Ransomware

Introduction

Ransomware is a category of malware that denies victims access to their data or systems and demands a ransom payment -- typically in cryptocurrency -- for restoration. It has evolved from a curiosity into the single most financially destructive form of cybercrime. The FBI's Internet Crime Complaint Center (IC3) received over 2,825 ransomware complaints in 2023 alone, with adjusted losses exceeding $59.6 million, and these figures represent only a fraction of actual incidents since many go unreported.

Ransomware attacks have shut down hospitals, disrupted fuel pipelines, crippled city governments, and paralyzed global shipping operations. The evolution from opportunistic attacks against individuals to targeted campaigns against large organizations has transformed ransomware into a multi-billion-dollar criminal industry, complete with customer support, affiliate programs, and corporate-style organizational structures.

"Ransomware is more disruptive than other forms of cybercrime because it directly impacts the availability of critical data and systems. It is not just a data security problem -- it is an operational continuity crisis." -- Jen Easterly, Director of CISA

History and Evolution

Early Ransomware (1989-2012)

The first known ransomware was the AIDS Trojan (also called PC Cyborg), created by biologist Joseph Popp and distributed on floppy disks at the 1989 WHO AIDS conference. After 90 reboots, it hid directories and encrypted file names, demanding $189 be sent to a PO box in Panama. Its symmetric encryption was easily broken, but it established the extortion model that would persist for decades.

For nearly two decades, ransomware remained rare due to the difficulty of collecting payments anonymously. The emergence of digital currencies and prepaid voucher systems in the late 2000s changed this. Police-themed ransomware (Reveton, 2012) displayed fake law enforcement warnings claiming the user had viewed illegal content, demanding payment through untraceable vouchers like MoneyPak or Ukash.

The Crypto-Ransomware Era (2013-2016)

CryptoLocker (September 2013) marked a turning point. It was the first widespread ransomware to use strong asymmetric encryption (2048-bit RSA) and demand payment in Bitcoin. Each victim's files were encrypted with a unique AES key, which was itself encrypted with the attacker's RSA public key. Without the private key held on the attacker's server, decryption was mathematically impossible. CryptoLocker infected an estimated 250,000 systems and collected approximately $3 million before the Gameover ZeuS botnet that distributed it was taken down in 2014.

The Modern Era (2017-Present)

The modern ransomware era began with two devastating attacks in 2017. WannaCry (May 2017) combined ransomware with a worm-like propagation mechanism using the EternalBlue exploit (an NSA tool leaked by the Shadow Brokers). It spread across 150 countries in hours, infecting over 200,000 systems including the UK's National Health Service. NotPetya (June 2017), initially disguised as ransomware, was actually a destructive wiper deployed by Russian military intelligence (GRU) against Ukraine that spread globally, causing over $10 billion in damage -- the most destructive cyberattack in history.

How Ransomware Works

Encryption Mechanisms

Modern ransomware uses a hybrid encryption scheme that combines the speed of symmetric encryption with the key management advantages of asymmetric encryption:

1. The ransomware generates a unique AES-256 symmetric key for each victim (or sometimes per file)
2. Files are encrypted using this AES key at high speed
3. The AES key is then encrypted with the attacker's RSA-2048 or RSA-4096 public key
4. The encrypted AES key is stored locally or transmitted to the C2 server
5. Only the attacker's RSA private key can decrypt the AES key, which is needed to decrypt the files

Some ransomware families use Elliptic Curve Cryptography (ECC) instead of RSA for key exchange, and ChaCha20 or Salsa20 instead of AES for file encryption, as these stream ciphers can be faster on systems without AES hardware acceleration.

Infection Vectors

Ransomware reaches its targets through multiple vectors:

• Phishing emails: Malicious attachments (Office documents with macros, PDFs, ZIP files) or links to exploit kits remain the most common initial vector
• Remote Desktop Protocol (RDP): Brute-forcing or credential-stuffing exposed RDP services is a primary vector for targeted attacks. Shodan indexes millions of exposed RDP endpoints
• Exploitation of vulnerabilities: Unpatched VPN appliances (Pulse Secure, Fortinet), web servers, and edge devices provide initial access
• Supply chain compromise: The Kaseya VSA attack by REvil (2021) infected managed service providers, cascading to over 1,500 downstream businesses
• Access brokers: Criminal actors specialize in gaining initial access to networks and selling that access to ransomware operators

Notable Ransomware Attacks

Ransomware-as-a-Service (RaaS)

The Ransomware-as-a-Service model has industrialized ransomware operations. RaaS operators develop and maintain the ransomware payload, negotiation infrastructure, and payment systems. They recruit affiliates who conduct the actual intrusions and deploy the ransomware. Revenue is split between the operator and the affiliate, typically 20-30% to the operator and 70-80% to the affiliate.

This division of labor means that technically sophisticated developers do not need to conduct intrusions, while skilled penetration testers do not need to write malware. The result is a highly efficient criminal ecosystem where each party specializes in their core competency.

"The ransomware ecosystem has evolved into a mature criminal economy with its own supply chains, specialist roles, and market dynamics. It mirrors legitimate software businesses in structure, if not in legality." -- Dmitri Alperovitch, co-founder of CrowdStrike

Major RaaS operations have included LockBit (the most prolific ransomware group of 2022-2023), BlackCat/ALPHV, Conti (dissolved in 2022), REvil/Sodinokibi, DarkSide, and Hive (disrupted by FBI in 2023). These groups maintain darknet leak sites, offer victim negotiation services, and even provide "customer support" to help victims purchase cryptocurrency and navigate the payment process.

