Ransomware (Extortion & Encryption Threats)

Threat Class: Extortion Malware / Cyberextortion Tracked Families: 1 Severity: CRITICAL MITRE ATT&CK Aligned

Threat Landscape & Operational Overview

Ransomware represents one of the most destructive and financially impactful categories of malicious software. Modern ransomware strains operate under sophisticated multi-tier extortion models, combining high-speed asymmetric cryptographic algorithms (such as ChaCha20, AES-256, and RSA-4096) with covert data exfiltration to achieve double extortion. Threat actors gain initial access through phishing, exposed Remote Desktop Protocol (RDP) instances, or compromised VPN gateways, rapidly escalating privileges via Active Directory vulnerabilities before staging network-wide encryption payloads. Ransomware operators intentionally target volume shadow copies, active hypervisors, and enterprise backup repositories to maximize leverage over victim organizations and compel illicit ransom payments.

🛡️ Enterprise Incident Response & Hardening Guidance

Dealing with an active security incident or looking to harden enterprise defenses against this threat class? Read our dedicated operational engineering guide:

→ Open Master Guide: Ransomware Containment & Incident Response Playbook

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

ID Technique Tactic Observed Operational Behavior
T1486 Data Encrypted for Impact Impact Encrypts local disks, mapped shares, and ESXi storage pools using strong asymmetric crypto.
T1490 Inhibit System Recovery Impact Deletes Volume Shadow Copies (vssadmin delete shadows) and disables Windows Recovery Environment.
T1059 Command and Scripting Interpreter Execution Executes PowerShell, cmd.exe, and WMI scripts for automated payload detonation.
T1562.001 Impair Defenses: Disable Tools Defense Evasion Terminates security services, unloads EDR kernel drivers, and modifies Windows Defender.
T1048 Exfiltration Over Alternative Protocol Exfiltration Exfiltrates sensitive files to cloud storage or dark web staging servers prior to locking.

Actively Weaponized Exploits & Vulnerabilities (2 CVEs)

Adversaries deploying ransomware (extortion & encryption threats) frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

CVE-2017-0144 CVSS 9.8 CRITICAL

Microsoft Windows SMBv1 Remote Code Execution (EternalBlue / MS17-010)

Attributed Payloads: wannacry

View Exploitation Dossier →
CVE-2017-0145 CVSS 9.8 CRITICAL

Microsoft Windows SMBv1 Remote Code Execution (EternalRomance / MS17-010)

Attributed Payloads: wannacry

View Exploitation Dossier →
→ Explore all 63 weaponized vulnerabilities in our master CVE Exploitation Matrix

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

  1. Immediately disconnect affected subnets and isolated endpoints from local area networks and corporate Wi-Fi.
  2. Preserve volatile system memory (RAM capture) before powering off devices to capture encryption keys and active C2 sockets.
  3. Verify the integrity of immutable and offline backup snapshots; confirm backup infrastructure has not been compromised.
  4. Reset all enterprise administrative credentials, Active Directory service accounts, and KRBTGT passwords twice.
  5. Engage legal counsel and cyber incident response professionals; do not attempt uncoordinated negotiations.
⚠️ Critical Mistakes to Avoid:
  • Do not immediately reboot or wipe compromised systems; volatile memory often retains active cryptographic keys or decryption material.
  • Do not pay ransoms without forensic consultation; payment does not guarantee data recovery and may violate OFAC sanctions.
  • Do not restore from untested backups while threat actors retain persistent access or web shells in your directory.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

wannacry

EMBER Samples: 4,876

WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprec...

View Profile & Rules →

Complete Directory (1 Families)

Alphabetical index of all tracked malware families cataloged under ransomware (extortion & encryption threats):