Understanding and Countering Ransomware

Ransomware has become a dominant cybersecurity threat, gaining broad attention through major incidents such as WannaCry and Petya/NotPetya. Multiple 2016 threat reports from major security vendors anticipated this growth, and the trend has been confirmed by increased global reach, higher ransom demands, and escalating operational and physical consequences. Although financially motivated mass campaigns remain the typical model—aiming to infect as many users as possible—some outbreaks resemble “pseudo-ransomware” that primarily seeks disruption rather than revenue, as illustrated by Petya/ExPetr’s destructive behavior (e.g., rendering systems unbootable).

Ransomware usually spreads via spam emails that carry malicious attachments or links, often relying on trojans or social engineering to convince users to execute the payload. After infection—frequently enabled by unpatched or older operating systems—it encrypts files or locks user interfaces, then demands payment commonly via cryptocurrencies such as Bitcoin. Human behavior is a critical factor, with users often serving as the easiest entry point. The risk is greatest in the early period before detection and remediation; traditional signature-based tools are weakest against unknown or newly released variants, especially when criminals reuse exploits while changing signatures across families.

The report emphasizes that paying ransom is not a reliable remedy and can amplify long-term risk, including repeat targeting and continued criminal incentives. Defense requires an end-to-end resilience program across identify, prevent, detect, respond, recover, and improve—combining patch management, advanced detection (behavioral/sandboxing), incident response roles and processes, and robust backup-based recovery. Healthcare emerges as particularly vulnerable, where outages and disrupted connected medical equipment can put patient safety at risk.

• Ransomware quadrupled in 2016 compared to the previous year.
• Ransomware cost businesses over $1 billion in 2016.
• CryptoWall generated an estimated $325 million in revenue in 2013.
• The number of ransomware families increased from 30 in 2014/2015 to 101 in 2016.
• Symantec reported an approximate 36% rise in ransomware detections from 2015 to 2016.
• Petya infected more than 12,500 systems in over 65 countries, with Europe hit the most.
• Eset’s distribution figures for Petya showed Ukraine at 75.24% of infections, Germany at 9.06%, and Poland at 5.81%.
• WannaCry infected over 230,000 computers across more than 150 countries.
• WannaCry demanded a $300 ransom payment in Bitcoin.
• WannaCry’s business interruption costs were estimated to have reached over $4 billion.

• “Ransomware is malware, using the same principles and attack techniques”
• “The biggest challenge is the phase until attacks are detected – traditional security technology does not protect well here”
• “There is a well-working business model behind ransomware”
• “Developed nations are usually the prime targets for ransomware”
• “Traditional Security Technologies are not sufficient to counter the ransomware threat”
• “Be prepared to recover when being hit by ransomware – once you are hit, it is too late to prepare”
• “Countering ransomware requires an adequate organization and must cover all phases of the cybersecurity cycle, from identification of risks to recovery and continuous improvement.”
• “Ransomware is here to stay and will keep increasing in the future.”
• “When looking at the recent WannaCry ransomware attack, which paralyzed healthcare institutions, financial organizations and other business, but also held individuals’ data hostage, on global scale, there was damage up to risking the life of patients in affected hospitals.”
• “Immediate and continuous actions are mandatory for improving cyberattack resilience.”