What Is Ransomware?
Ransomware is malware that encrypts files or locks systems and demands payment — typically in cryptocurrency — for the decryption key. Modern ransomware operations have evolved into sophisticated criminal enterprises that combine encryption with data theft for maximum pressure.
Ransomware Evolution
| Era | Approach | Example | |---|---|---| | Early (2013-2017) | Mass spray, low ransoms | CryptoLocker, WannaCry | | Big Game Hunting (2018-2021) | Target large orgs, high ransoms | Ryuk, REvil, DarkSide | | Double Extortion (2020+) | Encrypt + steal data | LockBit, BlackCat, Cl0p | | Triple Extortion (2021+) | Encrypt + steal + DDoS/threaten customers | Various groups | | RaaS (ongoing) | Ransomware-as-a-Service platforms | LockBit, BlackBasta |
Common Ransomware Attack Chain
- Initial Access: Phishing email, exploited vulnerability, compromised credentials, or RDP brute force
- Persistence: Install backdoors, create accounts
- Discovery: Map the network, identify critical systems and data
- Lateral Movement: Move to additional systems using stolen credentials
- Data Exfiltration: Steal sensitive data before encryption (for double extortion)
- Impact: Deploy ransomware across all accessible systems simultaneously
Ransomware Defense Strategy
Prevention
- Email security: Block phishing and malicious attachments
- Patch management: Eliminate exploitable vulnerabilities
- MFA everywhere: Prevent credential-based access
- Network segmentation: Limit lateral movement
- Least privilege: Minimize blast radius of compromised accounts
Detection
- EDR/XDR: Detect ransomware behavior (mass file encryption, shadow copy deletion)
- SIEM: Correlate indicators across the environment
- Network monitoring: Detect unusual data exfiltration
Response
- Incident response plan: Documented, tested procedures specific to ransomware
- Backup strategy: Offline/immutable backups tested regularly
- Containment playbooks: Automated isolation of infected systems
- Legal counsel: Prepared for negotiation, disclosure, and regulatory reporting
To Pay or Not to Pay?
Most security experts and law enforcement agencies recommend against paying ransoms because:
- Payment doesn't guarantee data recovery
- Payment funds future attacks
- Paying makes you a target for repeat attacks
- Some jurisdictions restrict ransom payments to sanctioned entities
However, each situation is unique and should involve legal counsel, cyber insurance, and senior leadership.