Ransomware

Definition

Ransomware is a type of malicious software that blocks access to your files or systems until you pay a ransom. Most often, it encrypts your data so you can’t open it, then demands payment — usually in cryptocurrency — in exchange for a decryption key.

A typical ransomware attack goes like this:

1. **Infection** – Delivered via phishing emails, malicious attachments, drive-by downloads, or exploiting vulnerabilities.
2. **Execution** – The ransomware runs and starts encrypting files or locking the operating system.
3. **Notification** – A ransom note appears, telling you how much to pay and how to pay it.
4. **Payment (Optional)** – Victims may pay in hopes of getting their data back, but there’s no guarantee the attacker will deliver a working key.
5. **Data Theft (in modern attacks)** – Many groups now steal sensitive files first, threatening to leak them online if the ransom isn’t paid (**double extortion**).

Many attacks today are part of the **Ransomware-as-a-Service (RaaS) ecosystem**. In RaaS, a core group of developers builds and maintains the ransomware, then “leases” it to affiliates. Affiliates carry out the attacks and share the profits with the developers. This business model works much like legitimate software-as-a-service — complete with subscription plans, technical support, and marketing — and makes it easier for less-skilled criminals to get into ransomware operations. Groups like LockBit, BlackCat (ALPHV), and REvil are known for running large affiliate programs.

From an investigation perspective, ransomware cases involve looking for:

* The initial entry point (phishing email, RDP compromise, vulnerable software)
* File modification patterns consistent with encryption
* Ransom note files dropped in multiple directories
* Outbound network connections to attacker infrastructure
* Evidence of data exfiltration before encryption

Real-world examples:

* **WannaCry (2017)** – Spread rapidly using the EternalBlue exploit, impacting hospitals, businesses, and governments worldwide.
* **LockBit** – A RaaS group with industrial-scale attacks and aggressive data-leak sites.
* **Ryuk** – Targeted large enterprises and hospitals, often demanding multi-million-dollar payments.
* **REvil (Sodinokibi)** – A prolific RaaS operator behind high-profile supply chain incidents like the Kaseya breach.

Explore More Terms

Practice in These Games

Castle & Sand: A Beachy Case of Ransomware

In a world of sun, sand, and surf, Castle&Sand reigns supreme as the beacon of beachwear and accessories. Enter the **SharkzBoys**, a shadowy group of cyber marauders, who unleash a devastating ran...

View Game

AzureCrest - The full version

Azure Crest Hospital 🏥 is a cornerstone of healthcare excellence, standing tall as a regional medical beacon with a team of over 200 dedicated heroes. Azure Crest is more than a hospital—it's a lif...

View Game

Jojo's Hospital: A Ransomware Investigation

Jojo's Hospital, a cornerstone of Lexington's healthcare system, faces a critical crisis. The stakes are immense: will the hospital recover its vital services and secure patient data 🏥 or succumb t...

View Game

FHS - Jojo's Hospital

View Game