Examples of Ransomware Attacks

Famous ransomware examples

The increase of ransomware attacks has seen different types of ransomware used to exploit system vulnerabilities in different ways.

Ryuk

Ryuk has been responsible for some of the most notorious ransomware attacks targeting organizations worldwide. It is a form of crypto ransomware that has specifically targeted large enterprises, often with the intent of demanding a hefty ransom.

Locky

Locky is a notorious ransomware variant primarily distributed via phishing email attachments, usually disguised as invoices, documents, or software updates. Once clicked, the malicious attachment locks the victim’s files, making them inaccessible

Wannacry

The WannaCry attack caused a global crisis, infecting more than 230,000 computers across 150 countries and causing an estimated $4 billion in damages. The attack exploited a vulnerability in Microsoft Windows systems, specifically targeting systems that had not been patched with a critical security update

Bad rabbit

Bad Rabbit was a drive-by ransomware attack, meaning it spread via compromised websites that unsuspecting users visited. The malware appeared to be a legitimate Adobe Flash installer, but it was actually a piece of ransomware that encrypted the ransomware victim’s files

Jigsaw

Petya ransomware spreads by encrypting the Master Boot Record (MBR) and rendering the entire system inoperable. It often uses phishing emails as a delivery method, causing severe disruptions to businesses by locking their computers at the system level.

NotPetya

NotPetya initially appeared to be a variant of Petya, but it was far more destructive. It spread quickly using exploits from the same Windows vulnerability as WannaCry and was designed not just to extort money but to cause massive damage to systems. It impacted organizations across the globe, particularly in Ukraine.

Cerber

Cerber is a highly sophisticated ransomware strain that uses advanced encryption techniques to lock files. It is commonly spread through phishing emails with malicious attachments and has been notorious for its ability to adapt and change its tactics to avoid detection.

BitPaymer

BitPaymer ransomware is often linked to large, well-coordinated attacks. It targets corporate environments and encrypts files before demanding a Bitcoin payment for the decryption key. The ransom note typically includes a URL to a TOR-based payment portal.

Cryptolocker

One of the most notorious ransomware strains, Cryptolocker encrypted files and demanded ransoms in digital currencies like Bitcoin. It was spread through spam and ransomware emails and successfully infected a vast number of users, causing significant damage before its takedown.

DarkSide

DarkSide is a Ransomware-as-a-Service (RaaS) operation, primarily targeting enterprise environments. It gained attention for its role in the Colonial Pipeline cyber attack, which disrupted U.S. fuel supplies. DarkSide typically demands large ransoms, often in the millions, and its operators have recently expanded to Linux-based systems.

Dharma

Dharma ransomware operates through a RaaS model, where attackers license the ransomware and launch it via affiliates. Dharma primarily targets small and medium-sized businesses, often demanding a ransom of around $500-$2,000 in Bitcoin.

DoppelPaymer

DoppelPaymer is a highly dangerous strain of ransomware that has been used in numerous high-profile attacks. It encrypts files on infected systems and demands payment through a TOR-based payment portal. DoppelPaymer is known for its aggressive tactics and has been linked to major breaches.

GandCrab

GandCrab was one of the most active and widely distributed ransomware families, with its developers consistently updating the strain. GandCrab was spread primarily via phishing emails and exploit kits, and its affiliates used various tactics to infect targets worldwide.

Maze

Maze ransomware is known for its double extortion ransomware technique, where attackers not only encrypt data but also steal it and threaten to release it unless the ransom is paid. Maze has targeted numerous high-profile organizations and has become notorious for its use of data exfiltration in addition to encryption.