Ransomware #

Ransomware is the umbrella term for malware that "encrypts files and demands payment (a 'ransom') in exchange for the decryption key." Its ancestor is the 1989 AIDS Trojan, but the model only became viable as a business after Bitcoin (launched 2009) enabled anonymous, cross-border payment. CryptoLocker (2013) was the industrialization point, and ransomware has been the largest cybercrime revenue source since. Chainalysis estimates 2024 total ransom payments worldwide exceeded $1.14 billion.

This article continues from the Trojan Horse article, focusing on ransomware as the final payload Trojans deliver. Rather than rehashing malware delivery in general, this piece zeroes in on what's specific to ransomware: the five sub-categories, the staged evolution of multi-extortion, the Big Game Hunting attack chain (SVG 1), why AES + RSA hybrid cryptography is unbreakable without the key (SVG 2), canonical incidents, the rise and fall of major RaaS groups, the "should we pay?" policy debate, cryptocurrency tracing, and realistic defenses. The goal is to assemble the picture by touching each face of "ransomware is a technical, legal, and economic problem all at once" in turn.

1. The five categories — what's being held hostage #

What gets called "ransomware" actually covers multiple distinct hostage models:

The modern mainstream is Crypto ransomware combined with Doxware — encryption plus the threat that "if you don't pay, the stolen data goes public" is now standard. Locker ransomware faded because OS lock screens are bypassable. Wiper-disguised is heavily used in nation-state attacks — NotPetya was a wiper deployed by Russia's GRU disguised as ransomware against Ukraine; it spread worldwide and caused over $10 billion in damage (centered on Maersk / Merck / FedEx TNT).

2. Multi-extortion — Single → Quadruple #

Ransomware's economic leverage has expanded in stages over a decade. The history of how the payment-pressure surface area kept growing:

The most egregious Quadruple Extortion case: in 2023 ALPHV/BlackCat reported MeridianLink directly to the SEC, filing a complaint that the company "failed to disclose the breach within four business days," flanking the victim with administrative risk on top of the cyber damage.

Once the "if you don't pay, we leak the data" model took hold, organizations capable of restoring from backup also started paying. That's the economic backdrop behind the rise of Big Game Hunting — the high-ransom enterprise-targeted ransomware industry.

3. The attack chain — typical Big Game Hunting flow #

Modern enterprise ransomware spends days to weeks preparing between intrusion and detonation. "Encrypt fast and bail" isn't the model; prepare thoroughly and detonate all at once is the essence of Big Game Hunting.

Things to note:

• Days to weeks pass between intrusion and detonation — detecting initial access early can prevent encryption. EDR behavioral detection + a fast-responding SOC earn their value here
• Backup Destruction is built into the chain — Veeam / Commvault / VSS snapshots / backup NAS are deliberately destroyed before encryption. That's why "we have backups, so we're fine" no longer holds
• Exfiltration happens before encryption — Double Extortion ammo gets secured first, then encryption fires. Hundreds of GB of outbound traffic detectable by DLP / NDR is the last line
• Detonation timing skews to nights and weekends — Friday night detonation is common (response stalls until Monday). CISA in 2021 specifically warned about "Holiday Ransomware" targeting major holiday weekends

4. Encryption mechanics — why decryption is impossible without the key #

A common question from victims: "Just like passwords get cracked from hashes, can't you compute the key from the encrypted data?" The answer: "Modern cryptography is mathematically designed to make that impossible." The structure of AES + RSA hybrid encryption explains why.

The two-stage hybrid (speed via AES, public-key management via RSA) is the standard, correct design used in TLS / PGP / SSH and most modern cryptographic protocols. Ransomware exploits this very correctly-implemented cryptography, which is why "breaking" it is, in principle, impossible. The cryptographer's dilemma — "strong crypto helps the good and the bad equally" — appears here directly.

For victims, the realistic decryption paths are limited:

1. Pay the ransom — no guarantee the key arrives, but as a "business," major RaaS mostly do deliver (their next victims won't pay otherwise)
2. Law enforcement compromises the attacker — REvil (2022 Russian FSB), LockBit (2024 NCA), ALPHV (2023 FBI), Hive (2023 FBI) have all had seized RSA private keys made public
3. Internal leak — Conti (2022, when their public support of Russia's invasion of Ukraine prompted a Ukrainian member to leak everything) shows internal feuds can release keys
4. Implementation bugs — older ransomware (some 2014–2017) had weak keygen or storage mistakes; decryption tools live at No More Ransom Project — 200+ tools, free

5. Representative incidents — what changed each time #

The reality is that "attacks on critical infrastructure, healthcare, and government haven't stopped — even in 2024." Colonial Pipeline / Change Healthcare showed the world that "lifelines can be taken offline by ransomware," and governments started treating the issue as a national-security matter.

6. The rise and fall of RaaS groups — knocked down, sprouting again #

Five years of major Ransomware-as-a-Service (RaaS) operators:

"Knock one down, another rises under a new brand" — the whack-a-mole dynamic continues. Major operations like LockBit takedown (2024) produce short-term wins, but core operators residing in sanctions-shielded countries can keep operating — a structural problem.

