Ransomware (Extortion & Encryption Threats)

Threat Class: Extortion Malware / Cyberextortion Tracked Families: 1,541 Severity: CRITICAL MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Ransomware represents one of the most destructive and financially impactful categories of malicious software. Modern ransomware strains operate under sophisticated multi-tier extortion models, combining high-speed asymmetric cryptographic algorithms (such as ChaCha20, AES-256, and RSA-4096) with covert data exfiltration to achieve double extortion. Threat actors gain initial access through phishing, exposed Remote Desktop Protocol (RDP) instances, or compromised VPN gateways, rapidly escalating privileges via Active Directory vulnerabilities before staging network-wide encryption payloads. Ransomware operators intentionally target volume shadow copies, active hypervisors, and enterprise backup repositories to maximize leverage over victim organizations and compel illicit ransom payments.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Ransomware Containment & Incident Response Playbook

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID Technique Tactic Observed Operational Behavior
T1486 Data Encrypted for Impact Impact Encrypts local disks, mapped shares, and ESXi storage pools using strong asymmetric crypto.
T1490 Inhibit System Recovery Impact Deletes Volume Shadow Copies (vssadmin delete shadows) and disables Windows Recovery Environment.
T1059 Command and Scripting Interpreter Execution Executes PowerShell, cmd.exe, and WMI scripts for automated payload detonation.
T1562.001 Impair Defenses: Disable Tools Defense Evasion Terminates security services, unloads EDR kernel drivers, and modifies Windows Defender.
T1048 Exfiltration Over Alternative Protocol Exfiltration Exfiltrates sensitive files to cloud storage or dark web staging servers prior to locking.

Actively Weaponized Exploits & Vulnerabilities (18 CVEs)

Adversaries deploying ransomware (extortion & encryption threats) frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

CVE-2020-1472 CVSS 10.0 CRITICAL

Microsoft Active Directory Netlogon Elevation of Privilege (Zerologon)

Attributed Payloads: black, conti, ryuk

View Exploitation Dossier →
CVE-2015-5119 CVSS 10.0 CRITICAL

Adobe Flash Player ByteArray Use-After-Free (Hacking Team Leak)

Attributed Payloads: teslacrypt, troldesh

View Exploitation Dossier →
CVE-2015-5122 CVSS 10.0 CRITICAL

Adobe Flash Player DisplayObject opaqueBackground Use-After-Free

Attributed Payloads: cerber

View Exploitation Dossier →
CVE-2015-0311 CVSS 10.0 CRITICAL

Adobe Flash Player ByteArray Uncompress Use-After-Free (Angler EK)

Attributed Payloads: teslacrypt

View Exploitation Dossier →
CVE-2017-0144 CVSS 9.8 CRITICAL

Microsoft Windows SMBv1 Remote Code Execution (EternalBlue / MS17-010)

Attributed Payloads: bsymem, crysis, petya

View Exploitation Dossier →
CVE-2017-10271 CVSS 9.8 CRITICAL

Oracle WebLogic Server WLS-WSAT Remote Code Execution Vulnerability

Attributed Payloads: crysis

View Exploitation Dossier →
CVE-2017-0145 CVSS 9.8 CRITICAL

Microsoft Windows SMBv1 Remote Code Execution (EternalRomance / MS17-010)

Attributed Payloads: petya

View Exploitation Dossier →
CVE-2019-19781 CVSS 9.8 CRITICAL

Citrix ADC & Gateway Directory Traversal Remote Code Execution (Shitrix)

Attributed Payloads: revil

View Exploitation Dossier →
→ Explore all 63 weaponized vulnerabilities in our master CVE Exploitation Matrix

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

  1. Immediately disconnect affected subnets and isolated endpoints from local area networks and corporate Wi-Fi.
  2. Preserve volatile system memory (RAM capture) before powering off devices to capture encryption keys and active C2 sockets.
  3. Verify the integrity of immutable and offline backup snapshots; confirm backup infrastructure has not been compromised.
  4. Reset all enterprise administrative credentials, Active Directory service accounts, and KRBTGT passwords twice.
  5. Engage legal counsel and cyber incident response professionals; do not attempt uncoordinated negotiations.
⚠️ Critical Mistakes to Avoid:
  • Do not immediately reboot or wipe compromised systems; volatile memory often retains active cryptographic keys or decryption material.
  • Do not pay ransoms without forensic consultation; payment does not guarantee data recovery and may violate OFAC sanctions.
  • Do not restore from untested backups while threat actors retain persistent access or web shells in your directory.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

stop

EMBER Samples: 8,900

STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ra...

View Profile & Rules →

gandcrab

EMBER Samples: 2,992

GandCrab is a landmark ransomware family that revolutionized the modern cyber extortion industry by pioneering and popularizing the Ranso...

View Profile & Rules →

cerber

EMBER Samples: 1,792

Cerber is an influential, early Ransomware-as-a-Service (RaaS) operation that operated with immense commercial success between February 2...

View Profile & Rules →

gandcrypt

EMBER Samples: 474

Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt)...

View Profile & Rules →

lockbit

EMBER Samples: 340

LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) ope...

View Profile & Rules →

black

EMBER Samples: 329

Black (cataloged across threat telemetry as Ransom:Win32/Black, Ransomware.BlackMatter, and Trojan-Ransom.Win32.Black) is an aggressive d...

View Profile & Rules →

daws

EMBER Samples: 246

TrojanDownloader:Win32/Daws (cataloged across security vendors as Trojan.Daws or Ransom.Daws) is a persistent Windows trojan downloader a...

View Profile & Rules →

ryuk

EMBER Samples: 210

Ryuk is one of the most destructive and lucrative enterprise ransomware families in cybersecurity history, first identified in August 201...

View Profile & Rules →

Complete Directory (1,541 Families)

Alphabetical index of all tracked malware families cataloged under ransomware (extortion & encryption threats):

🛡️ Verified Antivirus Support & Customer Assistance

Experiencing issues with unexpected malware infections, persistent adware popups, or security software licensing? Access our verified resolution guides and official customer support helplines:

→ View all 57 TotalAV Antivirus & Security Support Resources