Ransomware is a fast growing cybercrime. The most common ransomware technique involves locking your computer to prevent you from accessing it until you pay a ransom. While this digital extortion racket is not new, cybercriminals have improved on how the scheme works with the creation of cryptware, which encrypts the files on the computer using a private key that only the attacker possesses.

The beginnings of ransomware could be traced to floppy disks being sent to individuals inviting them to take a survey assessing their risk of contracting AIDS. When the disk was inserted, its software locked their computers and demanded $189 in cash be sent to a P.O. box in Panama.

Ransomware victims range from large corporations, to hospitals, small and medium enterprises, to individuals.

Instead of a single or group of cybercriminals writing ransomware and distributing it themselves, ransomware authors will open their code for use by other cybercriminals. According to a McAfee-CSIS report more than 6,000 illegal online marketplaces now sell ransomware products and services, offering more than 45,000 different products! Ransomware-as-a-Service (RaaS) allows authors to set up platforms where others can modify and deploy to their own targets.

Rather than attacking just one device, ransomware worms are self-replicating viruses that embed themselves into parts of a device’s operating system that are run automatically.  The worms work their way through networks to lock out many more computers than just the initial target. The WannaCry incident showed how these worms work, and it is likely that we will see more attacks like this.It is common for worms to be noticed only when their uncontrolled replication consumes system resources, slowing or halting other tasks.