Ransomware

Malicious software that encrypts files and demands money in exchange for recovery, a representative form of cyber extortion crime targeting companies and public institutions.

Ransomware

Overview

Ransomware is malicious software that encrypts files on an infected system or exfiltrates data, then demands money (usually cryptocurrency) in exchange for restoration or non-disclosure. Originating with the 1989 "AIDS Trojan," it caused massive damage worldwide with WannaCry in 2017, and today it has evolved from simple malware into an industrialized cybercrime ecosystem in the form of "Ransomware-as-a-Service (RaaS)." Initially it targeted individual users, but recently double extortion tactics targeting companies, hospitals, public institutions, and supply chains have become mainstream.

Key Details

Infection Vectors

The most common intrusion routes are malicious attachments and links in phishing emails, brute-force attacks on vulnerable Remote Desktop (RDP) accounts, zero-day vulnerabilities in perimeter devices such as VPNs and firewalls, and software supply chain attacks through vendors. Recently, cases of abusing legitimate management tools or remote monitoring solutions to evade detection are increasing.

Evolution of Attack Tactics

  • Double Extortion: In addition to encrypting files, exfiltrating internal data and threatening public disclosure.
  • Triple Extortion: Threatening to spread leaked data to customers and partners, or announcing DDoS attacks to apply pressure.
  • RaaS Model: Developer organizations sell ransomware as a service, and affiliates carry out the actual intrusion and then share the profits.
  • Initial Access Brokers: A market has formed on the dark web trading access to corporate networks themselves.

Notable Cases

Representative examples include WannaCry in 2017, attacks that paralyzed several U.S. local governments in 2019, the 2021 SolarWinds supply chain incident and Colonial Pipeline incident, the 2022 chain of attacks on Costa Rican government agencies, and 2024 breaches of large hospitals and manufacturers at home and abroad. In particular, attacks on medical institutions are directly linked to patient safety and therefore carry great social repercussions.

Response and Recovery Strategy

The core principle is the three stages of "prevent, detect, recover." On the prevention side, multi-factor authentication (MFA), the principle of least privilege, patch management, and minimizing internet-exposed assets are important. On the detection side, EDR/XDR, anomalous behavior monitoring, and ransomware-specific backup monitoring are used. On the recovery side, a 3-2-1-1 backup strategy (3 copies, 2 media, 1 offsite, 1 offline/immutable storage) and regular recovery drills are essential. When an incident occurs, network isolation, forensic preservation, reporting to law enforcement and specialized agencies, and careful decision-making based on the principle that "paying the ransom encourages repeat offenses" are required.

Legal and Institutional Response

Korea mandates incident reporting through the Information and Communications Network Act and the Personal Information Protection Act, and operates a ransomware response support system through the Ministry of Science and ICT and KISA. The United States runs the #StopRansomware campaign centered on CISA alongside designating sanctioned organizations, and the European Union strengthened supply chain security requirements through the NIS2 Directive.

Latest Trends

The biggest change in 2024–2025 is the fragmentation and specialization of the RaaS ecosystem. As large organizations were dismantled by crackdowns, their members dispersed into smaller groups and reorganized, and "initial access services" that automate the pre-intrusion stage are increasing in order to raise attack success rates. In addition, tailored phishing emails and voice phishing (vishing) using generative AI have increased, greatly raising the sophistication of attacks. Conversely, on the defense side, AI-based anomaly detection, immutable storage, and adoption of zero trust architecture are spreading rapidly. On the regulatory side, legislation shortening incident reporting deadlines to 24–72 hours is underway in various countries, and there is a clear trend toward stricter scrutiny of security control requirements when underwriting insurance. Domestically as well, mock drills targeting major information and communications infrastructure and mandatory supply chain security inspections are being strengthened.

Related Topics

  • [[Malware]]
  • [[Zero-day vulnerability]]
  • [[Cybersecurity]]
  • [[Phishing]]
  • [[Zero Trust]]
  • [[Information Security Act]]