This report explores ransomware, including what it is, its different types, common attack methods, and the impact it can have on organizations. It also discusses a real-world ransomware incident and ways companies can reduce this risk. This artifact demonstrates my ability to research a cybersecurity topic and organize information in a way that general readers can understand.
What is Ransomware
People have prioritized making money for a long time. In this day with the constant improvements of technology there have been a rise in ways to use this technology to make money. The problem arises where people will make their money legally, there will also be those who will abuse this technology to make their money illegally. With the fast improvement of computers and the heavy reliance on them for day-to-day people to complete their tasks, there are bad actors out there who have found vulnerabilities and used exploits for their own monetary gain. One of the techniques bad actors will use is through the use of ransomware, a form of malware that can attack individuals and target large companies for potentially millions in damages. This has brought concerns about how companies can protect themselves from these attacks and prevent and mitigate the damage that can come.
Ransomware is a kind of malware, where malware is a harmful piece of code or software that is meant to do damage to a network or computer system. Ransomware is more focused towards monetary gain; the goal of ransomware is to restrict access to a computer or data until they pay a ransom to regain access from the hacker. Ransomware can restrict access to important files one may need or just restrict access to the whole computer by encrypting the data on the file or locking the user out of the computer.
Ransomware can spread through a variety of methods. Two popular methods used for spreading ransomware are from “phishing emails that contain malicious attachments or through drive-by-downloading”, where clicking a link in an email will download the ransomware onto the system (“Ransomware”). Drive by downloading instead of being through email infects the users when they “unknowingly visits an infected website and then malware is downloaded and installed without the user’s knowledge” (“Ransomware”). Some ransomwares once they infect a system will go on to try spread the malware and infect other systems itself known as self-propagating. The more recent versions of ransomware are more complex and can do “self-propagating mechanisms that allow for lateral movement to other devices connected to the network” (Baker). Ransomware can also be spread as a service, ransomware as a service allows people to buy ransomware tools online to do their own attacks. With this bad actors who have developed effective codes can sell the software online “putting ransomware within the reach of non-technically savvy criminals” who can also deploy attacks for their own gain (Baker).
There are two types of ransomwares, locker ransomware and crypto ransomware. Locker ransomware works by locking access from a computer, this method works by “locking the computer’s or device’s user interface” until the hacker is paid to regain access (Savage 6). Locker ransomware limits the use of the computer interface although “leaving the underlying system and files untouched” leaving options to remove the malware and restore the system without having the pay the ransom (Savage 6). Although because of this it is a less popular option to use compared to crypto ransomware. This type of ransomware is more likely to include social engineering as a method to get the ransom paid as instead of demanding a ransom paid it “masquerades as law enforcement authorities and claims to issue fines” to trick the user into thinking they violated online laws and pay a small fine (Savage 6).
Crypto ransomware on the other hand is focused on encrypting valuable data stored on devices and making them inaccessible to the user unless a ransom is paid. This is an effective method because it encrypts the data instead of restricting access on the computers interface making it the more popular option compared to locker ransomware. Once it is on the system, the “ransomware quietly searches for and encrypts files”, trying to remain undetected until it finds all the files it can encrypt until the user tries opening one of the files and is hit with the ransomware message (Savage, 7). Crypto ransomware while it encrypts important data stored on a computer will not target any critical files, so the computer will still function normally while restricting access to the files it has encrypted.
Targets for ransomware are vast, and the reasons can be different from each case, depending on the individual or the group that has deployed the ransomware and what their intentions and goals are. Targets can be government agencies, businesses, college students, or normal home users. Home users and college students can be big targets due to important files saved on their systems. It can also be seen as the most effective one because these users “are not fluent with computers or are not familiar with ransomware” leaving them more susceptible to pay the ransom (Savage 13). For college students they could have a large amount of important course work or materials such as online textbooks downloaded, essays, homework, and big projects. They may be more inclined to pay the ransom because of deadlines they face, having to work on their assignments in a timely manner and having them finished by the due date can make students overwhelmed and more likely to pay to quickly regain access. Normal home users can also have important files they would want to regain access to such as family photos. These targets are also less likely to have backups as “25 percent of home users did not do any backups at all”, making them more likely to pay the ransom as they may feel they do not have any other option (Savage 13).
Businesses and agencies can also be big targets, even more for ransomware that are deployed by a group of bad actors rather than individuals. They can be targeted because if the group is successful in infecting important systems that can hinder the day-to-day operations of these businesses, they may be more willing to pay to get back to operational. Businesses also need to store all kinds of important data where “the loss of this information could have a catastrophic impact on the business” such data like customer information, business plans, reports, or forms that are mission critical (Savage 13). Government Agencies and Educational institutions can also be big targets as they also store critical data for their operations. A school in New Jersey was infected with ransomware “by cybercriminals who demanded a ransom payment of 500 bitcoins (US$124,00)” that shows that these cybercriminals will hit any target they feel they can make money off of (Savage 14).
