MODULE 4 — Ransomware: Mechanisms, Economics, and Impact

Learning Objectives

After completing this module, learners will be able to:

Explain how ransomware works, from initial infection to data encryption and extortion.
Describe different ransomware families, variants, and operational models.
Analyse the economics behind ransomware campaigns and why they remain profitable.
Understand double extortion, triple extortion, and emerging tactics.
Evaluate the organisational and societal impact of ransomware attacks.
Identify preventive and mitigative strategies used in modern environments.

Module Overview

Ransomware has evolved into the most financially destructive class of cyber threat. What began as simple data-locking malware has matured into a global criminal ecosystem, complete with affiliate structures, negotiation teams, technical support, and revenue-sharing models.

In this module, we dissect ransomware from three angles:

Technical — how ransomware infiltrates systems and executes its payload.
Operational — how attackers organise, scale, and monetise campaigns.
Strategic — why ransomware succeeds and how organisations can disrupt its impact.

Understanding ransomware requires examining not only the malware itself but the broader incentive structures that drive its expansion.

1. What Is Ransomware?

Ransomware is malware that encrypts files or disables systems, demanding payment (typically in cryptocurrency) to restore access.
It is characterised by:

Rapid propagation
Strong encryption algorithms
Operational persistence
Extortion and negotiation mechanisms
Public data-leak threats

Ransomware is the only cyber threat category where the victim directly funds the attacker, creating a self-reinforcing economy.

2. Lifecycle of a Ransomware Attack

A ransomware intrusion follows a predictable multi-stage progression similar to APT-style attacks.

2.1 Initial Access

Common entry points:

Phishing emails with malicious attachments
Exploitation of unpatched vulnerabilities
Credential stuffing using leaked passwords
Compromised VPN appliances
Breached RDP endpoints

Attackers increasingly buy initial access from brokers, accelerating operations.

2.2 Lateral Movement

Once inside, attackers navigate the network to locate valuable assets.

Techniques include:

Harvesting credentials
Exploiting SMB shares
Moving via legitimate administrative tools
Searching for backup servers

This phase may last days or weeks.

2.3 Privilege Escalation

Attackers attempt to obtain:

Domain admin access
Backup deletion privileges
Key management access

The goal is to maximise blast radius before encryption.

2.4 Data Exfiltration

Modern ransomware groups often steal data before encryption.
This supports double extortion (encrypt + leak).

2.5 Encryption

Ransomware deploys strong cryptography, typically:

Symmetric encryption for speed (AES)
Asymmetric encryption for key security (RSA, ECC)

Backups, virtual machines, shared drives, and on-premise servers are common targets.

2.6 Extortion and Negotiation

Attackers issue ransom demands, often including:

Timers
Threats of public leaks
Instructions for cryptocurrency payment
Dedicated chat portals

Negotiation is now an organised process, with professionalised teams.

3. Ransomware Models and Variants

3.1 Crypto Ransomware

Encrypts data and demands payment for decryption keys.

3.2 Locker Ransomware

Locks the operating system entirely, often targeting consumers.

3.3 Double Extortion Ransomware

Encrypts data and also threatens to leak stolen information.

3.4 Triple Extortion Ransomware

Targets:

The victim organisation
Its customers or partners
The public, regulators, or media

3.5 Ransomware-as-a-Service (RaaS)

Affiliates rent ransomware toolkits from developers in exchange for a percentage of profits.

This business model has industrialised cyber extortion.

4. Why Ransomware Works: The Economics

Ransomware thrives because it is economically efficient for attackers and costly for victims.

4.1 High Rewards, Low Risk

Attackers enjoy:

Near-anonymity via cryptocurrency
International jurisdictional safe havens
Low operational costs

4.2 Scalable Operations

Ransomware campaigns run globally with minimal effort due to:

Automation
Toolkits
Affiliate networks
Access brokers

4.3 Victim Pressure

Victims face:

Operational downtime
Legal and regulatory penalties
Customer disruption
Reputational loss

Paying ransom often appears cheaper than prolonged downtime.

4.4 Insurance Complications

In some cases, insurance payouts indirectly incentivise ransom payments.

5. Impact of Ransomware

Ransomware impacts extend beyond financial loss.

5.1 Organisational Impact

Loss of business continuity
Permanent data loss
Incident response costs
Regulatory fines
Long-term reputational damage

5.2 Societal Impact

Ransomware has disrupted:

Hospitals
Energy pipelines
Schools
Government services
Emergency response systems

As digital infrastructure becomes essential, ransomware becomes a national security issue.

6. Defensive Strategies Against Ransomware

6.1 Preventive Measures

Email filtering and sandboxing
Patch management
Multi-factor authentication
Zero-trust network architecture
Endpoint detection and response

6.2 Containment Measures

Network segmentation
Privilege minimisation
Backup isolation (offline or immutable backups)
Lateral movement detection

6.3 Recovery Measures

Verified backup restoration
Business continuity planning
Forensic investigation
Legal and regulatory reporting

Ransomware defence requires an integrated approach, not isolated controls.

7. Case Study: WannaCry

WannaCry demonstrated how ransomware can weaponise a worm-like propagation mechanism.

Key elements:

Used EternalBlue exploit (MS17-010)
Spread autonomously across global networks
Crippled hospitals, logistics, and manufacturing
Highlighted the consequences of poor patch management

WannaCry remains a defining example of ransomware’s disruptive potential.

8. Reflection Questions

Why is ransomware more economically successful than other malware types?
How do double and triple extortion strategies change the defender’s calculus?
Which defensive measure provides the highest ROI for preventing ransomware impact?
Should governments prohibit ransom payments? What would be the consequence?

Summary

Ransomware is both a technical threat and an economic system. Its success is driven by strong cryptography, scalable operations, profitable extortion, and widespread organisational weaknesses. Understanding ransomware requires analysing not only the malware itself but the broader ecosystem that fuels its growth.
Mastering this foundation is essential before exploring botnets, APTs, supply chain compromises, and emerging threat models in later modules.