Ransomware remains an enduring and evolving threat, consistently impacting critical sectors such as healthcare and even electoral processes. Over time, various reports have highlighted the prevalence and adaptability of this malicious software. Instances of ransomware attacks have been a concern for years, with significant increases observed across industries. This ongoing trend underscores the importance of understanding vulnerabilities within organizations to safeguard against potential attacks.
Ransomware is a type of malware that encrypts data and files within an organization’s IT environment or locks users out of their devices, then demands a ransom payment in exchange for restoring access to the computer or the data stored on it. Most ransomware variants work by encrypting valuable files stored on an infected machine using an encryption key known only to the attacker. To reverse the encryption and restore access to their data, victims must pay the ransom to receive that key.
Ransomware has become a prolific malware variant because it is successful and profitable. Ransom demands in the millions of dollars are common, and victims often pay the ransom to gain access to critical data. As a result, ransomware groups have ample funding to attract new talent and improve their tools and techniques.
Over the past few years, ransomware attacks have grown more numerous, sophisticated, and costly to their victims. Protecting against ransomware attacks is vital to an organization’s bottom line and ability to remain in business.
Financial loss is only one impact of ransomware. Obscuration, which occurs when the ransomware installation encrypts the victim’s data, can result in significant business disruption for days, weeks, or months. Aside from the immediate losses, businesses also incur the cost of incident response, digital forensics, regulatory fines, and legal and PR counsel resulting from long-term damage to a company’s reputation. In the healthcare sector, ransomware can even have deadly consequences.
Ransomware is designed to make money for cybercriminals by forcing victims to pay to regain access to their lost data. The way ransomware works is by encrypting data using a key known only to the attackers. With modern encryption algorithms, it is impossible to restore encrypted data without knowledge of the key, so cybercriminals can sell victims the decryption key for their own data.
What ransomware does is gain access to a computer like any other malware. It might be distributed via a phishing email, the attackers may leverage compromised credentials to log in via a VPN, or exploitation of an unpatched vulnerability may allow malware to be planted on a device. Once installed, the ransomware can do its job in a couple of ways:
Regardless of its approach to encryption, the ransomware follows up by presenting a ransom demand to the user. Often this appears as a text file saved alongside encrypted files or a changed background image. The ransom demand includes the amount of cryptocurrency to be paid, where and how to pay the ransom, and potentially information for “customer support”.
Many ransomware variants exist, and different ransomware groups use different techniques to extort their victims. Ransomware operators are increasingly supplementing their attacks with data theft or the threat of distributed denial of service (DDoS) attacks. By threatening to leak sensitive information, perform a DDoS attack, or directly extorting a victim’s customers, the attacker increases their leverage and the probability of receiving a ransom payment.
Some ransomware groups also operate under an “affiliate” model where a ransomware developer distributes their malware to affiliates who infect victims’ machines with it. Under this model, profits are shared between the ransomware developer and the affiliates. This model enables ransomware operators to have their malware distributed to more targets, increasing overall ransom payments.
The modern ransomware attack is highly targeted. Ransomware groups carefully research potential targets to determine how to infect them and the maximum ransom that they can demand with an expectation of being paid.
While any organization can be a target of ransomware, certain organizations are more tempting targets than others. In addition to the ability to pay large ransoms, ransomware operators commonly target organizations that are more likely to pay the ransom quickly. For example, hospitals need access to their data to treat patients, so they have a greater incentive to pay a ransom demand quickly.
Ransomware groups’ tactics and targets change over time, and they benefit from the fact that it is difficult to attribute cyberattacks and pursue legal action against attackers. While a ransom note may state which group is behind an attack, the identity of the group’s members and their affiliates is hard to determine.
The answer comes down to money and time. Ransomware attacks are significantly faster and cheaper to carry out compared to many other cyber models and have a much higher payout. Take a banking trojan operation for example.
Before ransomware, banking trojans were the most common form of malware. The banking trojan business model is extremely complex and requires many people to play many roles. This scheme of money laundering limits profit because they have to split the earnings with everyone else involved in the cash-out. The business model that ransomware follows has several benefits over banking trojans and other forms of malware:
The rewards speak for themselves. The Verizon 2021 Data Breach Investigations Report found that the median ransom paid in 2020 was $11,150 but ran as high as $1.2 million. With such a great potential to earn money, so-called “ransomware gangs” have become more organized. Many of their members have different roles and specialize in specific ransomware attack methods, which helps these groups maximize their potential gains.
Ransomware attacks are a growing threat for a few reasons, including malware availability, cross-platform technological advancement and new effective techniques the generate profit for ransomware groups:
Ransom can come in several varieties that pose different levels of risk to an infected computer. These range from scareware, which is primarily a scam, to encrypting ransomware, which carries the risk of permanent data loss, and screen lockers.
Scareware is a form of ransomware designed to intimidate the target into taking some action. Typically, this involves locking the screen or putting up pop-ups claiming that a virus has been detected on the computer. This message will include instructions for contacting a “help desk,” which promises to fix the problem for a fee. While the offer to help clean up the virus is a scam, the computer does need to be checked and cleaned of the malware that creates the pop-up.
