Ransomware and Cryptolockers

Ransomware is malware that denies access to data or systems and demands payment — typically in cryptocurrency — for restoration. The defining characteristic is extortion: the victim's own data becomes leverage against them. Modern ransomware operations are sophisticated criminal enterprises generating billions of dollars annually. The 2021 Colonial Pipeline attack disrupted fuel supply across the US East Coast; the 2020 Universal Health Services attack impacted 400 hospitals. Ransomware is among the most severe threats organizations face today, combining technical sophistication with significant business impact.

Ransomware attacks follow a predictable sequence. Initial access: phishing email, RDP brute-force, or exploitation of a public-facing vulnerability. Persistence: install backdoor and disable security tools. Lateral movement: spread through the network to maximize infection scope and compromise backup systems. Data exfiltration: steal sensitive data before encrypting (double extortion). Encryption: encrypt files across all accessible systems simultaneously. Ransom demand: leave ransom note with payment instructions and threat to publish stolen data if unpaid. Understanding each phase reveals defensive opportunities at every step.

CryptoLocker (2013) pioneered modern ransomware by combining RSA-2048 public key encryption with Bitcoin payment, making decryption impossible without the private key held by the attacker. It was distributed via phishing email attachments and spread to mapped network drives. CryptoLocker was disrupted in 2014 but inspired a generation of successors: WannaCry (2017) spread as a worm, NotPetya (2017) masqueraded as ransomware but was a destructive wiper targeting Ukraine, Ryuk (2018-2020) targeted enterprises with manual operator-driven attacks, and REvil (2020-2021) pioneered the RaaS double-extortion model.

Ransomware as a Service (RaaS) is a criminal business model where ransomware developers lease their tools and infrastructure to affiliates who conduct the actual attacks. The affiliate keeps 70-80% of the ransom; the developer keeps the rest. This dramatically lowered the technical barrier for ransomware attacks, enabling less-skilled criminals to deploy sophisticated ransomware. Notable RaaS operations include REvil, LockBit, BlackCat/ALPHV, and Conti. Law enforcement disruption of operators often leads to splinter groups rebranding and continuing operations, making RaaS resilient to takedowns.

Single extortion encrypts files and demands payment for the decryption key. Double extortion (pioneered by Maze in 2019) also exfiltrates data before encryption and threatens to publish it on a leak site if the ransom is not paid — effective even against victims with good backups. Triple extortion adds a third pressure: DDoS attacking the victim's infrastructure simultaneously to prevent them from operating while negotiating. Some groups also contact the victim's customers, partners, and regulators to increase pressure. These multi-pressure approaches make backup-based recovery alone insufficient as a ransomware response strategy.

Sophisticated ransomware operators specifically target backup infrastructure before triggering encryption, knowing that good backups are their primary obstacle. Tactics include: deleting Windows Volume Shadow Copies (vssadmin delete shadows), deleting backup software databases, corrupting backup agents, and accessing network backup servers through compromised credentials. This is why immutable backups — backups that cannot be modified or deleted even by an authenticated administrator for a defined retention period — are essential. Immutable object storage (AWS S3 Object Lock, Azure Immutable Blob) and tape backups stored offline are highly effective.

The 3-2-1 backup rule is the foundational backup strategy for ransomware resilience: maintain 3 copies of data (production + 2 backups), on 2 different media types (e.g., disk and tape), with 1 copy stored offsite (geographically separated from primary systems). A ransomware-hardened variant adds a 4th element: at least one copy must be offline or immutable. Backups that are accessible to the production network are vulnerable to encryption. The offsite/offline requirement ensures that even complete compromise of the primary environment leaves one clean copy accessible for recovery.

The decision to pay ransom involves complex considerations. Paying does not guarantee decryption (some ransomware groups disappear after payment), may fund criminal enterprises or sanction-listed groups (OFAC in the US prohibits payments to sanctioned entities), and signals that the victim will pay — potentially making them a repeated target. However, organizations without viable backups may face existential business risk from prolonged outages. The FBI generally recommends not paying but acknowledges the difficult position businesses face. Before any payment consideration, consult legal counsel, law enforcement (FBI has victim resources), and cybersecurity specialists to explore all alternatives.

Beyond backups, ransomware-specific technical controls include: EDR with ransomware detection that monitors for mass file encryption operations and can automatically isolate affected endpoints; honeypot files placed across file shares that alert immediately if touched (ransomware will encrypt them along with real files); controlled folder access (Windows Defender feature) that prevents unauthorized applications from writing to protected folders; and application allowlisting that blocks execution of unknown processes (significantly limits ransomware ability to run). Disable macros, block RDP exposure to the internet, and enforce MFA on all remote access.

When ransomware strikes, recovery options without paying include: restoring from verified clean backups (the most reliable path), checking if a decryptor exists on NoMoreRansom.org (law enforcement and security vendors release decryptors for some ransomware families after infrastructure seizure), recovering files from Volume Shadow Copies if ransomware did not delete them, and for some encryption implementations, researchers have identified weaknesses in the random number generation that make decryption feasible. Always snapshot or image affected systems before attempting any recovery — data preserved now may be recoverable later even if not immediately.

Organizations must have a ransomware-specific incident response plan before an attack occurs. The plan should include: escalation contacts (legal, executive, cyber insurance carrier, law enforcement liaison), decision trees for containment vs. continued operation, pre-negotiated relationships with ransomware negotiation firms if relevant, backup recovery procedures with estimated RTOs, communication templates for customers, partners, and regulators, and legal guidance on ransom payment law. The plan must be tested via tabletop exercises. Staff should know the plan; discovering it during an attack adds critical minutes to an already chaotic situation.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: modern ransomware follows a kill chain from initial access through lateral movement to encryption, presenting defensive opportunities at each phase, immutable and offline backups following the 3-2-1 rule are the most reliable recovery mechanism because ransomware specifically targets online backup systems, and double extortion adds data theft before encryption, meaning backups alone no longer fully protect organizations from all ransomware impacts. Next up we explore rootkits, spyware, and keyloggers.