06 Apr 2022

Everything to Know About Ransomware: The Anatomy & Investigations of Ransomware Attacks

Maltego Team

Executive Summary 🔗︎

Ransomware is a type of software that encrypts users’ data, ensuring that they can no longer recover it without payment. It has been around since about 1989 and has become a very lucrative business with a bleeding impact on organizations: Financial cost of pay-out, loss of reputation, agencies’ fines, permanent data loss, operational loss, clean-up/damage repair costs. As ransomware attacks rise alongside the massive adoption of technology and cryptocurrency, they have also evolved to implement non-monetary extortion threats and RaaS (Ransomware-as-a-Service) strategy to urge victims into submitting payments.

In this whitepaper, we will guide you through the anatomy of ransomware attacks—including the threat actors, their operational processes and roles, and more—as well as the investigative workflows, data, and tools that support effective ransomware investigations.

Key Takeaways 🔗︎

  • Around since 1989, ransomware is a type of malware that encrypts the victim’s data and only giving them access once payment, or a ransom, has been provided.
  • IBM Ponemon Institute states that the average cost of a ransomware breach in 2021 was estimated at $4.62 million. Chainalysis states in their 2021 report that ransomware payment size was over $118,000 in 2021, up from $88,000 in 2020 and $25,000 in 2019, with some large payments such as the record $40 million received by Phoenix Cryptolocker.
  • Threat actors nowadays follow a collaborative operational model called “Ransomware-as-a-Service (RaaS)” and divide the operation into three roles: Operators, Affiliates, and Initial Combat Brokers.
  • Ransomware investigations usually involve the following steps: Mapping the threat landscape, identifying attach surface, threat hunting in internal networks, TTP investigations, and finally, follow-the-money investigations.
  • Maltego provides a number of data integrations to aid the different steps in a ransomware investigation and helps investigators easily visualize data relationships between data points from different data sources. 

Understanding Ransomware Threats 🔗︎

Although it has been the most remarkable cyberthreat in the last years, ransomware is not something new in the cybersecurity arena: The first malware asking for a ransom payment dates back to 1989. The invention of Bitcoin in 2008 (facilitating anonymous payments), the professionalization of cybercrime growing up heavily a few years later (strong collaboration and exchange in dark web hacking forums and markets), and the massive adoption of technology (with relevant vulnerabilities and high-impact exploits from time to time) has probably generated the “perfect storm” for them.

Ransomware Evolution: Timeline from 1989 to 2019

Ransomware, as a malware specimen, is a relatively simple piece of software that encrypts a victim’s data, making it theoretically unrecoverable, and demanding payment in exchange for recovery. It is mainly used by threat actors during the last stage of a network compromise. This means that, before its detonation, an initial entry vector was abused, and several steps were taken afterward to silently pivot and land into other highly relevant assets in the organization. During that breach, attackers will be trying to obtain enough privileges to launch data encryption and wipe everything out, including mirrored data and online backups, even hosted in alternative systems for business continuity purposes. It must be noted that their extortion activities do not just stop at asking a ransom for data recovery, but also heavily pressuring victims by threatening to leak stolen information, including customer data, intellectual property, etc.

IBM Ponemon Institute states that the average cost of a ransomware breach in 2021 was estimated at $4.62 million. We are talking about a very lucrative business with a bleeding impact on organizations: Financial cost of pay-out, loss of reputation, agencies’ fines, permanent data loss, operational loss, clean-up/damage repair costs.

Chainalysis states in their 2021 report that there were more active ransomware strains than any other year, at least 140 of them received payments from victims at any point in 2021, compared to 119 in 2020, and 79 in 2019. The same study indicates that ransomware payment size was over $118,000 in 2021, up from $88,000 in 2020 and $25,000 in 2019, with some large payments such as the record $40 million received by Phoenix Cryptolocker. One reason for the mentioned increase in ransom sizes is ransomware attackers’ focus on carrying out highly targeted attacks against large organizations.

Top 10 most active strains in 2021 by monthly revenue

Average ransomware payment size, 2016 - 2021

Ransomware as a Service (RaaS) & RaaS Players 🔗︎

As you will notice, there are many stages and different tools involved in a ransomware attack. The criminal hacking industry, as in any other software and services one, requires specialization and a strong partnership program as the most reasonable step to compete in this business. Nowadays, this is no longer a “Blue Ocean” as there are many threat actors competing to compromise a big ecosystem.

The most common trend in this ecosystem is following a collaborative operational model known as Ransomware as a Service (RaaS) with three clear roles: Operators, Affiliates, and Initial Access Brokers (IABs).

Download this whitepaper now to learn more about: 🔗︎

  • RaaS attack groups and the roles of Operators, Affiliates, and Initial Access Brokers
  • Attack trends of RaaS and their Tactics, Techniques, and Procedures (TTPs)
  • The 6 aspects of a ransomware investigation
  • Top OSINT Tools and data providers for ransomware investigations

6 Aspects of Ransomware Investigations

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +995
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.