Ransomware

Explained

Understanding the Ransomware Ecosystem – From RaaS Operators to Ransom Demands to How Ransomware Attacks Work

While its origins stretch back decades, it’s only in more recent years that ransomware has become a major threat for organizations of all sizes and industries, with ransomware-as-a-service (RaaS) operators and affiliates dominating the threat landscape.

Understanding ransomware — from its origins to its impacts to the TTPs that allow ransomware gangs to exploit victim organizations and make off with millions in ransom payments and extortion fees — is the key to defending against it.

Even when a company employs leading-edge security tools and robust processes throughout its organization, it still is at risk. But exploring the world of ransomware and the motives of threat actors can help you better understand where your organization may be vulnerable and how you can protect it more effectively.

01

The History of Ransomware

The History of Ransomware
02

Dominant Ransomware Groups

Dominant Ransomware Groups
03

What Is the True Cost of Ransomware?

What Is the True Cost of Ransomware?
04

Most Targeted Industries

Most Targeted Industries
05

How Ransomware Works

How Ransomware Works
06

How to Defend Against Ransomware

How to Defend Against Ransomware

01 The History of Ransomware

The ransomware we know today began decades ago with a floppy disk. Since then, it’s seen evolution after evolution, driven by technological advances such as email, bitcoin, and the dark web.

The highlights include:

1980s AND 90s

First Recorded Attack

Ransomware has existed since the 1980s, with the first recorded attack occurring in 1989. This first strain of ransomware — the AIDS Trojan — was easy to remove, rendering it ineffective.
Read More

EARLY 2000s

Archievus Appears

The first strain to use advanced RSA encryption —Archievus — appears.

2010s

Cryptocurrencies

Bitcoin, along with other cryptocurrencies, gain popularity, giving threat actors an avenue for collecting often untraceable, digital payment.

Ransomware-as-a-service Arrives

The first instance of ransomware-as-a-service (RaaS) occurs with Reveton ransomware. The malware would impersonate local law enforcement, threatening victims with arrest or criminal charges if they did not pay.

WannaCry Impact

WannaCry ransomware hits hundreds of thousands of devices across more than 150 countries, making it one of the biggest ransomware attacks in history.

Data Exfiltration

Ransomware starts to utilize data exfiltration, first executed with the GrandCrab strain, which was integrated with a file-stealing malware.

Dark Web Leak Sites

Leak sites begin to pop up on the dark web, exposing victims to further financial and reputational losses, as well as allowing for stolen credentials and personally identifiable information (PII) to be used in future attacks.

VIEW FULL TIMELINE

Want to explore ransomware’s dark history in full?

See our complete timeline.

02

Ransomware Groups Behind Dominant Ransomware Variants in 2024

Focusing on engagements in which the Arctic Wolf Incident Response team confidently attributed an attack to a particular ransomware variant, the five variants we encountered the most in 2024 were BlackCat (AlphV), LockBit 3.0, Akira, Royal, and BlackBasta.

Group Name

Akira

Group Name

LockBit 3.0
Initially “ABCD,” changed name to LockBit in 2020

Group Name

Play

Group Name

Fog

Group Name

Black Suit

The Blurred Lines of the Ransomware Ecosystem

While ransomware variants originate from specific ransomware operators, behind the scenes, the ransomware ecosystem has blurred lines:

Individual ransomware groups often work with many different affiliates

Affiliates may use several different ransomware variants — from different groups — concurrently

The ransomware groups behind some of the most in-use variants have made claim to some of the biggest attacks in recent memory, including:

The U.K. Royal Mail and Boeing By: Lockbit

CDK GlobalBy: black suit

The City of OaklandBy: Play

Krispy Kreme By: play

Nissan Australia By: Akira

LockBit, and a handful of other ransomware groups, dominated the RaaS space in 2024, as they did the year prior. This demonstrates both the continuing effectiveness of their operating models and their ability to evade law enforcement — or at least it did.

Law Enforcement Gains Success Striking Back

Despite some of the more prolific groups that have remained active over multi-year periods, international law enforcement operations are having success taking down ransomware operations,¹ shuttering dark web marketplaces,² and closing cryptocurrency mixers/tumblers³ that facilitate laundering of ransomware proceeds.

