external drive?
In two ways. A drive can carry the malware itself, which runs when someone opens a disguised file, and some malware copies itself onto every drive it finds so that it travels between computers and sites. And a drive that is connected when encryption starts is simply encrypted with everything else, which is why a backup on a permanently attached USB disk does not protect you from ransomware. Disable automatic running of programs from removable media, scan unknown drives on a dedicated computer, allow only company-issued devices where you can, and disconnect backup drives after each run. Spain's INCIBE has published a real case in which ransomware spread as infected devices were connected. A USB transfer does not cross the network, so a network sensor does not see it; NetSenX sees what the infected computer does next, such as scanning or calling an outside server.
Read next
Related questions
- What evidence should we keep for the insurer, the police and the regulator?
- How long does NetSenX keep the network evidence of an incident?
- Should we hire an incident-response firm or handle an incident ourselves?
- How do we tell customers what data was affected in a breach?
- Can network evidence show that a specific customer's data did not leave?