Double and Triple Extortion

Beginning with the Maze ransomware group in late 2019, attackers began exfiltrating data before encrypting it. This "double extortion" approach means that even victims with robust backups face pressure to pay -- the threat of public data exposure can be as damaging as data loss, particularly for organizations handling sensitive personal, financial, or medical information.

Triple extortion adds a third pressure vector: DDoS attacks against the victim's infrastructure, direct threats to the victim's customers or partners, or reporting the victim to regulatory authorities for data breaches. Some groups have contacted journalists, business partners, and even the victim's clients directly to increase pressure.

By 2024, data exfiltration occurred in over 80% of ransomware incidents, making it the norm rather than the exception. Some groups, like Cl0p, have moved entirely to data theft without encryption, recognizing that the threat of exposure alone is sufficient leverage.

Defense Strategies

Defending against ransomware requires a layered approach spanning prevention, detection, and recovery:

• Backups: Maintain offline, immutable backups following the 3-2-1 rule (3 copies, 2 different media types, 1 offsite). Test restoration procedures regularly. Air-gapped backups cannot be encrypted by ransomware.
• Patch Management: Rapidly patch known vulnerabilities, especially in internet-facing systems (VPNs, firewalls, email gateways). Most ransomware exploits known, patched vulnerabilities.
• Email Security: Deploy email filtering, sandboxing, and DMARC/DKIM/SPF authentication. Disable Office macros by default via Group Policy.
• Network Segmentation: Limit lateral movement by segmenting networks and restricting inter-segment access. Microsegmentation prevents ransomware from spreading across the entire environment.
• Endpoint Detection and Response (EDR): Deploy EDR solutions that can detect and block ransomware behavior patterns (mass file encryption, shadow copy deletion, privilege escalation).
• Least Privilege: Limit user and service account permissions. Disable unnecessary administrative access. Implement privileged access management (PAM).
• RDP Hardening: Disable RDP where unnecessary. Require MFA for remote access. Use VPNs or zero-trust network access (ZTNA) instead of exposing RDP directly.
• Incident Response Planning: Develop, document, and rehearse ransomware-specific incident response procedures before an attack occurs.

Incident Response

When ransomware is detected, a structured response is critical. The following framework outlines the key phases:

1. Containment: Immediately isolate affected systems from the network to prevent further spread. Disconnect (do not power off) infected machines to preserve forensic evidence and memory artifacts.
2. Assessment: Determine the scope of the infection, the ransomware variant (check the ransom note, encrypted file extensions, and resources like ID Ransomware), and whether data exfiltration occurred.
3. Notification: Engage legal counsel, notify law enforcement (FBI, CISA, local authorities), activate cyber insurance, and assess regulatory notification requirements (GDPR, HIPAA, state breach notification laws).
4. Eradication: Identify and close the initial access vector. Remove all malware, persistence mechanisms, and attacker tools from the environment. Reset all credentials, as the attacker likely has broad access.
5. Recovery: Restore systems from clean backups. Rebuild systems that cannot be verified as clean. Check for decryptors at nomoreransom.org before considering payment.
6. Lessons Learned: Conduct a thorough post-incident review. Document findings, improve defenses, and update incident response procedures.

For more on the tools and techniques used to analyze ransomware samples, see malware analysis. Understanding the underlying malware types helps inform defense strategies -- see trojans and worms.

The Payment Debate

Whether to pay a ransom is one of the most contentious questions in cybersecurity. Law enforcement agencies universally advise against payment, arguing that it funds criminal operations and encourages future attacks. However, for organizations facing existential threats -- hospitals unable to access patient records, businesses unable to operate -- the calculus is more complex.

Research from Coveware shows that in 2023, the average ransom payment was approximately $740,000, though this varies enormously by victim size and industry. Critically, paying does not guarantee full data recovery: approximately 80% of paying victims receive a working decryptor, but on average it only recovers 65% of encrypted data. Furthermore, 80% of organizations that pay are attacked again, often by the same group.

Several governments have considered or implemented bans on ransom payments, and the US Treasury's Office of Foreign Assets Control (OFAC) has warned that paying ransoms to sanctioned entities can result in civil penalties, adding legal risk to an already fraught decision.

References

• Savage, K., Coogan, P., & Lau, H. (2015). "The Evolution of Ransomware." Symantec Security Response.
• US-CERT. (2017). "Alert TA17-132A: Indicators Associated with WannaCry Ransomware." CISA.
• Greenberg, A. (2019). Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers. Doubleday.
• FBI Internet Crime Complaint Center. (2024). "Internet Crime Report 2023." Federal Bureau of Investigation.
• CISA. (2023). "#StopRansomware Guide." Cybersecurity and Infrastructure Security Agency.
• Coveware. (2024). "Quarterly Ransomware Report." Coveware by Veeam.
• Europol. (2023). "Internet Organised Crime Threat Assessment (IOCTA)." European Union Agency for Law Enforcement Cooperation.
• No More Ransom Project. https://www.nomoreransom.org/
• MITRE ATT&CK. "Ransomware Techniques." https://attack.mitre.org/
• Mandiant. (2024). "M-Trends 2024 Report." Google Cloud.