Ransomware

What Is Ransomware?

Most attacks on computers try to stay hidden. This one announces itself. After the program runs, files stop opening and a note appears on screen with a price, a deadline and a payment address. The victim learns about the attack at the exact moment the attacker wants to be paid.

Extortion by software is older than crypto, but crypto made it scale. Early schemes in the 2000s asked for prepaid cards or wire transfers, which police could often trace or block. When CryptoLocker spread in 2013, it accepted payment in bitcoin, a currency that worked across borders, settled without a bank and did not require the attacker to open an account in their own name.

The model then grew into an industry. Ransomware-as-a-service groups write the software and run the payment sites, while affiliates break into victims and keep most of each ransom, often around 70% to 80%.

How Does Ransomware Work?

An attack moves through four steps: entry, spread, encryption and extortion. Entry usually comes through a phishing attack, a stolen remote-access password or an unpatched server. Once inside, attackers spend days or weeks spreading across the network, deleting backups and copying sensitive files. Only then do they trigger encryption on every machine at once.

Encryption relies on the same public-key cryptography that secures the internet. The malware encrypts files with a fast symmetric key, then locks that key with the attacker’s public key. Without the attacker’s private key, recovering the files by force would take longer than the age of the universe.

Consider a hypothetical manufacturer whose plants go offline. Each day of downtime costs $2 million in lost output and penalties. The attackers demand $5 million in bitcoin, and the company’s backups were wiped during the spread phase.

On a pure cost basis, paying looks cheaper than three days of shutdown, and that arithmetic is what the attackers count on. Yet a paid decryptor is often slow and buggy, restoring systems can still take weeks, and the copied data may leak anyway. The lesson most security teams draw is that the decision is made months earlier, when the company chooses whether to keep offline backups.

Types of Ransomware

Crypto ransomware encrypts files and leaves the operating system running so the victim can read the ransom note and pay. Locker ransomware blocks access to the whole device without necessarily encrypting files, and it was common on phones.

Double extortion steals data before encrypting it, then threatens to publish it on a leak site if the victim restores from backup instead of paying. Some groups skip encryption entirely and run pure data-theft extortion, while others add pressure through DDoS attacks or calls to the victim’s customers.

Ransomware vs. Other Malware

Why Is Ransomware Important for Traders?

Ransomware is the clearest case of crypto’s traceability cutting both ways. In May 2021, the Colonial Pipeline operator paid the DarkSide group 75 BTC, worth about $4.4 million, after an attack that led it to shut down the largest fuel pipeline on the US East Coast. Weeks later, the US Justice Department seized 63.7 BTC of that ransom from an address whose key it had obtained. Because bitcoin had fallen in the meantime, the recovered coins were worth about $2.3 million.

That traceability shapes the market around attackers. Ransom addresses are flagged by analytics firms, and centralised exchanges that run KYC/AML compliance checks can freeze deposits linked to them. As a result, many groups ask for Monero or charge more for bitcoin, and regulators point to ransomware when they push exchanges to restrict privacy coins.

The limitation for defenders is that tracing a payment is not the same as stopping the crime. Most gangs operate from countries that do not extradite, rebrand under new names after takedowns and launder funds through mixers and cross-chain swaps. For an individual trader, the practical risk is smaller but real: encrypted wallet files on an infected laptop are recoverable only if the seed phrase was backed up offline.

Key Takeaways

• Ransomware is malware that encrypts or steals data and demands a payment, usually in cryptocurrency, for a decryption key or for silence.
• Modern attacks follow four steps: entry, quiet spread across the network, simultaneous encryption and an extortion demand backed by a threat to leak data.
• Crypto let ransomware scale because payments cross borders without a bank, but public blockchains also let investigators trace and sometimes seize ransoms.
• Paying does not guarantee recovery, can fund further attacks and may break sanctions rules, so offline backups remain the main defence.
• For individual holders, a seed phrase stored offline turns an encrypted wallet file into an inconvenience rather than a loss.