A recent attack on a big business was the cyber-attack that hit the Colonial Pipeline in 2021. The cyber-attack on the Colonial Pipeline was bad enough that the operations were ceased from May 7 through May 13. A cybercriminal group called DarkSide had ransomware that they used against the Colonial Pipeline, the “Internal Information technology Infrastructure was the target” which would encrypt the data on the systems and cease the operations (Olorunlana and Mohammed, 2). After Darkside had successfully encrypted the files on the target systems they “demanded a ransom payment of $4.4 million in bitcoin in exchange for a decryption key”, Colonial Pipeline decided to pay the ransom and retrieve the key in hopes of continuing operations (Olorunlana and Mohammed, 2). This ransomware attack not only cost the company millions, but it also caused civil unrest on the east coast where the pipeline supplied gas. This caused people to line up at gas stations panic buying gas to make sure they had enough to make through the undetermined length of time until the operations were functional again. This not only helps show how costly ransomware can be, but how it can also affect society as this caused panic for those that live in the areas that were supplied by Colonial Pipeline.
While the Colonial Pipeline affected the United States, ransomware affects companies worldwide. The threat of ransomware means companies around the globe have to make sure their systems are up to date and properly secured to help prevent and mitigate the damage and cost that may come from being a victim to ransomware. Cyberint, a website that keeps track of ransomware attacks, lists the top ten countries and industries hit by ransomware in the year 2024. In 2024, Cyberint showed that the top three industries were Business services, retail, and manufacturing with business services “with 24.1% of the ransomware cases” (Bleih).
The risk of damage and cost associated with ransomware means finding the best ways to prevent and mitigate to stay protected. One of the first steps is to make sure people are informed about how ransomware works, and the methods used to spread them. Having employees go through training so they are aware of techniques “such as the social engineering tricks in the spam emails” (Savage 51). Another method is to make sure that systems are up to date, as methods such as not clicking suspicious links may not always work as “your browser could be redirected to the malicious site by a malvertisement or hidden iframe” on a legit site making up to date software and security patches ever more important (Savage 51).
Making sure a company has a proper Incident Response Plan for cyber-attacks is also another important step to protect against ransomware as this will also help prepare the company for cyber-attacks that are not ransomware. The last thing a company wants is to have their operations stop due to a cyber-attack, and having the right policies in place in the Incident Response Plan can play a big part in preventing that. An IRP helps in many areas such as being able to “quickly contain and resolve security breaches” to help prevent the ransomware from encrypting more files and dealing more damage (Balaji N). The right plan will also help mitigate the damage the company will have to deal with and make sure the team is properly prepared to handle the situation. An IRP will also need an incident Response Team (IRP) to help make sure the steps are followed and that the incident is handled from start to finish. The IRP paired with a properly trained IRT will help make sure that a company is “better equipped to respond to incidents, minimize damage, and recover swiftly” (Balaji N).
Ransomware is a specialized malware designed to make monetary gains off ransoms paid to regain access to computers or important data. Anyone can become a victim to ransomware and depending on the person or company can cost millions in paying the ransom and even more in the event that it ceases company operations. Taking the right steps to help make sure that the company is protected and prepared in the event that they become a victim to ransomware is important. As no security is 100 percent secure, having the proper steps in line can help mitigate the damage and cost from ransomware and help keep operations running.
Works Cited
Baker, Kurt “How Does Ransomware Spread? 10 Most Common Infection Methods” CrowsStrike, 5 October, 2023. https://www.crowdstrike.com/en-us/cybersecurity-101/ransomware/how-ransomware-spreads/ Accessed 28 March, 2025.
Bleih Adi “Ransomware Annual Report 2024” Cyberint, 13 January, 2025. https://cyberint.com/blog/research/ransomware-annual-report-2024/ Accessed 28 March, 2025.
N. Balaji “How to Build an Effective Incident Response Plan: A Practical Guide” Cyber Security News, 13 November, 2024. https://cybersecuritynews.com/effective-incident-response-plan/ Accessed 30 March, 2025.
Olorunlana Taiwo, Mohammed Hamdiya “Analysis of the Colonial Pipeline Cybersecurity Incident” ResearchGate, April, 2025. https://www.researchgate.net/profile/Taiwo-Olorunlana/publication/387104186_Analysis_of_the_Colonial_Pipeline_Cybersecurity_Incident/links/67e6e5949b1c6c4877602f6f/Analysis-of-the-Colonial-Pipeline-Cybersecurity-Incident.pdf Accessed 23 April, 2025.
Savage, Kevin, et al. “The evolution of ransomware” Docslib, 6 August, 2015. https://docslib.org/doc/48082/the-evolution-of-ransomware Accessed 4 April, 2025.
UC Berkeley “Frequently Asked Questions – Ransomware” UC Berkeley, https://security.berkeley.edu/faq/ransomware/ Accessed 30 March, 2025.