Key takeaway
Ransomware readiness takes more than installing software: updated systems, limited administrative privileges, prepared staff, network segmentation and tested recovery copies must work together.
What ransomware does
Ransomware denies access to data or a device and demands payment to restore it. It may encrypt files or lock a device; some attacks also steal data and threaten disclosure. Disruption, recovery costs and loss of trust can follow: inaccessible patient records, for example, can affect a healthcare organization’s continuity. Payment guarantees neither recovery nor deletion of stolen copies. Responsible decision makers follow incident procedures and seek appropriate advice.
Milestones in ransomware history
Ransomware history shows changes in techniques and criminal business models. In Ransomware-as-a-Service (RaaS), providers of malware and infrastructure and affiliates carrying out attacks may divide roles and proceeds; there is no mandatory chain. REvil is a historical affiliate example.
1989 · AIDS Trojan
The 1989 AIDS Trojan blocked access and demanded US$189 be sent to a company in Panama. Its weak encryption led to free recovery tools. This early example does not establish recovery prospects for modern attacks.
Gpcode and Archiveus
Gpcode and Archiveus are early examples of malware demanding payment for access to files. Some Gpcode variants used RSA. Researchers developed decryption methods for particular variants; recovery depended on the variant and its encryption implementation.
Early 2010s · digital payments
Some groups began accepting cryptocurrency. Demands also used prepaid payment services, Western Union and gift cards. Payment methods varied by group and campaign; cryptocurrency does not make tracing impossible. Locker malware can deny screen or device access without encrypting files.
2017 · Petya/NotPetya
The 2017 Petya/NotPetya events highlighted the importance of updates and recovery preparation. Europol’s Petya guidance at the time emphasized installing updates, keeping backups, disconnecting infected devices from the network and reporting incidents.
From 2019 · REvil and service models
REvil emerged in 2019 and used a Ransomware-as-a-Service model. Malware and infrastructure providers supplied affiliates who carried out attacks. This division separated development and platform operation from the work of conducting attacks.
2021 · international response
On October 13–14, 2021, representatives from more than 30 countries and the European Union joined the Counter-Ransomware Initiative meeting to discuss cooperation, resilience and disruption of ransomware. The event shows the role of coordinated response.
Understand access paths and risk factors
An attack may start through phishing, an untrusted download, stolen credentials, unpatched software or an internet-exposed system. An older device raises exposure when unsupported or unpatched; age alone does not prove insecurity. Untested backups and an unprepared team can complicate recovery. Review accounts, email, exposed services and supplier connections separately.
Recoverable backups
Back up critical data regularly. A network-separated copy and immutable storage address different risks and are not interchangeable in every environment. Set frequency and retention around tolerated data loss, downtime and applicable requirements. Test files, accounts, applications and dependencies during restoration, and verify the copy is clean separately; opening a file alone does not prove that.
Manage access, updates and user readiness
Patch operating systems, browsers, applications and device firmware promptly. Limit daily use of administrative privileges, apply multifactor authentication and least privilege by role, and disable unused accounts. Teach staff to verify suspicious messages, avoid unexpected files and report incidents promptly. Segment networks around critical systems so an issue on one device cannot move easily into other areas.
Response sequence during an incident
The plan should name an incident lead, roles, communications, evidence handling and recovery criteria. Report promptly and begin authorized containment while scope assessment continues throughout the response. Start assessing notification needs early. The incident lead orders actions around safety, critical services and evidence preservation.
Report and scope
Notify IT and the response team promptly. Start an inventory of affected devices, accounts, data and services; preserve timestamps and event records and avoid unnecessary changes to suspect devices. Update scope as the investigation continues.
Contain spread
Under the incident lead, disconnect the device or restrict the affected segment. Account for critical-service safety, investigation access and relevant evidence. If credentials may be stolen, revoke access and change passwords from a trusted device.
Preserve digital evidence
Authorized specialists collect suitable system images, memory data, and security and network logs. Powering off can destroy evidence in memory. If network disconnection is impossible, the incident lead considers shutdown to limit spread while accounting for critical-service safety.
Eradicate and validate recovery
Remediate entry and persistence, then assess cleanup or rebuild. Restore into a clean environment from a validated clean backup or approved image. Verify data, applications and services before controlled reconnection.
Review and complete notifications
Document the timeline and actions, complete the notification assessment started earlier, and make required contacts under internal procedures. Assign owners and deadlines for backup and response-plan improvements.
Layered defense and exercises
Email and web filtering, anti-malware tools, intrusion detection, endpoint monitoring, identity controls and backups reduce different risks. EDR can expose suspicious activity and provide context for investigation and isolation, but it does not replace every control. Run a tabletop exercise covering communications, decisions, device isolation and recovery, then assign owners and due dates to gaps.