www.trendmicro.com
Open in
urlscan Pro
104.87.131.128
Public Scan
URL:
https://www.trendmicro.com/en_us/research/23/b/ransomware-evolution-part-1.html
Submission: On February 22 via api from TR — Scanned from DE
Submission: On February 22 via api from TR — Scanned from DE
Form analysis
3 forms found in the DOM<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
</td>
</tr>
</tbody>
</table>
</div>
</form>
<form class="main-menu-search" aria-label="Search Trend Micro">
<div class="main-menu-search__field-wrapper" id="cludo-search-form-mobile">
<table cellspacing="0" cellpadding="0" class="gsc-search-box" style="width:100%">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" size="10" class="gsc-input" name="search" title="search" placeholder="Search Trend Micro" autocomplete="off">
</td>
<td class="gsc-search-close collapsed" style="width:1%;" data-target="#search-mobile-wrapper" data-toggle="collapse">
<span class="icon-close"></span>
</td>
</tr>
</tbody>
</table>
</div>
</form>
POST #
<form class="acsb-form" data-acsb-search="form" enctype="multipart/form-data" action="#" method="POST"> <input type="text" tabindex="0" name="acsb_search" autocomplete="off" placeholder="Unclear content? Search in dictionary..."
aria-label="Unclear content? Search in dictionary..."> <i class="acsbi-search"></i> <i class="acsbi-chevron_down"></i> </form>
Text Content
Use Website In a Screen-Reader Mode Skip to Content ↵ENTER Skip to Menu ↵ENTER Skip to Footer ↵ENTER dismiss 0 Alerts undefined * No new notifications at this time. Download * Scan Engines * All Pattern Files * All Downloads * Subscribe to Download Center RSS Buy * Find a Partner * Home Office Online Store * Renew Online * Free Tools * Contact Sales * Locations Worldwide * 1-888-762-8736 (M-F 8am - 5pm CST) * Small Business * Buy Online * Renew Online Region * The Americas * United States * Brasil * Canada * México * Middle East & Africa * South Africa * Middle East and North Africa * Europe * België (Belgium) * Česká Republika * Danmark * Deutschland, Österreich Schweiz * España * France * Ireland * Italia * Nederland * Norge (Norway) * Polska (Poland) * Suomi (Finland) * Sverige (Sweden) * Türkiye (Turkey) * United Kingdom * Asia & Pacific * Australia * Центральная Азия (Central Asia) * Hong Kong (English) * 香港 (中文) (Hong Kong) * भारत गणराज्य (India) * Indonesia * 日本 (Japan) * 대한민국 (South Korea) * Malaysia * Монголия (Mongolia) and рузия (Georgia) * New Zealand * Philippines * Singapore * 台灣 (Taiwan) * ประเทศไทย (Thailand) * Việt Nam Log In * Business Support Portal * Log In to Support * Partner Portal * Home Solutions * My Account * Lost Device Portal * Trend Micro Vault * Password Manager * Customer Licensing Portal * Online Case Tracking * Worry-Free Business Security Services * Remote Manager * Cloud One * Referral Affiliate * Referral Affiliate Free trials * Cloud * Detection and Response * User Protection Folio (0) Contact Us * Contact Sales * Locations * Support * Find a Partner * Learn of upcoming events * Social Media Networks * Facebook * Twitter * Linkedin * Youtube * Instagram * 1-888-762-8736 (M-F 8-5 CST) Business Solutions Solutions Platform Trend Micro One By Challenge Understand, Prioritize & Mitigate Risks Secure Cloud-Native Apps Hybrid cloud transformation Securing your workforce infrastructure Eliminate network blindspots See more and respond faster Threats Agilely to Extending your team resources By Role CISO/CIO SOC Manager Infrastructure Manager Cloud Builder and Developer Cloud Security Ops By Industry Healthcare Manufacturing Oil & Gas Electric Utility Federal Automotive 5G Networks Products Products Cloud Security Cloud Security Overview Workload Security Cloud Security Posture Management Container Security File Storage Security Endpoint Security Network Security Open Source Security Cloud Visibility Network Security Network Security Overview Network Intrusion Prevention (IPS) Breach Detection System (BDS) Secure Service Edge (SSE) OT & ICS Security Endpoint & Email Security Endpoint & Email Security Overview Endpoint Protection Email Security Mobile Security Security Operations Security Operations Overview Attack Surface Management XDR (Extended Detection & Response) Threat Intelligence All Products & Trials Our Unified Platform Service Packages Small & Midsize Business Security Services Services Our Services Service Packages Managed XDR Support Services Research Research Research About Our Research Research, News and Perspectives Research and Analysis Blog Security Reports Security News Zero