Screen locking ransomware will lock the screen, keyboard, and mouse on a computer, making it impossible to use. This type of ransomware commonly comes with a pop-up demanding a ransom payment and showing a countdown clock designed to create a sense of urgency. While this type of ransomware is more inconvenient than scareware, it is less dangerous than encrypting ransomware. This ransomware variant does not usually encrypt files, reducing the probability of data loss.
Encrypting ransomware is what most people think of when they hear ransomware. Encrypting ransomware will encrypt files or the MBR on a victim’s computer and demand a ransom payment in exchange for the decryption key. This is the most dangerous type of ransomware because there is the potential that data may be lost forever whether or not the target decides to pay the ransom.
Within these types of ransomware, there are a handful of primary pathways that cyber criminals use to deliver the ransomware. Learn more about the 7 most common ransomware attack vectors here.
Many different ransomware variants exist, and new ones are discovered on a regular basis. However, some variants stand out from the crowd due to the scope and impact of their attack:
These ransomware examples indicate just how important it is to pay attention to how your organization could be vulnerable. Not every example of ransomware is financially motivated — some are primarily intended to cause an operational disruption on a network. Below, are seven real-life ransomware examples that are regularly used — and extremely dangerous.
While some cyber criminals make and distribute their ransomware, some have begun to provide a software package—complete with ransom note customization—to other cybercriminals for a fee.
Interestingly, some of the biggest ransomware examples are believed to be motivated by operational disruption or systemic harm, not financial gain. Two recent attacks used a single Bitcoin wallet to collect ransom, placing greater emphasis on the disruption itself rather than payment collection. This tactic also makes it impossible for the distributor to know which victims paid the requested ransom.
NotPetya also impacted the bottom line of some large companies, even though it wasn’t a financially motivated ransomware example. According to this Insurance Journal article, “Package delivery company FedEx Corp. said a [NotPetya] attack on its Dutch unit slashed $300 million from its quarterly profit, and the company lowered its full-year earnings forecast. The company said the cyber attack slashed 79 cents per share from its profit.”
The following examples show the pervasive and potentially catastrophic risk that organizations in almost every industry must address:
One of the most costly and disruptive incidents of recent times is the Colonial Pipeline ransomware attack. Believed to be the largest-ever attack on an American energy system, hackers disrupted fuel supply across the East Coast for days until a $4.4 million ransom was paid (although the Department of Justice later seized the funds).
The attack was attributed to DarkSide, a relatively new RaaS group first discovered in August 2020. According to CISA, DarkSide explicitly targets large, high-revenue organizations, stating that their goal “is to make money [not create] problems for society.” The group’s ransom requests range from $200,000 to $2,000,000 – although history has shown that they are open to negotiation! In addition to the pipeline attack, DarkSide recently announced three more victims, including a Scottish construction company, a renewable energy product reseller in Brazil, and a technology services reseller in the U.S. The hackers stole client, employee, and financial data.
Bitsight research suggests that similar attacks in the U.S. are likely: after reviewing the cybersecurity performance data of more than 2,000 U.S.-based oil and energy companies, we found that 62% are at heightened risk of a ransomware attack.
Another vulnerable and lucrative target for hackers is healthcare. Since 2009, there have been over 3,000 healthcare data breaches in the U.S. medical industry. Notable incidents in recent years include NotPetya attacks against drugmaker Merck and Heritage Valley Health Systems (both in 2017), the latter resulting in postponed surgeries. In September 2020, major healthcare provider Universal Health Services experienced a ransomware attack resulting in widespread computer systems failures. And, in May 2021, Ireland’s health service suffered a ransomware attack forcing a shutdown within its IT infrastructure.
Hackers also have the public sector and education institutions in their sights. In 2020, 33% of cyberattacks on government agencies were ransomware, disrupting missions and public services and creating a national security risk. Schools are also fast becoming a leading target.
Supply chains are an emerging trend as a vehicle for ransomware. In July 2021, the REvil ransomware group attacked Kaseya, a Florida-based software provider of a widely used remote management monitoring solution. The attack impacted Kaseya, its customers, and companies who outsource IT management to Kaseya. Hackers requested $70 million in payment.
These sectors are not alone. Manufacturing companies, financial services, retailers, and others are also vulnerable to the mounting ransomware threat.
If your organization is infected with a ransomware attack, the immediate question is usually “Should we pay?” We — along with the No More Ransom Project and various governmental agencies — do not recommend paying the ransom. This simply confirms the ransomware business model and encourages the cycle to continue.
Paying the ransom may seem like the easiest solution to a ransomware attack and this is exactly what ransomware groups want their victims to think. However, there are several reasons why paying the ransom can only make things worse. Besides funding criminal activity, you may not get a description key to get your data back, or even put a target on your back that might lead to more demands for ransom.
After reviewing the different types and examples of ransomware, read more about best practices on how to prevent and protect your organization from ransomware attacks.
Law enforcement has had a difficult time fighting ransomware because of the sheer volume of ransomware examples in operation, and the fact that the operations themselves are difficult to track. The No More Ransom Project — founded in 2016 by the Dutch Police, Europol EC3, Kaspersky, and McAfee, and in partnership with over 100 other organizations worldwide—has helped decrypt tens of thousands of devices and is also helping to educate individuals and organizations about ransomware.
The attack surface is expanding as AI becomes more embedded in enterprise and attacker workflows. Get the full picture on AI exposure, exploit pressure, and the underground trends security teams need to watch.