One of the most active ransomware operators of 2022, Hive, was infiltrated and taken down in January 2023, as announced by Europol and the U.S. Department of Justice.⁴

The RaaS group’s payment and data leak sites were seized as part of the international law enforcement operation. This operation captured the group’s decryption keys and offered them to victims worldwide, saving victims over $130 million in potential ransom payments.

AlphV, also known as BlackCat, made headlines multiple times in late 2023. First, with their move to file a with the Securities and Exchange Commission (SEC) against a victim company⁵ as a new pressure tactic, outing the victim for not filing a disclosure in response to becoming one of the group’s latest victims.

By December, AlphV found themselves in the crosshairs of international law enforcement, when the FBI disrupted its operations and released a decryption tool that allowed compromised victims to recover their data. In response to an escalating game of tug-of-war with law enforcement, AlphV promptly moved victim notifications to a different site.⁶ To date, the new AlphV-owned site continues to post victims.

During this period, which (at least for now) appears to be a temporary setback, AlphV offered incentives to retain its criminal affiliates, who were likely feeling the heat from the close call with the FBI. The FBI operation also gave other ransomware groups like LockBit an opportunity to poach AlphV affiliates.⁷

View Section Sources

In February 2024, the pressure on many of these groups only intensified as the U.S. Department of State announced $15 million (USD) bounties on three of the most prolific RaaS operators: AlphV, LockBit, and Hive.⁸ A reward of up to $10 million (USD) is available for information leading to the identification or location of any individual(s) who hold a key leadership position in these transnational organized crime groups, along with a reward of up to $5 million (USD) for information leading to the arrest and/or conviction of any individual conspiring to participate in, or attempting to participate in, the three named group’s ransomware activities.

What does this mean for the threat landscape facing today’s organizations?

More groups are competing for the attention and allegiance of more affiliates, with affiliates responding to economic incentives by aligning with groups that have the most reliable tools, strongest track record of fulfilling their agreements, and greatest ability to evade law enforcement.

As the saying goes, no animal is more dangerous than when it’s cornered, and right now ransomware groups are feeling cornered. We expect to see more ambitious ransoms, stricter negotiations, more aggressive naming and shaming, and further experimentation with new tactics throughout 2024.

It’s also possible that some operators will decide to retire altogether or shift to an alternative form of cybercrime, like business email compromise (BEC).

2025 Arctic Wolf Security Operations

The second annual Security Operations Report demonstrates how Arctic Wolf’s world-class SOC closes the effectiveness gap.

03 What Is the True Cost of Ransomware?

According to Chainalysis, ransomware payments in 2024 totaled $813.55 million (USD) in 2024. This is a significant drop from 2024, where the total was over a billion, the highest number ever observed, and the average cost of a ransomware attack reached $5.08 million (USD) source: IBM according to the 2025 IBM Cost of a Data Breach report, up 11% from the average cost of $4.54 million (USD) in the 2022 report. While the global total may have dropped, 2024 saw the largest ransom payment on record. A Fortune 50 company reportedly paid a staggering $75 million (USD) in Bitcoin to the Dark Angels group.

And while most in the cybersecurity community have grown accustomed to seeing these massive ransom payment figures, most of the costs incurred from ransomware attacks have nothing to do with the ransom demanded. Lost productivity and the recovery time required to get IT systems running and back to normal operating levels are significant expenses incurred by organizations in the aftermath of a ransomware attack.

Common Costs Associated with a Ransomware Attack

View a detailed breakdown of expected ransomware costs estimated against an organization’s annual revenue.

