Threat actors are now a lot more intelligent in their approach. At first they would spread like a worm through organizations, collecting credentials and encrypting files along the way. Later on, ransomware gangs realized they would make a lot more money targeting businesses. In the early days, hackers mostly targeted consumers, and it would encrypt immediately upon executing. The emergence of new strains has slowed down, but ransomware is getting much more sophisticated.

Today, a Ransomware Infection is a Data Breach The Global Cost of Ransomware Infographic According to Microsoft, 42% of attempted recoveries from tape backups in the past year have failed. Storage Magazine reports that over 34% of companies do not test their backups and of those tested 77% found that tape backups failed to restore. However, cybercriminals are now often corrupting backups before the victims know what hit them. Once files are encrypted, the only way to get them back is to restore a backup or pay the ransom. Annual ransomware-induced costs are projected to exceed $265 billion by 2031, according to Cybersecurity Ventures. This is a very successful criminal business model. Some major strains are WannaCry, GandCrab, Phobos and Cerber. Techniques the cybercriminals are using are constantly evolving to get past traditional defenses. New strains and variants come and go as new cyber mafias muscle into the 'business'. Next, when a user wants to access one of these files they are blocked, and the system admin who gets alerted by the user finds two files in the directory that indicate the files are taken ransom, and how to pay the ransom to decrypt the files. Once the malware is on the machine, it starts to encrypt all data files it can find on the machine itself and on any network shares the PC has access to.

It typically gets installed on a user’s workstation (PC or Mac) using a social engineering attack where the user gets tricked in clicking on a phishing link or opening an attachment.

September 2013 is when ransomware went pro. Ransomware attacks cause downtime, data loss, possible intellectual property theft, and in certain industries an attack is considered a data breach. Ransomware is defined as vicious malware that locks users out of their devices or blocks access to files until a sum of money or ransom is paid.

Crypto locker wikipedia