Day Initiatives (ZDI) Resources CISO Resource Center DevOps Resource Center Cyber Risk Index/Assessment Threat Encyclopedia What Is? Glossary of Terms EXPLORE THE CYBER RISK INDEX (CRI) Use the CRI to assess your organization’s preparedness against attacks, and get a snapshot of cyber risk across organizations globally. Calculate your risk Partners Partners Channel Partners Channel Partner Overview Managed Service Provider Cloud Service Provider Professional Services Resellers Marketplace System Integrators Alliance Partners Alliance Overview Technology Alliance Partners Our Alliance Partners Partner Tools Partner Login Education and Certification Partner Successes Distributors Find a Partner About About Why Trend Micro The Trend Micro Difference Customer Success Stories The Human Connections Industry Accolades Strategic Alliances Company Trust Center History Diversity, Equity & Inclusion Corporate Social Responsibility Leadership Security Experts Internet Safety and Cybersecurity Education Legal Resources Newsroom Events Investors Careers Webinars × Folio (0) 0 Alerts undefined * No new notifications at this time. Download * Scan Engines * All Pattern Files * All Downloads * Subscribe to Download Center RSS Buy * Find a Partner * Home Office Online Store * Renew Online * Free Tools * Contact Sales * Locations Worldwide * 1-888-762-8736 (M-F 8am - 5pm CST) * Small Business * Buy Online * Renew Online Region * The Americas * United States * Brasil * Canada * México * Middle East & Africa * South Africa * Middle East and North Africa * Europe * België (Belgium) * Česká Republika * Danmark * Deutschland, Österreich Schweiz * España * France * Ireland * Italia * Nederland * Norge (Norway) * Polska (Poland) * Suomi (Finland) * Sverige (Sweden) * Türkiye (Turkey) * United Kingdom * Asia & Pacific * Australia * Центральная Азия (Central Asia) * Hong Kong (English) * 香港 (中文) (Hong Kong) * भारत गणराज्य (India) * Indonesia * 日本 (Japan) * 대한민국 (South Korea) * Malaysia * Монголия (Mongolia) and рузия (Georgia) * New Zealand * Philippines * Singapore * 台灣 (Taiwan) * ประเทศไทย (Thailand) * Việt Nam Log In * Business Support Portal * Log In to Support * Partner Portal * Home Solutions * My Account * Lost Device Portal * Trend Micro Vault * Password Manager * Customer Licensing Portal * Online Case Tracking * Worry-Free Business Security Services * Remote Manager * Cloud One * Referral Affiliate * Referral Affiliate Free trials * Cloud * Detection and Response * User Protection Folio (0) Contact Us * Contact Sales * Locations * Support * Find a Partner * Learn of upcoming events * Social Media Networks * Facebook * Twitter * Linkedin * Youtube * Instagram * 1-888-762-8736 (M-F 8-5 CST) * No new notifications at this time. * No new notifications at this time. * Scan Engines * All Pattern Files * All Downloads * Subscribe to Download Center RSS * Find a Partner * Home Office Online Store * Renew Online * Free Tools * Contact Sales * Locations Worldwide * 1-888-762-8736 (M-F 8am - 5pm CST) * Small Business * Buy Online * Renew Online * The Americas * United States * Brasil * Canada * México * Middle East & Africa * South Africa * Middle East and North Africa * Europe * België (Belgium) * Česká Republika * Danmark * Deutschland, Österreich Schweiz * España * France * Ireland * Italia * Nederland * Norge (Norway) * Polska (Poland) * Suomi (Finland) * Sverige (Sweden) * Türkiye (Turkey) * United Kingdom * Asia & Pacific * Australia * Центральная Азия (Central Asia) * Hong Kong (English) * 香港 (中文) (Hong Kong) * भारत गणराज्य (India) * Indonesia * 日本 (Japan) * 대한민국 (South Korea) * Malaysia * Монголия (Mongolia) and рузия (Georgia) * New Zealand * Philippines * Singapore * 台灣 (Taiwan) * ประเทศไทย (Thailand) * Việt Nam * Business Support Portal * Log In to Support * Partner Portal * Home Solutions * My Account * Lost Device Portal * Trend Micro Vault * Password Manager * Customer Licensing Portal * Online Case Tracking * Worry-Free Business Security Services * Remote Manager * Cloud One * Referral Affiliate * Referral Affiliate * Cloud * Detection and Response * User Protection * Contact Sales * Locations * Support * Find a Partner * Learn of upcoming events * Social Media Networks * Facebook * Twitter * Linkedin * Youtube * Instagram * 1-888-762-8736 (M-F 8-5 CST) undefined Ransomware A Deep Dive into the Evolution of Ransomware Part 1 Subscribe Content added to Folio Folio (0) close Ransomware A DEEP DIVE INTO THE EVOLUTION OF RANSOMWARE PART 1 This 3-part blog series takes an in-depth look at