The widely cited first ransomware attack occurred in 1989. Following a World Health Organization conference on AIDS, attendees received “AIDS Information” floppy disks laden with a trojan virus. The trojan would encrypt files on an infected system, and then ask the victim to mail a $189 payment to an address in Panama to restore access.
In the early 1990s came “scareware,” so called for its use of fear-based social engineering. Infected computers would display an error message with a link to buy and download software to fix the issue. (The software was, of course, usually more malware, often designed to steal data.) Scareware persists today in many forms, such as malspam and browser popups.
The rise of file sharing popularized a category of ransomware called screen lockers. Instead of encrypting files, these would lock the user's system and demand a ransom or "fine" (frequently citing police, the FBI, etc.). In reality, many lockers simply restricted mouse movement, and a system restart could restore normal functions. Nonetheless, fear led many victims to pay.
The Link Between Ransomware and Cryptocurrency
Early on, ransom demands typically peaked at a few hundred dollars from individual users. Moreover, ransom payments were usually made with ordinary payment cards, making the transactions far easier to track and the threat actors easier to catch.
Today, innovations in cybercrime and crypto technology have helped ransomware explode in popularity. In particular, cryptocurrency—digital currency based on anonymity and encryption—has enabled bad actors to cover their tracks by making transactions nearly untraceable.
Ransomware as a Service (RaaS)
A byproduct of that popularity and success, RaaS tools are often subscription-based and affordable, just like legal SaaS offerings. Many are readily available on the dark web, and they enable even people without programming skills to launch a cyberattack and earn part of its profits. Some RaaS providers even offer technical support and paid bug bounty programs.
Double Extortion Ransomware
Eventually, better data backup and decryption technology began to move the needle in victims’ favor. In response, in 2019, a criminal group called TA2102 perpetrated the first high-profile double extortion ransomware attack, both encrypting and exfiltrating the victim’s data before threatening to leak it unless paid US$2.3 million in bitcoin. This way, even if the victim had managed to restore their data, they would still suffer a severe data breach unless they paid.
Encryption-less Ransomware
In 2022 and 2023, an insidious trend emerged that reimagined how ransomware works at its core. Both an evolution and a sort of regression, encryption-less ransomware attacks don’t encrypt victims’ files. Instead, attackers focused only on exfiltrating sensitive data as leverage for extortion.
Victims of these attacks tend to be in sectors that handle highly sensitive PII, such as legal and healthcare. Because their key concern is preventing leaks of their sensitive data, many will pay the ransom regardless of encryption. In addition, victims can recover unencrypted data more quickly and easily, often translating to faster ransom payouts.
