The most dangerous ransomware of recent years

Malware created to demand a ransom has existed for years. Today it goes by the name ransomware – a blend of the words ransom and software.

They are not all the same: some, for example, deceive the user by posing as police authorities demanding payment for alleged unlawful activities supposedly committed by the user. Others instead threaten the information itself.

The purpose of the latter is to sneak into information systems, encrypt, copy or delete sensitive or important data, and demand payment for its return and/or for not disclosing it.

Finally, ransom-motivated malicious software has been discovered that can attack ICS systems by using the system’s PCs as vehicles of infection.

Can the ransom be traced?

If, following a breach, the user or company decides to pay what is demanded, the payment method would obviously be electronic.

Unfortunately, the new virtual currencies (or cryptocurrencies) that have emerged in recent years guarantee untraceability and anonymity. It therefore becomes very hard to track down the perpetrators of such crimes.

Let us now look at the biggest ransomware attacks of the last half-decade, to tell the story of this malware as it evolves.

1. TeslaCrypt

Emerging initially as a variant of CryptoLocker, TeslaCrypt targeted gamers. It specialised in going after files associated with video games, virtual maps, downloadable content and saved games.

Strange as it may seem, the stolen content can be very important to professional gamers, so much so that TeslaCrypt alone accounted for 48% of ransomware attacks.

In 2016 the creators of TeslaCrypt announced the end of their criminal activity by publicly sharing the master decryption password.

2. SimpleLocker

With the spread of mobile devices (mainly smartphones), the attention of cybercriminals also shifted to them.
Between the end of 2015 and the beginning of 2016, Android ransomware infections quadrupled.

SimpleLocker was the first Android-based attack to encrypt files and make them inaccessible without the help of the fraudsters.
It was also the first known ransomware to deliver its malicious payload via a trojan (or Trojan horse) – potentially harmless software that becomes a vehicle for dangerous threats.

Fortunately the numbers are still relatively low, but it remains a lurking threat.

3. WannaCry

In mid-2017, two major, intertwined ransomware attacks spread like wildfire around the world, shutting down hospitals in Ukraine and radio stations in California, and that was when ransomware became an existential threat.
The first of the two major attacks was called WannaCry and was without doubt the worst ransomware attack in history.

But the real significance of WannaCry goes beyond the numbers: it maliciously used hacking tools leaked from the NSA.
One example is EternalBlue – an exploit that takes advantage of a flaw in Microsoft’s implementation of the SMB (Server Message Block) protocol – released by the Shadow Brokers hacker group.

Although Microsoft had already released a patch for the flaw, many users had not installed it and many organisations had the SMB port – 445 – openly exposed to the Internet.

4. NotPetya

Petya was a ransomware package dating back to 2016.
A few weeks after the WannaCry outbreak, an updated version began to spread that also used the EternalBlue package, like WannaCry, leading researchers to rename it NotPetya because it had advanced far beyond its origins.

NotPetya caused OT systems to shut down at most of the plants of pharmaceutical giant Merck, halting production and forcing the company to borrow $240 million worth of Gardasil doses from the stockpiles managed by the US CDC centres.
Overall, the attack cost the company almost a billion dollars.

This ransomware spread so quickly that it made it plain that organisations around the world were still not taking cyber security as seriously as they should.
Being proactive in monitoring network traffic, both on-premises and within cloud environments, could have prevented some of the infections.

5. SamSam

Attacks using the software known as SamSam began to appear at the end of 2015, but increased sharply in the following years.
Victims include the Colorado Department of Transportation, the city of Atlanta and numerous healthcare facilities.

What makes SamSam special is that it does not indiscriminately search for a specific vulnerability, but is rather a ransomware-as-a-service whose controllers carefully probe selected targets to identify weak points, which are then used to exploit vulnerabilities in IIS, FTP or RDP.

Once inside the system, the attackers work diligently to escalate privileges to ensure that when they start encrypting files, the attack is especially damaging.

6. Ryuk

Ryuk is another targeted ransomware variant that struck hard in 2018 and 2019.
Its victims are organisations with little tolerance for downtime, such as newspapers and water utilities – for example the North Carolina water utility dealing with Hurricane Florence.

The Los Angeles Times wrote a fairly detailed account of what happened when its systems were infected. One feature of Ryuk is that it can disable the Windows “System Restore” option, making it even harder to recover data.

Ransom demands were particularly high for the high-value victims it targeted.

Analysts believe the Ryuk source code is largely derived from Hermes, which is a product of North Korea’s Lazarus group.
McAfee believes Ryuk was built on code purchased from a Russian-speaking vendor, because the ransomware does not run on computers whose language is set to Russian, Belarusian or Ukrainian. It is not clear how this Russian source acquired the code from North Korea.

(Dis)honourable mention: CryptoLocker

CryptoLocker burst onto the scene in 2013 and truly opened the era of large-scale ransomware: it spread through spam email attachments and used RSA public-key encryption to lock users’ files, demanding money in exchange for the decryption keys.

More than 500,000 machines were infected by CryptoLocker.

CryptoLocker was primitive, and was eventually defeated by Operation Tovar, which took down the botnet that controlled CryptoLocker, uncovering the private keys that CryptoLocker used to encrypt files.

CryptoLocker had “opened the floodgates” to many other varieties of file-encrypting ransomware, some derived from its own code and others written from scratch: one of these was CryptoWall, which in 2015 accounted for more than half of all ransomware infections.

Times change

Ransomware is in decline in 2018 and 2019, and the drop has been steep: ransomware affected around 48 percent of organisations in 2017, but only 4 percent in 2018.

There are a couple of reasons: ransomware attacks are increasingly tailored to specific targets and run in real time by sophisticated controllers, like SamSam and Ryuk.
Then there is the fact that ransomware is a kind of “fussy” attack that requires its victims to carry out a series of steps in order to turn a profit. Victims have to work out how to exchange cryptocurrencies, and many will not, to avoid giving money to criminals.

Moreover, if an attacker’s goal is to get into someone else’s computer systems, there are much easier ways to do it: cryptojacking.

Cryptojackers follow the playbook that spammers and DDoS attackers have used for years: gaining control of computers without their owners knowing. In this case, the compromised machines become bitcoin mining platforms, quietly generating money and using idle processing cycles while the victim is unaware.

While ransomware attacks have dropped sharply, cryptojacking attacks have increased by 450%, and the two statistics are believed to be correlated.