Cybersecurity
Updated 11 days ago | GitHub

Ransomware

Ransomware is malware which restricts access to a computer and demands money to remove the restriction. It can be distributed via email, phishing links, or drive-by download.

Early examples of ransomware would lock up an operating system and display a message demanding money to regain use of the computer. They were a nuisance but not particularly effective.

“Your computer contains illegal software and pornography. Authorities will be contacted unless you pay a fine.”

Recent versions of ransomware are more potent. They use strong encryption algorithms to encrypt certain file types. The files may include local, shared, and networked drives, including files on cloud servers like Dropbox. Then the malware demands that the user pay to receive the password necessary to decrypt them.

“All files on your computer have been encrypted. You must pay a ransom within 72 hours to regain access to your data.”

Consumer-era campaigns of the mid-2010s typically demanded a few hundred dollars, payable in bitcoin, cash vouchers, or gift cards that were difficult to trace. Contemporary enterprise-targeted ransomware demands are dramatically larger and denominated almost exclusively in cryptocurrency — Chainalysis’s on-chain analysis tracked roughly $813 million in ransom payments during 2024, with individual confirmed payments reaching eight figures (for example, UnitedHealth’s $22 million payment to BlackCat/ALPHV after the 2024 Change Healthcare intrusion, which the affiliate later disputed and which preceded the group’s likely exit-scam shutdown). Paying the ransom may or may not decrypt the files, and even when a working key is delivered the underlying malware, stolen data, and network backdoors can remain.

Ransomware grew rapidly in the mid-2010s. From 2013-2015 the share of new malware that consisted of new ransomware variants grew significantly each year (2013: 20%, 2014: 40%, 2015: 60%), and 2016 was dubbed “the year of ransomware”. According to one analysis, in early 2016 93% of phishing emails were pushing ransomware, while at the same time phishing had increased 789%. Ransomware has remained one of the most disruptive categories of cybercrime in the years since, with high-impact incidents like WannaCry (2017), NotPetya (2017), the Colonial Pipeline attack (2021), Kaseya/REvil (2021), and zero-day mass-exploitation campaigns by Cl0p against managed-file-transfer software (Accellion FTA, GoAnywhere MFT, and MOVEit). Two prominent gangs were disrupted in early 2024: LockBit’s infrastructure was seized in Operation Cronos, a February 2024 international law-enforcement action, and BlackCat/ALPHV shut down in March 2024 in the aftermath of the Change Healthcare ransomware attack.

Attackers have shifted decisively toward businesses and public-sector organisations, whose operational and reputational stakes make them more willing and financially able to pay than individual home users. Verizon’s 2026 Data Breach Investigations Report finds ransomware present in 48% of analysed breaches (up from 44% in the previous year’s report), with a median paid ransom of $139,875 (down from $150,000 in the previous year’s reporting dataset) and 69% of victim organisations refusing to pay at all. Of the ransomware cases where organisation size was known, roughly 96% of victims were small- and medium-sized businesses. Most modern strains are run as ransomware-as-a-service (RaaS): core operators develop the malware and run the leak site while affiliates carry out intrusions in exchange for a share of each ransom. Many now employ a double-extortion model, in which stolen data is threatened for public release even if the victim can restore encrypted files from backups.

Biggest Names in Ransomware

Consumer era (2013–2016)

  • CryptoLocker
  • CryptoWall
  • TorrentLocker
  • CTB Locker
  • TeslaCrypt
  • Ransom32
  • Locky
  • Chimera

Enterprise era (2015–present)

  • MSIL/Samas — commonly known as SamSam; first deployed in December 2015 and active through 2018, one of the earliest human-operated, target-selected ransomware families. Operators exploited vulnerable JBoss servers and brute-forced RDP access to pick specific victims before manually deploying ransomware, extorting more than 200 organisations including the City of Atlanta in March 2018 and multiple US hospital systems; two Iranian nationals were indicted in November 2018.
  • Cl0p — Russian-speaking gang first observed in February 2019; ran mass-exploitation campaigns against managed-file-transfer platforms (Accellion FTA in late 2020, GoAnywhere MFT in early 2023, and MOVEit Transfer in mid-2023) and has increasingly shifted to “encryption-less” data-theft extortion.
  • LockBit — an affiliate-based RaaS platform that appeared on Russian-language cybercrime forums in January 2020; its darknet infrastructure and roughly 2,200 BTC in seized wallets were taken offline in February 2024 by the international Operation Cronos action, though a LockBit 5.0 variant was still surfacing in 2025.
  • BlackCat/ALPHV — Rust-based RaaS active from November 2021 through March 2024; responsible for the 2024 Change Healthcare attack and the $22 million payment that immediately preceded its exit-scam shutdown.
  • RansomHub — emerged in February 2024 and, per Chainalysis’s 2024 review, quickly rose to the highest claimed-victim count of any active strain.
  • Akira — one of the top-earning strains of 2024 and the only major operation Chainalysis observed increasing activity in the second half of that year.

Ransomware Preventions

The best prevention is to backup computer files regularly and to back them up to offline media. (The MSIL/Samas Ransomware deletes any backup files it finds.) This will not prevent a ransomware infection, but it will greatly minimize the damage.

Ransomware is primarily delivered via drive-by downloads and phishing emails, so standard precautions against those is a good prevention against ransomware. Email spam filtering can prevent phishing emails from arriving and users should ignore or block email attachments from suspicious sources. Disable macros for email attachments. Some are documents which, when opened, will ask the user to “Enable Editing”.

Application whitelisting is a good way to block malware which is becoming increasingly popular. The only software which can run is software which has been granted explicit permission to run.

Another prevention is to block TOR traffic if possible. Ransomware frequently uses TOR to communicate between the infected computer and a command and control server.