$0-25M $25M-$150M $150M-$500M $500M+

Organizations with $0-$25M Annual Revenues

Well-Known Costs:

Forensics
Incident Response Legal Counsel
Restoration & Recovery
Notifications to Customers and Vendor Costs
PR Costs
Regulatory Fines

$409K

Lesser-Known Costs:

Ransom Payment
Lawsuits
Data Mining
Credit Monitoring

$1.4M

Where insurance coverage (typically) ends

$338K

Revenue
Downtime

22 days of lost profits¹

$61K

Wasted
Payroll

50% of employees not producing for 22 days

$140K

Loss of Future
Revenues

10% drop in profits from lost revenues for the following 3 months ^2,4

$972K

Company Valuation
Decline

3% lower stock price after 6 months^3,4

View Section Sources

¹Statista: Average Duration of Downtime After a Ransomware Attack
²Forbes: Target Profit Falls 46% On Credit Card Breach And The Hits Could Keep On Coming
³Comparitech: How Data Breaches Affect Stock Market Share Prices
⁴Nasdaq: Clorox Experiences Share Drops and Anticipates Lower Revenues

Should You Pay the Ransom?

While the FBI does NOT recommend negotiating or paying ransom, the 2023 IBM Cost of Data Breach Report presents some interesting insights regarding how paying or not paying ransom impacts the overall cost of a ransomware event. Organizations that paid the ransom during a ransomware attack achieved only a small difference in total cost, paying $110,000 or 2.2% less compared to victim organizations that didn’t succumb to ransom demands.

However, this data doesn’t include the cost of the ransom itself. With the high cost associated with most ransom demands, organizations that did make payments likely ended up paying more than organizations that didn’t pay the ransom.

The victim organization’s size and financial position, which threat actors use to estimate the organization’s ability to pay.

The victim organization’s industry, which influences their sensitivity to disruption and negative press.

The scope of the attack, which typically influences the victim’s ability to recover and the impact to their operations.

The victim’s insurance coverage. Some ransomware groups actively seek out cyber insurance policies in a victim’s environment to better inform their ransom demands, typically asking up to the maximum the insurance policy will cover.

Our Recomendation

Arctic Wolf recommends working with a vetted incident response vendor that has experience with ransomware threat actor negotiations. On average, Arctic Wolf Incident Response customers have seen up to 92% reductions from the original ransom request.*

*All cases are different, and ransom reductions are not guaranteed. It is also never a guarantee that threat actors will live up to their word in a ransom situation.

Incident Response In Action

Learn how our IR team stops attacks and swiftly restores your organization to pre-incident operations.

04 Which Industries Are Most Targeted by Ransomware?

Ransomware groups tend to be opportunistic but still favor particular industries. The five most represented industries in Arctic Wolf® Incident Response engagements are:

1:

Manufacturing
2:

Healthcare
3:

Construction
4:

Legal & Government
5:

Education & Nonprofit

The median initial ransom demand associated with incidents investigated by Arctic Wolf Incident Response remained the same as in in 2024, at $600,000 (USD). While it can be tempting to posit explanations for the year-over-year consistency, probably the wisest approach is simply to observe that there is tremendous variation across and within industries, and that specific ransom amounts remain largely unpredictable despite the aggregate figure.

Ransomware & Data Extortion IR Cases by Industry

when we look at the data, we see that five industries that are highly susceptible to both these tactics account for just over two-thirds of ransomware IR cases.

Manufacturing organizations have more representation on leak sites than any other industry, and threat actors target them aggressively, recognizing that these organizations have little tolerance for production downtime. However, manufacturers can often maintain production without paying ransom, which may cause them to appear more frequently on leak sites.

Healthcare organizations are under regulatory pressure to protect the sensitive data they handle, so they may pay a ransom, removing them from leak sites. Similar pressure applies to legal and governmental entities.

Why These Industries?

The five industries listed above have two major traits in common that make them strong targets for ransomware groups.

They run on legacy software:

When it’s difficult for organizations to regularly update or patch, threat actors gain an opportunity to take advantage of old vulnerabilities to initiate exploits.

They have a low tolerance for downtime:

Threat groups aim to take advantage of the pressure these organizations are under to meet deadlines and produce deliverables, hoping this will lead them to pay quickly and in full. Lost revenue streams from operational downtime can also push organizations to concede to ransom demands.

Report Available

The 2025 Arctic Wolf Threat Report

Explore why three types of cyber incidents account for 96% of incident response cases, which industries may be more prone to specific incidents, and how your organization can stop threats before they escalate by calling in the professionals.

