Ransomware — How It Works, Notable Incidents, and How to Defend

What gets called "ransomware" actually includes several distinct hostage models.

The economic leverage of ransomware has expanded in stages over 10 years — a steady history of adding new pressure sources to force payment.

The "pay or we leak" model has matured to the point that even organisations that can restore from backup end up paying. This is the economic basis behind Big Game Hunting — the modern enterprise-focused, high-ransom flavour of ransomware.

Modern enterprise-focused ransomware takes days to weeks between initial access and the encryption trigger. The point isn't "encrypt fast, leave fast" — it's to set everything up carefully, then detonate all at once.

"Can't you just compute the key from the ciphertext, the way you crack a password from a hash?" — the answer is "by design of modern cryptography, no". The reason becomes clear when you look at the AES + RSA hybrid construction.

The encrypted file ends up structured as: [ AES-encrypted body ] + [ RSA-encrypted AES key ] + [ file ID / extension ].

The "AES for speed, RSA for key management" hybrid is the legitimate design used across TLS / PGP / SSH — modern encrypted communication in general. Ransomware abuses this correctly-implemented cryptography, which is exactly why "solving" it from the outside is, in principle, not possible.

Realistic decryption paths for victims #

1. Pay the ransom — there's no guarantee the key arrives, but major RaaS groups deliver in most cases to preserve their reputation
2. Law-enforcement takedown of the operators — REvil (FSB 2022) / LockBit (NCA 2024) / ALPHV (FBI 2023) / Hive (FBI 2023) each resulted in seized keys being released
3. Insider leaks — Conti's internal documents and keys all became public after the group declared support for Russia's 2022 invasion of Ukraine
4. Implementation bugs — older ransomware (2014–2017 era) used weak key generation; free decryptors are published on the No More Ransom Project (200+ families)

Attacks on critical infrastructure, healthcare, and government are still hitting in 2024. Colonial Pipeline and Change Healthcare showed society at large what it looks like for a lifeline to be taken out by ransomware, and governments now treat it as a national-security issue.

The last five years of the major Ransomware-as-a-Service operations.

It's been a game of whack-a-mole: take one down and a new brand pops up. Big operations like LockBit's 2024 takedown produce short-term wins, but as long as the key members live in sanction-evading jurisdictions, the underlying structural problem persists.

The FBI, CISA, NCSC, and Europol all consistently recommend don't pay. Reasons:

• It funds the next victim — your ransom becomes the next attack's working capital
• No guarantee the key arrives — newer groups and wiper-disguise attacks may simply not deliver
• You become marked as "an organisation that pays" — and a target for repeat attacks
• OFAC sanctions — in the US, payment to sanctioned groups (North Korea's Lazarus, Russia's Evil Corp, etc.) is illegal

Legislative movement #

• Australia (2024) — critical-infrastructure operators and large companies are required to report ransom payments to the government within 72 hours
• US CIRCIA Act (passed 2022, full effect by 2026) — critical-infrastructure operators must report ransom payments within 24 hours
• Outright ban debate — the US and UK are debating fully banning ransom payments. "Cut off the economic incentive" vs "SMBs can't continue operating" are still at odds
• Insurance industry — Lloyd's of London has excluded "state-sponsored ransom" from coverage since 2023

A realistic decision framework #

1. Can we restore from backup? (yes, if it's immutable / offline)
2. How damaging is the data leak? (under Double Extortion, getting the key still doesn't stop the leak)
3. Is the group on the OFAC sanctions list? (a US entity paying anyway crosses into criminal territory)
4. What's the effect on the industry? (being seen as "an industry that pays" attracts more targeting)

The naive assumption that "if the ransom is in Bitcoin the attacker can't be caught" has been largely demolished by cryptocurrency-tracing firms like Chainalysis / TRM Labs / Elliptic. Bitcoin and Ethereum are public blockchains, meaning every transaction is permanently visible.

Operators try to evade tracing through:

• Mixer / tumbler services — mixing flows across many addresses (though Chainalysis can trace most of them)
• Monero (XMR) — a truly anonymous cryptocurrency; unlike Bitcoin, transaction contents are not public, which is why major RaaS groups have increasingly demanded it from 2022 on
• OFAC sanctions evasion — North Korean groups cash out via DPRK-based exchanges; violators risk being cut out of the international remittance system

The bedrock of ransomware defence is "be able to recover without paying". Four defensive layers:

Practical paths to immutable backups #

• AWS S3 Object Lock — once written, deletion is blocked for a configurable period
• Veeam Hardened Repository — Linux + immutable filesystem
• WORM tape — Write Once Read Many
• Run it under a different domain / different account — outside the reach of any Domain Admin compromise

Detection signals #

EDR rollback features — Microsoft Defender, SentinelOne, and CrowdStrike all record file changes via VSS or their own snapshots, and can roll changes back if encryption hits (within limits).

The No More Ransom Project is a free decryptor collection co-run by Europol, the Dutch police, Kaspersky, and McAfee. In eight years they've published decryption keys for 200+ families and helped over 1.5 million people recover for free. Check this site first.

Ransomware is the post-2010 cybercrime revenue model that exists by "taking a good technology — correctly-implemented cryptography — and using it for bad ends". The 1989 AIDS Trojan is the ancestor; Bitcoin (2009) made payments work; CryptoLocker (2013) was the industrialisation point; and from Single to Double to Triple to Quadruple Extortion, the leverage kept climbing until Big Game Hunting was able to take entire enterprises offline for weeks at a time.

Technically, because it weaponises modern cryptography, decryption is in principle impossible — which forces victims into "pay vs restore from backup". The No More Ransom Project and seized keys from law-enforcement operations have saved some cases, but you cannot expect that for today's major RaaS.

The core of defence is "assume you'll be compromised, and have the recovery capability ready". 3-2-1-1-0 + immutable backups + restore drills are the last line; EDR + network segmentation + Tier-isolated Domain Admin are the second line, where the days-to-weeks between intrusion and detonation can still be used to stop the attack. "Pay or not pay" is no longer just an individual organisation's moral call — it is a society-wide incentive problem, and government regulation plus the shrinking insurance market keep pressing on the side that would pay.