the evolution of ransomware business models, from the early stages to current trends. By: Trend Micro February 21, 2023 Read time: 4 min (1000 words) Save to Folio Subscribe -------------------------------------------------------------------------------- Ransomware has become a notorious and damaging form of malware, inflicting financial losses on enterprises, governments, healthcare organizations and core infrastructure. Ransomware has been a very profitable activity for malicious actors. However, we want to investigate what would cause changes in this business model—both in the far future and near future. Our team conducted comprehensive research to understand the future of ransomware. We studied various scenarios, from focusing on risk assessment and avoiding capture by authorities, to exploring more financially advantageous opportunities cybercriminals may come across in their operations. It appears that geopolitical events such as Russia's 2022 invasion of Ukraine can be triggers for this change along with proactive defence strategies employed by authorities' network hardening tools, arrests against criminal gangs and cryptocurrency regulations designed to reduce money laundering risks. We believe these conditions will help create an environment where malicious activity associated with ransomware is now less attractive to cybercriminals. The ransomware evolution Figure 1. Summarized timeline of ransomware changes Fake virus Before mapping out what the future brings for ransomware and its implication for cybersecurity, it’s vital to look back at its evolution over the years. In the past decade, ransomware attacks have become an increasingly common threat in the digital world. To understand these malicious tactics better, we can look to earlier forms of ransom-requesting malware such as “Fake Antivirus” software and “Locker” malware. Both methods involve hijacking a computer system's data while attempting to persuade users into paying up with various scare tactics. However, Fake AV was particularly successful from 2005 - 2010 due to its ability to convince many people that their computers were infected even when they weren't. This eventually led it to gain press attention which subsequently caused its effectiveness (and popularity) among hackers to decline significantly over time. Locker malware By 2010, Locker malware had become a prevalent threat. Rather than usual viruses that are designed to disrupt computers, this malicious code enabled attackers to completely lock users out until they paid money in exchange for access and often posed as a "fine" from fake law enforcement agencies. However, due to its high-profile coverage and exposure by the media, victims soon became aware of these ruses. Encrypting ransomware Ransomware attacks have become an all-too-common occurrence since 2015, targeting users' files with a powerful encryption algorithm and demanding payment to unlock them. This type of attack is particularly effective; once the computer system has been infected, victims are helplessly entrapped. As such, ransomware poses a serious threat to individuals and organizations alike. The wave of ransomware attacks that swept across the world using Bitcoin payments has allowed attackers to evade law enforcement and receive payment more easily. Common perpetrators included CryLock and Dharma/Crysis who initially employed mass-mailed downloads or links attached to email messages as their main vector for delivering malware - a method often able to bypass anti-spam filters in its indiscriminate spread. Modern ransomware Figure 2 Clop ransomware’s routine changes deployed by different groups As ransomware continues to evolve, intruders have become increasingly targeted in their attacks. In 2019, newer versions of this malicious software infiltrated the network via hacking or other means. After assessing for valuable data, they moved laterally within it to gain administrative privileges before encrypting that information and asking for a ransom payment. Among the most well-documented variants are Conti, Clop & LockBit. Ransomware attacks have evolved into sophisticated strategies, combining encryption with additional tactics to persuade victims to pay. Tactics range from publishing data bit by bit in an attempt to increase pressure on targets through more aggressive measures, making these threats all the harder for organisations and individuals alike to protect against. When it comes to extortion, criminals don't just settle for a basic demand. In recent years, ransomware