Encrypting ransomware is a relatively recent but highly disruptive threat that has surged almost uncontrollably since 2013. Despite strong countermeasures from security companies and law enforcement, ransomware continues to evolve rapidly, posing increasingly complex challenges for both individual users and businesses. So, what can be done to tackle it?
The beginning: 2013
Encrypting malware was rarely a major issue until late 2013, when the infamous Cryptolocker appeared. It quickly became a widespread threat: affected systems had minimal defenses, not all antivirus solutions could detect it, and IT teams struggled to respond effectively.
“…The company boss didn’t take my warning seriously – thought I was overreacting. Later, he probably regretted it, since we lost tons of files. I’m not sure if they paid the ransom, but it was a nightmare…” shared an anonymous consulting system administrator about his first encounter with ransomware.
Saving Private Files: a no-movie #ransomware
Tweet
Unfortunately, cybercriminals turned this sudden scare into profit. Even though relatively few victims paid the ransom, attackers saw it as striking gold. Cryptolocker and its variants multiplied rapidly, evolving like Zerg from the famous video game: Cryptolocker 2.0, CryptoWall, ACCDFISA, Onion/Tor malware, Xorist, Scatter, and more.
For a detailed breakdown of ransomware variants, see this comprehensive Securelist article, which tracks their evolution from early versions to today’s advanced threats.
The evolution of ransomware
The first ransomware strains were relatively simple but effective. The IT professional we spoke with explained:
“Our CTO once dissected one. It looked like nothing more than a VB script launching encryption. We managed to capture the file with its encryption key before it spread and restored all data. The safest method is to cut power to servers at the first sign of infection – extreme, but effective. Without backups, you’re in serious trouble.”
After the successful Operation Tovar, which took down the Gameover ZeuS botnet and Cryptolocker infrastructure, attackers added another layer of security for their malware by hiding their command-and-control servers on TOR networks, making detection even harder for researchers and law enforcement.
Humans are the real target
Unlike many other threats, ransomware targets human behavior more than the systems themselves. Most antivirus solutions now include anti-ransomware features, but they are useless if turned off.
“We often see file encryption in organizations caused by employees disabling their antivirus. These aren’t rare cases – our support team sees this multiple times a week,” wrote ImgConverter Lab expert Artem Semenchenko.
He explained that this paradox arises because better security often makes users complacent:
“With improved browser and OS defenses, users encounter fewer threats directly. This leads some to turn off parts of their antivirus or ignore it entirely.”
Cybercriminals exploit such mistakes: opening suspicious email attachments or clicking unknown links. Advanced defenses don’t replace the need for basic cybersecurity practices.
#Security advancements in browsers & OS suddenly worked against itself
Tweet
Ransomware often relies on scaring its victims. Attackers may send letters impersonating law enforcement, debt collectors, or courts, with official logos and intimidating language in all caps. In extreme cases, victims even mistakenly reported themselves to authorities after receiving such messages, as in this incident.
Usually, innocent users are targeted. Threatening messages disguise phishing attempts or ransomware demands for money after files are already encrypted.
The ultimate goal
Ransomware is purely profit-driven. Attackers target both individuals and companies, sometimes demanding thousands of euros from corporations. Payments are often requested via Bitcoin, making transactions harder to trace.
Recovery is challenging. While some ransomware (like Xorist) can be decrypted, the most sophisticated strains use asymmetric encryption, often with multiple key pairs, making decryption practically impossible without paying the ransom.
Prevention is the best strategy
The key to safety is proactive prevention. Backups are critical, ideally “cold” storage disconnected from the network. Antivirus programs must be constantly updated, preferably before employees begin working each day.
Employees should also be educated on phishing, suspicious files, and general cybersecurity hygiene. Getting hit by ransomware is easy; recovering can be nearly impossible.
Securelist provides links to specific anti-ransomware tools, but they only work against certain types. Preventing infection remains the most effective strategy to frustrate attackers.