05 How Does Ransomware Work?

Root Point of Compromise: Gaining Initial Access

In the modern cybersecurity world of cloud environments and hybrid work, threat actors have become adept at evading security solutions by pivoting rapidly and employing multiple paths to value. Research from the Arctic Wolf Labs 2025 Threat Report shows the two major ways most ransomware attacks begin: external exposure and user action.

External Exposure

In almost two-thirds of the ransomware cases we investigated, threat actors gained initial access to victim environments through external exposure — a system exposed, whether knowingly or inadvertently, to the public Internet.

In 2024, threat actors leveraged external remote access in 59.4% of cases.

Other forms of external exploits, including known vulnerabilities and zero-days, accounted for 33.2%.

External Exposure

External Remote Access

This form of external exposure typically involves identity-based attacks aimed at breaching an organization’s identity and access management (IAM) system — the governance, control, and monitoring of users’ identities and access within a system or network. External remote access attacks can take a few different forms, including:

Compromising servers with Remote Desktop Protocol (RDP)

Compromising servers with Microsoft Active Directory

Using valid credentials purchased from an initial access broker (IAB) on a dark web marketplace

External Exposure

External Exploits

External exploits, however, involve leveraging either a known vulnerability or a zero-day vulnerability to gain access to an environment.

More than a quarter of non-business email compromise (BEC) incidents we investigated — of which the vast majority were ransomware — exploited a known (i.e., not a zero-day) vulnerability.

In theory, an effective patching program could have mitigated the attack or at least forced the threat actor into a different course of action.

Zero-Day Vulnerability

0.4%

While zero-days get all the headlines, they make up a small percentage of cases — just 0.4% of the ransomware incidents by Arctic Wolf.

0 %

Human Risk

While comprising a smaller section of attacks, user action still plays a role in ransomware attacks.

The team at Arctic Wolf Incident Response Labs has identified four major ways that user action can lead to a ransomware attack:

0 %

Phishing: T1566

A user clicks on a malicious link and is tricked into sharing credentials or downloading and executing a malicious attachment within an email.

0 %

Previously compromised credentials: T1078

The threat actor uses credentials that are known to be part of a data breach or credential dump — but that have not yet been deactivated by the victim organization (i.e., user inaction).

0 %

Malicious software download: T1204.002

A user falls prey to a drive-by attack or downloaded software containing hidden malicious functionality.

0 %

Other social engineering

A user is tricked by a tech support scam or some other social engineering attack besides phishing.

It’s important to note that hardening your environment to protect against ransomware will pay deep dividends against all forms of cyber attack, as the same initial access attack vectors are used in many other forms of cyber attack, including BEC and malware attacks.

06 How to Defend Against Ransomware

Like all attack vectors, the best defense involves a comprehensive security strategy that contains proactive and reactive components.

Our Recommendation

By examining the common TTPs exploited by ransomware groups and individual threat actors, we can recommend the following actions, which should occur in parallel and continuously, to reduce your cyber risk while improving your security posture.

Conduct Basic File Backups

As ransomware evolves, threat actors are now regularly exfiltrating data in the early stages of attack, threatening to release it to the dark web if payment isn’t met (double extortion).

In 71% of Arctic Wolf Incident Response engagements for ransomware, the victim organization was able to leverage backups in some capacity to restore their environment.

It’s best to follow the 3-2-1 principle of file backup, meaning an organization has:

3 copies of data

1 primary, 2 backup

2 copies stored

At separate locations

1 off-site storage

In a secure private cloud

Secure The Cloud

With the shared responsibility model, it’s important for organizations to understand where their responsibility lies when keeping their cloud environment safe. A security incident originating from within your organization that destroys or disrupts your cloud data is your responsibility, and many cloud security incidents can be traced back to misconfigurations and/or overly permissive access policies.

Not only can the cloud offer initial access to threat actors, but as data storage and operational applications expand to the cloud, it’s likely threat actors will find their way there (through lateral movement or privilege escalation) to encrypt and/or exfiltrate data.

Enforce Identity & Access Controls

Be it through social engineering, the purchase of stolen credentials, or even a brute-force attack, access often begins with a password. In addition, credentials can be used by the threat actor to gain privileged access, allowing them to deploy malware into critical parts of the network.