7. The "should we pay?" policy debate #

FBI / CISA / NCSC (UK) / Europol consistently advise "don't pay." Reasons:

• It funds the next victim — ransom revenue is the attacker's resource for the next attack
• No guarantee the key arrives — major RaaS mostly deliver, but emerging / small-scale / wiper-disguised don't
• You get marked as "an organization that pays" — repeat-target status
• OFAC sanctions — in the US, payments to OFAC-sanctioned groups (North Korea Lazarus, Russia Evil Corp) are illegal; both organizations and individuals face criminal liability

But payment continues in practice. Change Healthcare $22M / Colonial $4.4M / JBS $11M are all publicly known payments. Payment rates vary by region and industry, but Coveware's 2024 data shows 28% of cases paid (down from 76% in 2019, but still substantial).

Legislative momentum:

• Australia (2024) — mandatory reporting of ransom payments by critical infrastructure / large companies within 72 hours
• US CIRCIA Act (signed 2022, full enforcement expected 2026) — 24-hour reporting of ransom payments by critical infrastructure
• Total-ban discussions — the US and UK have ongoing debate over a complete ban. "Cut the economic incentive" advocates vs. "SMBs can't survive otherwise" advocates remain at impasse
• Insurance industry — since 2020, insurance covering ransom payments has been retreating. Lloyd's of London excluded "nation-state-attributed ransom" from coverage from 2023

The realistic decision matrix:

1. Can we restore from backup? ← check first (immutable / offline copies make it possible)
2. How damaging is the leaked data? ← Double extortion means paying doesn't guarantee leaks stop
3. Is the group OFAC-sanctioned? ← US organizations face criminal exposure
4. Industry-level effects ← becoming "an industry that pays" intensifies targeting

8. Cryptocurrency tracing — the "Bitcoin = anonymous" myth #

The naive view that "if attackers demand Bitcoin, they can't be caught" has been largely demolished by crypto-tracing firms like Chainalysis / TRM Labs / Elliptic. Bitcoin / Ethereum are public blockchains = every transaction visible forever, and wallet-to-wallet flows are fully traceable.

Ransomware operators take counter-tracing measures:

• Mixers / tumblers — combine multiple addresses to obscure flows (but Chainalysis's heuristics trace through many of them)
• Monero (XMR) — switched to a truly anonymous cryptocurrency (post-2022); unlike Bitcoin, transaction contents aren't public
• OFAC sanctions evasion — North Korea-linked groups cash out via DPRK exchanges, risking exclusion from the international financial system if caught

"Bitcoin ransom = anonymous and safe" is a 2014 understanding frozen in time. Modern major RaaS shifting to Monero is the corollary of Bitcoin tracing becoming operational.

9. Defense — backup remains the last line #

Ransomware defense's root principle is "build the ability to recover without paying." A four-layer defense:

3-2-1 rule = 3 copies on 2 different media types with 1 offsite. Modernly extended to 3-2-1-1-0: +1 immutable or offline (= cannot be deleted/modified) + 0 errors (regular verification).

Immutable backups are decisive:

• AWS S3 Object Lock — set retention period during which deletion is impossible
• Veeam Hardened Repository — Linux + immutable filesystem
• WORM (Write Once Read Many) tape
• Backup in a separate domain / separate account so Domain Admin permissions don't reach it

EDR rollback — Microsoft Defender / SentinelOne / CrowdStrike track file changes via VSS or proprietary snapshots and can roll back encryption (within limits).

The No More Ransom Project is a free decryption-tool collection jointly run by Europol / Dutch Police / Kaspersky / McAfee. Over 8 years it has published 200+ ransomware decryption keys and helped 1.5+ million people recover for free. Always check this site first.

# Important detection signals on Windows
# vssadmin / wmic attempting shadow-copy deletion (almost always ransomware)
wevtutil qe Security /q:"*[System[EventID=4688]]" /f:text | grep -E "vssadmin|wmic.*shadowcopy"

# On Linux
auditctl -a always,exit -F arch=b64 -S unlink -F path=/backup/

# Detect mass file renames via Sysmon / EDR (thousands on one host briefly = ransomware signal)

Ransomware is the largest cybercrime revenue model since the 2010s, succeeding by "weaponizing well-implemented cryptography — a good technology — for bad ends." Its ancestor is the 1989 AIDS Trojan, Bitcoin (2009) made payment possible, CryptoLocker (2013) was the industrialization point, and the model has since scaled through Single → Double → Triple → Quadruple Extortion to Big Game Hunting that takes enterprises offline for weeks.

Technically, "decryption is mathematically impossible because it abuses correctly-implemented modern cryptography" forces victims into a two-choice corner: pay, or restore from backup. Cases saved by No More Ransom Project keys or law-enforcement seizures exist, but don't expect this against the major modern RaaS.

The defense core is "assume intrusion will happen and ensure recovery." 3-2-1-1-0 + immutable backup + restoration drills is the last line, and EDR + network segmentation + Tier-isolated Domain Admin is the second line that can stop the attack during the days-to-weeks gap between intrusion and detonation. The "pay or don't pay" question isn't an individual ethical decision — it's a society-wide incentive problem, and government regulation plus shrinking insurance coverage keep tightening pressure on the payer side. 2026 may be the year a "ransom payment ban" becomes a realistic possibility — a turning point worth watching.