attacks have evolved from double-extortion threats of data disclosure into triple and quadruple extortions using additional pressure points such as the threat of distributed denial of service (DDoS) attacks on networks or harassing victims through social media platforms like clients and suppliers. The ultimate goal remains: financial gain via ransom payments at any cost. Key underground services that enable ransomware Ransomware has become an integral part of a sophisticated criminal ecosystem. Several actors may play key roles in the ransomware process, from pre- to post-attack. These phases are critical for successful implementation - understanding them is essential to protecting yourself against potentially devastating attacks. Some underground phases that enable ransomware: * Initial access Gaining access to a network is frequently done through malicious email campaigns which contain backdoors, targeting enterprises with specific social engineering techniques and exploiting vulnerabilities in internet-facing systems. Additionally, some ransomware actors purchase initial access from sellers of specialized services or gain it themselves. * Lateral movement and privilege escalation In this phase, an attacker tries to penetrate deeper into the victim’s network and tries to get elevated privileges with standard or custom hacking tools. * Sensitive data exfiltration When the lateral movement phase is a success, the attacker is likely to get their hands on private data and will try to exfiltrate it. In addition, the stolen data is analyzed to determine the ransom amount and whether the company has cyber insurance. * Backup systems’ disruption The attacker tries to lower the chances of the victim’s capability to potentially restore systems from backups by disrupting the backup processes and systems. * Ransomware payload deployment In this phase, an attacker deploys ransomware that can lead to serious problems for the victim: data files are encrypted and IT systems become unusable. * Extortion The attacker extorts the victim. Two ways are particularly harmful: the victim gets a decryption key for the encrypted data only after paying a ransom, or the threat actor threatens to release stolen data if the victim does not pay a ransom. In part two, we’ll discuss triggers that may cause ransomware actors to shift business models that could prompt them to start a ransomware revolution. Tags Research | Privacy & Risks | Cyber Threats | ICS OT | IoT | Ransomware | Articles, News, Reports AUTHORS * Trend Micro Research, News, and Perspectives Contact Us Subscribe RELATED ARTICLES * Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers * In Review: What GPT-3 Taught ChatGPT in a Year * Earth Kitsune Delivers New WhiskerSpy Backdoor via Watering Hole Attack See all articles * Contact Sales * Locations * Careers * Newsroom * Trust Center * Privacy * Accessibility * Support * Site map * linkedin * twitter * facebook * youtube * instagram * rss Copyright © 2023 Trend Micro Incorporated. All rights reserved. sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk This website uses cookies for website functionality, traffic analytics, personalization, social media functionality and advertising. Our Cookie Notice provides more information and explains how to amend your cookie settings.Learn more Cookies Settings Accept English Accessibility Adjustments Reset Settings Statement Hide Interface Choose the right accessibility profile for you OFF ON Seizure Safe Profile Clear flashes & reduces color This profile enables epileptic and seizure prone users to browse safely by eliminating the risk of seizures that result from flashing or blinking animations and risky color combinations. OFF ON Vision Impaired Profile Enhances website's visuals This profile adjusts the website, so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. OFF ON ADHD Friendly Profile More focus & fewer distractions This profile significantly reduces distractions, to help people with ADHD and Neurodevelopmental disorders browse, read, and focus on the essential elements of the website more easily. OFF ON Cognitive Disability Profile Assists with reading & focusing This profile provides various assistive features to help users with cognitive disabilities such as Autism, Dyslexia, CVA, and others, to focus on the essential elements of the website more easily. OFF ON Keyboard Navigation (Motor) Use website with the keyboard This profile enables motor-impaired persons to operate the website using the keyboard Tab, Shift+Tab, and the Enter keys. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements. Note: This profile prompts automatically for keyboard users. OFF ON Blind Users (Screen Reader) Optimize website for screen-readers This profile adjusts the website to be compatible with screen-readers such as JAWS, NVDA, VoiceOver, and TalkBack. A screen-reader is software that is installed on the blind user’s computer and smartphone, and websites should ensure compatibility with it. Note: This profile prompts automatically to screen-readers. Content Adjustments Content Scaling Default Readable Font Highlight Titles Highlight Links Text Magnifier Adjust Font Sizing Default Align Center Adjust Line Height Default Align Left Adjust Letter Spacing Default Align Right Color Adjustments Dark Contrast Light Contrast High Contrast High Saturation Adjust Text Colors Cancel Monochrome Adjust Title Colors Cancel Low Saturation Adjust Background Colors Cancel Orientation Adjustments Mute Sounds Hide Images Read Mode Reading Guide Useful Links Select an option Home Header Footer Main Content Stop Animations Reading Mask Highlight Hover Highlight Focus Big Black Cursor Big White Cursor HIDDEN_ADJUSTMENTS Keyboard Navigation Accessible Mode Screen Reader Adjustments Read Mode Web Accessibility By Learn More Choose the Interface Language English Español Deutsch Português Français Italiano עברית 繁體中文 Pусский عربى عربى Nederlands 繁體中文 日本語 Polski Türk Accessibility StatementCompliance status We firmly believe that the internet should be available and accessible to anyone and are committed to providing a website that is accessible to the broadest possible audience, regardless of ability. To fulfill this, we aim to adhere as strictly as possible to the World Wide Web Consortium’s (W3C) Web Content Accessibility Guidelines 2.1 (WCAG 2.1) at the AA level. These guidelines explain how to make web content accessible to people with a wide array of disabilities. Complying with those guidelines helps us ensure that the website is accessible to blind people, people with motor impairments, visual impairment, cognitive disabilities, and more. This website utilizes various technologies that are meant to make it as accessible as possible at all times. We utilize an accessibility interface that allows persons with specific disabilities to adjust the website’s UI (user interface) and design it to their personal needs. Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. If you wish to contact the website’s owner please use the website's form Screen-reader and keyboard navigation Our website implements the ARIA attributes (Accessible Rich Internet Applications) technique, alongside various behavioral changes, to ensure blind users visiting with screen-readers can read, comprehend, and enjoy the website’s functions. As soon as a user with a screen-reader enters your site, they immediately receive a prompt to enter the Screen-Reader Profile so they can browse and operate your site effectively. Here’s how our website covers some of the most important screen-reader requirements: 1. Screen-reader optimization: we run a process that learns the website’s components from top to bottom, to ensure ongoing compliance even when updating the website. In this process, we provide screen-readers with meaningful data using the ARIA set of attributes. For example, we provide accurate form labels; descriptions for actionable icons (social media icons, search icons, cart icons, etc.); validation guidance for form inputs; element roles such as buttons, menus, modal dialogues (popups), and others. Additionally, the background process scans all of the website’s images. It provides an accurate and meaningful image-object-recognition-based description as an ALT (alternate text) tag for images that are not described. It will also extract texts embedded within the image using an OCR (optical character recognition) technology. To turn on screen-reader adjustments at any time, users need only to press the Alt+1 keyboard combination. Screen-reader users also get automatic announcements to turn the Screen-reader mode on as soon as they enter the website. These adjustments are compatible with popular screen readers such as JAWS, NVDA, VoiceOver, and TalkBack. 