Proactive and reactive measures security teams can take to improve credential security include:

Implementing MFA
Conducting dark web monitoring
Hardening Active Directory using tools like PingCastle for visibility
Embracing the principle of least privilege access (PolP), supported by a zero-trust access model, role-based access control, and privileged access management (PAM)
Delivering comprehensive user security training

Ongoing Vulnerability Management

While zero-days make headlines, it’s often known, unpatched vulnerabilities that allow threat actors to gain access to a network or system. By staying on top of vulnerabilities, an organization goes a long way in hardening their attack surface.

A full vulnerability management program prioritizes continuous vulnerability remediation and assessment, with other components of the program complementing and assisting overall remediation and mitigation.

Vulnerability remediation

The act of removing a vulnerability through patching or another process

Vulnerability mitigation

The act of developing a strategy to minimize a threat’s impact if remediation is not possible

Employ a 24x7 monitoring, detection, and response solution

Monitoring is critical for preventing attacks, especially as threat actors utilize legitimate programs, such as PowerShell and Active Directory, for malicious ends. Without proper endpoint monitoring and detection, unusual behavior in those programs would go unnoticed.

In addition, swift detection and response capabilities allow your organization to stop a ransomware threat while the threat actors try to gain initial access or before they can make lateral movement.

History Shows That Ransomware Groups Aren’t Slowing Down.

If tools alone were enough to solve the problem, they would have by now.

This is an operational problem that needs to be solved, and that’s what Arctic Wolf delivers. Learn more about our unique approach to cybersecurity and why Arctic Wolf has emerged as a leader in the industry.

© 2025 Arctic Wolf Networks Inc. All Rights Reserved.
Privacy Notice	Terms of Use	Cookie Policy	Accessibility Statement	Information Security	Sustainability Statement	Cookies Settings

Platform

Concierge

Journey

Reduce Attack Frequency

Reduce Attack Severity

Transfer Risk

Get Started

Why Arctic Wolf

Expertise by Topic

Incident Response Timelines

Expertise by Industry

Resource Center

Trending Resources

The Arctic Wolf Threat Report draws upon the first-hand experience of our security experts, augmented by research from our threat intelligence team.

The Arctic Wolf State of Cybersecurity: 2025 Trends Report serves as an opportunity for decision makers to share their experiences over the past 12 months and their perspectives on some of the most important issues shaping the IT and security landscape.

Join Arctic Wolf on an interactive journey to discover a better path past the hazards of the modern threat landscape.

Security Bulletins

Microsoft Patch Tuesday October 2025

CVE-2025-61884: Oracle Releases Emergency Patch for Information Disclosure Flaw

SonicWall Concludes Investigation Into Incident Affecting MySonicWall Configuration Backup Files

Partners

Company

Careers

Press

Ransomware

Explained

Understanding the Ransomware Ecosystem – From RaaS Operators to Ransom Demands to How Ransomware Attacks Work

Table of Contents

01

The History of Ransomware

First Recorded Attack

Archievus Appears

Cryptocurrencies

Ransomware-as-a-service Arrives

WannaCry Impact

Data Exfiltration

Dark Web Leak Sites

Want to explore ransomware’s dark history in full?

02

Ransomware Groups Behind Dominant Ransomware Variants in 2024

Group Name

Akira

First Observed

Victims in 2024

Preferred Initial Access Method

Akira

First Observed:

Claimed Victims in 2024:

Preferred Initial Access Method:

Key Traits

Notable Moments:

Sources

Group Name

LockBit 3.0 Initially “ABCD,” changed name to LockBit in 2020

First Observed

Victims in 2024

Preferred Initial Access Method

LockBit 3.0

First Observed:

Claimed Victims in 2023:

Preferred Initial Access Method:

Key Traits

Notable Moments:

Sources

Group Name

Play

First Observed

Victims in 2024

Preferred Initial Access Method

Play

First Observed:

Claimed Victims in 2023:

Preferred Initial Access Method:

Notable Moments:

Sources

Group Name

Fog

First Observed

Victims in 2024

Preferred Initial Access Method

LockBit 3.0
Initially “ABCD,” changed name to LockBit in 2020