Definition and Trends of Ransomware (Ransom-Demanding Malware)

Ransomware is malware that demands money by encrypting victims' files or by exfiltrating data and threatening to publish it. Payment methods often include hard-to-trace cryptocurrencies or prepaid cards, and in some cases recovery without payment is possible due to implementation mistakes or key leaks.

In operational terms, a protocol called "cryptoviral extortion" is described: attackers distribute malware containing the attackers' public key; the infected host generates a random symmetric key to encrypt data, then encrypts that symmetric key with the attacker's public key and sends it to the attacker. Typical intrusion vectors are Trojan-style attachments, phishing links, and vulnerabilities in network services.

Historically, the 1989 AIDS Trojan is considered the earliest known example, and later families such as CryptoLocker and CryptoWall caused major impacts and financial gains. As statistics of incidents, reports show 181.5 million attacks in the first half of 2018, about 623 million in 2021, and about 493 million in 2022, indicating large-scale attack volumes. The IC3 (Internet Crime Complaint Center) reported 2,474 ransomware complaints and losses exceeding $29.1 million in 2020, and received 3,611 complaints and over $32.0 million in reported losses in 2025.

Regarding incident response, citing a Sophos report, the global average recovery cost (including downtime, remediation work, and ransoms paid) is about $761,106, underscoring the importance of recovery from backups. This article provides an overview organized around how ransomware works, its history, monetary impact, infection routes, and countermeasures.