Ransomware:
Understanding and Defeating Digital Extortion

Created by biologist Joseph Popp, the AIDS Trojan (also called PC Cyborg) used simple symmetric cryptography to hide file names and demand payment. The encryption was weak enough to reverse, but the concept of holding data hostage for payment was born. It would take over two decades for the model to become commercially viable for criminals.

Reveton pioneered the affiliate distribution model that would later define the ransomware economy. Operators provided the malware and infrastructure while affiliates handled distribution, splitting profits. The social engineering component -- fake FBI or Interpol warnings -- exploited fear and shame to drive payment without actually encrypting files.

CryptoLocker represented a fundamental shift: strong asymmetric encryption meant victims could no longer reverse-engineer the decryption key. Combined with Bitcoin for anonymous payment, it created a reliable criminal revenue model. The Gameover ZeuS botnet provided the distribution infrastructure, reaching hundreds of thousands of victims before law enforcement disruption.

Instead of casting wide nets for small ransoms, groups like Ryuk and SamSam began researching targets, identifying organizations with high revenue and low security maturity. Attackers spent weeks inside networks, mapping infrastructure, escalating privileges, and positioning for maximum impact before deploying encryption. Ransom demands jumped from hundreds to millions of dollars.

Double extortion eliminated the backup defense. Even organizations with perfect backup strategies faced public data exposure, regulatory penalties, and reputational damage. Maze created the first dedicated leak site to publish victim data, and the tactic was immediately adopted across the ransomware ecosystem. It fundamentally changed the calculus of whether to pay.

Modern ransomware operations use supply chain compromises to reach hundreds of victims simultaneously. Some groups have abandoned encryption entirely, relying solely on data theft and extortion threats. Zero-day exploits provide initial access before patches are available. Criminal organizations maintain HR departments, bug bounty programs, and customer service portals for ransom negotiations.

Phishing remains the most common delivery mechanism, but RDP brute-force and exploitation of unpatched vulnerabilities (especially VPNs and edge devices) are increasingly used. Initial Access Brokers (IABs) sell pre-established footholds into corporate networks, allowing ransomware affiliates to skip this step entirely.

Attackers install remote access trojans (RATs), create new privileged accounts, and establish encrypted C2 communications. Persistence mechanisms include scheduled tasks, registry modifications, and deployment of legitimate remote management tools (e.g., AnyDesk, TeamViewer) to blend with normal IT operations.

Attackers use tools like Mimikatz for credential dumping, BloodHound for Active Directory mapping, and legitimate admin tools for reconnaissance. Lateral movement through RDP and SMB connections allows access to file servers, database servers, and backup infrastructure. Domain controller compromise provides the keys to the entire environment.

Attackers identify and exfiltrate high-value data: financial records, customer PII, intellectual property, legal documents, and healthcare records. Data is typically staged in a central location, compressed, and exfiltrated via cloud storage services, FTP, or custom tools. This stage can take days to weeks depending on data volume.

Before encryption begins, attackers delete Volume Shadow Copies (vssadmin delete shadows), disable Windows Recovery, and target backup servers and NAS devices. Encryption is then deployed simultaneously across all compromised endpoints, often during off-hours or weekends. Ransom notes provide instructions for Tor-based communication and cryptocurrency payment.

Modern ransomware groups operate professional negotiation portals. They may offer discounts for quick payment, provide proof-of-life decryption of sample files, and set deadlines before publishing data. Some groups contact journalists, customers, or regulators directly to increase pressure. Payment is typically demanded in cryptocurrency, with amounts adjusted based on the victim's perceived revenue.