What Is Ransomware — Methods and a Growing Threat

IBM defines ransomware as “malware that locks victims’ confidential data and devices and demands a ransom.” Early attacks mainly sought payment in exchange for decryption keys, but it has become common to pair encryption with data theft and public disclosure.

Attacks generally progress through stages: initial access, post-exploit, lateral expansion, data collection and theft, and deployment and extortion. Typical entry points include phishing, software vulnerabilities, unauthorized remote access (RDP), and credential theft; trojans and RATs are sometimes used as stepping stones.

There are two main types of ransomware—crypto (encryption) and screen-locking—and various subtypes such as doxware (leak extortion), mobile-targeted, destructive (wiper), and scareware. Attackers increase pressure to pay by deleting or disabling victims’ backups and by exfiltrating data in addition to encrypting it.

In recent years, the Ransomware as a Service (RaaS) model, which separates developers and operators (affiliates), has become widespread and has contributed to the proliferation and diversification of attacks. IBM’s report points out that while the number of active groups has grown, the increase in publicly reported incidents has been modest, which may indicate improvements in detection and defense.