2. Keyboard navigation optimization: The background process also adjusts the website’s HTML and adds various behaviors using JavaScript code to make the website operable by the keyboard. This includes the ability to navigate the website using the Tab and Shift+Tab keys, operate dropdowns with the arrow keys, close them with Esc, trigger buttons and links using the Enter key, navigate between radio and checkbox elements using the arrow keys, and fill them in with the Spacebar or Enter key. Additionally, keyboard users will find content-skip menus available at any time by clicking Alt+2, or as the first element of the site while navigating with the keyboard. The background process also handles triggered popups by moving the keyboard focus towards them as soon as they appear, not allowing the focus to drift outside. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements. Disability profiles supported on our website * Epilepsy Safe Profile: this profile enables people with epilepsy to safely use the website by eliminating the risk of seizures resulting from flashing or blinking animations and risky color combinations. * Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. * Cognitive Disability Profile: this profile provides various assistive features to help users with cognitive disabilities such as Autism, Dyslexia, CVA, and others, to focus on the essential elements more easily. * ADHD Friendly Profile: this profile significantly reduces distractions and noise to help people with ADHD, and Neurodevelopmental disorders browse, read, and focus on the essential elements more easily. * Blind Users Profile (Screen-readers): this profile adjusts the website to be compatible with screen-readers such as JAWS, NVDA, VoiceOver, and TalkBack. A screen-reader is installed on the blind user’s computer, and this site is compatible with it. * Keyboard Navigation Profile (Motor-Impaired): this profile enables motor-impaired persons to operate the website using the keyboard Tab, Shift+Tab, and the Enter keys. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements. Additional UI, design, and readability adjustments 1. Font adjustments – users can increase and decrease its size, change its family (type), adjust the spacing, alignment, line height, and more. 2. Color adjustments – users can select various color contrast profiles such as light, dark, inverted, and monochrome. Additionally, users can swap color schemes of titles, texts, and backgrounds with over seven different coloring options. 3. Animations – epileptic users can stop all running animations with the click of a button. Animations controlled by the interface include videos, GIFs, and CSS flashing transitions. 4. Content highlighting – users can choose to emphasize essential elements such as links and titles. They can also choose to highlight focused or hovered elements only. 5. Audio muting – users with hearing devices may experience headaches or other issues due to automatic audio playing. This option lets users mute the entire website instantly. 6. Cognitive disorders – we utilize a search engine linked to Wikipedia and Wiktionary, allowing people with cognitive disorders to decipher meanings of phrases, initials, slang, and others. 7. Additional functions – we allow users to change cursor color and size, use a printing mode, enable a virtual keyboard, and many other functions. Assistive technology and browser compatibility We aim to support as many browsers and assistive technologies as possible, so our users can choose the best fitting tools for them, with as few limitations as possible. Therefore, we have worked very hard to be able to support all major systems that comprise over 95% of the user market share, including Google Chrome, Mozilla Firefox, Apple Safari, Opera and Microsoft Edge, JAWS, and NVDA (screen readers), both for Windows and MAC users. Notes, comments, and feedback Despite our very best efforts to allow anybody to adjust the website to their needs, there may still be pages or sections that are not fully accessible, are in the process of becoming accessible, or are lacking an adequate technological solution to make them accessible. Still, we are continually improving our accessibility, adding, updating, improving its options and features, and developing and adopting new technologies. All this is meant to reach the optimal level of accessibility following technological advancements. If you wish to contact the website’s owner, please use the website's form Hide Accessibility Interface? Please note: If you choose to hide the accessibility interface, you won't be able to see it anymore, unless you clear your browsing history and data. Are you sure that you wish to hide the interface? Accept Cancel Continue Processing the data, please give it a few seconds... Press Alt+1 for screen-reader mode Sumo