ZEKASTRA

Threat profile

Ransomware

Malware that encrypts files and demands payment, often after the attacker has also copied the data.

How it works

Attackers usually get in through phishing, exposed remote-access services or stolen credentials, spend time moving through the network, remove or encrypt backups they can reach, and then encrypt systems at once. Many also threaten to publish copied data, so restoring from a backup does not end the incident by itself.

What to look for

  • Files with changed extensions that no longer open, and a ransom note.
  • Backup jobs failing or backup data suddenly missing.
  • Unusual administrator activity or new accounts shortly before the event.

What reduces the risk

  1. Follow the 3-2-1 idea: three copies, two media, one offline or immutable. Test the restore.
  2. Do not expose remote desktop to the internet; put remote access behind a VPN or gateway with multi-factor authentication.
  3. Patch internet-facing systems quickly and limit administrator rights.
  4. Prepare an incident plan in advance: who decides, who is called, how systems are isolated.

Sources

This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).