Re-Thinking The Threat Of Ransomware

In the last year there has been an endemic use of ransomware on a large scale and at a global level.  To put this into context, a recent report from Druva estimated that 4,000 ransomware attacks occur each day, while a report from Verizon ranked ransomware as the number one piece of crime-ware used by cyber-criminals in 2017.

The National Cyber Security Centre has also identified ransomware as the most common cyber extortion method used by cyber-criminals to target UK businesses.

Ransomware is a type of malware that restricts access to a computer or its data and demands money for it to be released. The threat is typically spread via phishing emails, spam campaigns, drive-bys or programs downloaded to a computer by an unwitting user visiting an infected website. 

In May last year, WannaCry, one of the world’s most publicised ransomware variants caused global panic when it hit the NHS and left hospitals unable to access patient data. So, where did ransomware come from, is it a new threat, how is it evolving and, most importantly, what steps can organisations take to protect against it?

History of Ransomware 
Ransomware is not new and has been around since 1989 with the first ever documented case being the AIDS Trojan (or PC Cyborg ransomware) created by Joseph Popp, who distributed 20,000 infected floppy disk drives to the participants of the World Health Organisations AIDS Conference.

Since then, ransomware has appeared more frequently due to the amount of money that can be made using the technique.  
In 2017 the same report from Druva estimated that the ransomware industry has quadrupled over the past year, reaching an estimated $1 billion. As a result of the huge financial return on ransomware, cyber-criminals are constantly developing new variants in a bid in ensnare more victims and bypass security defenses.

The latest ransomware variants have deployed new strategies for the delivery of the malware. Whilst most ransomware typically requires some sort of user interaction, recent research has demonstrated how hackers have infected systems with WannaCry by exploiting a remote code execution (RCE) vulnerability, which allowed them to infect unpatched systems without user’s interaction. This is something that is usually associated with a worm rather than ransomware.

To Pay or Not to Pay
One of the key dilemmas an organisation faces when infected with ransomware is whether or not to pay the fine. This is particularly true for organisations that do not have a comprehensive back-up strategy in place and risk losing access to their files entirely if they do not pay. Whilst many law enforcement agencies and security practitioners often advise against paying ransoms for this criminal activity, reports suggest that severe disruption to services and the lack of backups sometimes leads to organisations giving in and paying the criminals for the release of their data.

However, as has been demonstrated in many recent attacks, even when organisations do pay the fine, there is no guarantee they will receive their files back. Additionally, in some cases when an organisation opts to the pay the ransom, they only receive part of their data back in return. 

This ultimately means organisations need to assess if paying the fine is worth it at all, when there is absolutely no way to know if the cybercriminals will ever return their files. 

Some businesses also believe that paying the fine makes sense because they believe their data is worth more than the ransom. However, the danger of paying is that they are essentially funding the ransomware industry, which will ultimately make it more profitable for cyber-criminals and lead to more attacks. So, what are the best ways to mitigate a ransomware attack without having to pay the fine? 

Protecting Against Ransomware
To protect against the tidal wave of ransomware attacks, organisations need to improve their software patching processes. Many organisations, for example the UK NHS, were caught out because they did not update their systems with the relevant patches in time.

Another lesson that can be learned from these events is that vulnerability disclosure practices within the industry need to improve as no single organisation can defend against these threats on its own. 

For any organisation that does fall victim to a ransomware attack, it is very important to carry out a post incident analysis. This will allow them to analyse how they contained the event and if there are any changes that could be made to improve their response, should a future attack occur.

Infosecurity- Magazine

You Might Also Read:

British IT Bosses Fear Sophisticated Cyber Threats:

FBI: Don’t Pay Bitcoin Ransomware:

 

 

« Australia's Largest Bank Lost The Personal Financial Histories Of 12m Customers
Hacker Group Targets Healthcare Providers »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 7,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

ZDL Group

ZDL Group

At ZDL (formerly ZeroDayLab) we take a comprehensive view of our clients cyber security risks and provide quality services to address those risk

NQA Certification

NQA Certification

NQA provides certification to a range of ISO standards including ISO 27001 for information security management.

ReliaQuest

ReliaQuest

ReliaQuest’s GreyMatter solution connects existing technology, people, and process – then equips security teams with unified, actionable insights across their entire environment.

Salient Law

Salient Law

Salient Law is a virtual law firm that specialises in advising providers and users of technology on contracts involving technology.

GreyNoise Intelligence

GreyNoise Intelligence

GreyNoise Intelligence is a cyber security company that collects, labels, and analyzes Internet-wide scan and attack data.

Verificient Technologies

Verificient Technologies

Verificient Technologies specializes in biometrics, computer vision, and machine learning to deliver world-class solutions in continuous identity verification and remote monitoring.

GLESEC

GLESEC

GLESEC offer a complete range of Cyber Security services from Operations & Intelligence Services to Auditing & Compliance and Simulation and Training.

eXate

eXate

eXate provides pioneering technology that empowers organisations to protect, control and manage their sensitive data centrally, providing a complete data privacy solution.

Polymer Solutions

Polymer Solutions

Polymer is a Data Governance & Privacy Platform for third party SaaS apps. A modern Data Loss Protection (DLP) approach to remove sensitive data exposure on collaboration tools in real-time.

R3I Ventures - House of DeepTech

R3I Ventures - House of DeepTech

The House of DeepTech is an incubator for deeptech entrepreneurs that are transforming global industries. Areas of interest include cybersecurity.

Cybersecurity Maturity Model Certification Center of Excellence (CMMC COE)

Cybersecurity Maturity Model Certification Center of Excellence (CMMC COE)

CMMC COE is an IT-AAC sponsored public–private partnership that will be the focal point for entities seeking to achieve Cybersecurity Maturity Model Certification.

Surfshark

Surfshark

Surfshark is a cybersecurity company focused on developing humanized privacy & security protection solutions to secure people's digital lives.

Cyrex

Cyrex

Cyrex is a Web3 security and development company. Our mastery over decentralized applications, smart contracts and blockchain will keep you secure across Web3.

Oz Forensics

Oz Forensics

Oz Forensics is a global leader in preventing biometric and deepfake fraud. It is a developer of facial Liveness detection for Antifraud Biometric Software with high expertise in the Fintech market.

Cyro Cyber

Cyro Cyber

Cyro Cyber is a collective of some of the UK’s most experienced and savvy cybersecurity, information assurance, data protection, IT governance and compliance experts.

CQR

CQR

CQR are at the forefront of innovative cyber solutions, dedicated to securing and fortifying Operational technology (OT) infrastructure.