Ruslan Rakhmetov, Security Vision
The level of cyberthreats in the Russian economy is growing: in recent years, not only has the number of cyberattacks increased, but so has their severity, which can be measured by the scale of damage from cyber incidents. One of the most destructive types of cyberattacks has been the infection of domestic companies with ransomware and wiper viruses, the impact of which extends far beyond the routine work of the information security department. The consequences of such attacks can include not only financial losses amounting to hundreds of millions of rubles, but also a damaged reputation, fines, lawsuits, and even bankruptcy. In this article, we will discuss ransomware, explain how it operates and the potential damage it can cause, and discuss how to protect against it.
Readers are likely already aware that ransomware is dangerous malware that encrypts files on a device, rendering them unusable, and demands a ransom for decryption. In recent years, hackers have refined their schemes, demanding ransom not only for decryption but also for keeping the attack secret. In some cases, when attacking large corporations, they may also steal important documents or personal data and blackmail the company into disclosing them. In addition to ransomware, DDoS attacks can be launched to inflict further damage, distract defenders, and disrupt the response process. Sometimes, attackers go further, blackmailing the affected organizations by threatening to file a complaint with government regulators about a data breach, allegedly on behalf of their clients.
To understand the nature of modern ransomware, let 's take a brief look at the history of encryption malware. The prototypes of modern encryption malware emerged in the late 2000s – these were cryptobanners, SMS banners, and WinLocker. These and similar types of viruses (so-called "scareware") operated rather primitively by modern standards: after infection (for example, through pirated software or after the user launched it under the guise of a "free program"), they replaced the Windows OS boot sequence. Instead of the legitimate "userinit.exe -> explorer.exe" startup sequence, the banner virus's executable file was launched. As a result, after booting the PC, the user saw not the usual login window and desktop, but a full-screen banner with a message stating that unlicensed software or prohibited materials had allegedly been detected on the PC. To "unlock" the computer, the user needed to send an SMS to a short number or top up the hackers' WebMoney wallet with a prepaid card. These viruses were extremely common in the CIS, but they were also easily removed – all that was needed was to boot the PC in Safe Mode or from a LiveCD, and then restore the OS boot order via the Windows registry.
With the rise of cryptocurrency in the early 2010s, attackers were able to monetize their attacks and reached a new level: they could now target victims worldwide, and to increase the likelihood of ransom payment, they needed to inflict real damage on them. This gave rise to the first modern ransomware viruses, which encrypted files on local, removable, and network drives and demanded a ransom in bitcoin for data recovery. One of the most notorious ransomware viruses was CryptoLocker, which spread in 2013-2014: its developers exploited a decentralized network of botnet C&C servers. Gameover ZeuS was used to control infected PCs and interact with victims. 2048-bit RSA key pairs were generated on the attackers' servers and used in a hybrid encryption scheme for the victim's files: after infection, an AES key was generated on the attacked device for fast symmetric encryption of target files (documents, photos, project files, etc.). To prevent recovery by the user, this AES key was then encrypted with a public RSA key from the attackers' server, and the original was deleted. The private RSA key for decrypting the AES key was stored only on the C&C server and used if the victim agreed to pay the ransom. A fragment of data with an encrypted AES key was appended to the files encrypted by the virus, allowing victims to use the ransomware's online portal and upload one of the encrypted files to obtain a Bitcoin wallet address, transfer the ransom, and obtain the decryption key. However, even such a complex ransomware scheme, which netted cybercriminals approximately $3 million in illegal profits, was eventually shut down by the joint efforts of law enforcement agencies in more than a dozen countries in early June 2014. By August, a free portal for CryptoLocker victims was launched, where they could obtain a free key to restore encrypted files.
There were other well-known cases of ransomware spreading later – for example, the WannaCry epidemic in May 2017, which used the EternalBlue exploit for a vulnerability in the SMB v1 protocol to spread. By late June of that year, NotPetya began spreading, disguised as ransomware but actually acting as a wiper. After infection, users who were attacked saw a ransomware message on their device screens, but the decryption key was not transmitted to the attackers' server, and the attackers would have been unable to transmit it to the victim even if they paid the ransom.
These illustrative cases demonstrate a number of characteristic features of ransomware that remain relevant to this day:
- ransomware viruses pose a real threat due to their ability to completely paralyze the operation of the IT infrastructure and effectively stop the entire business;
- modern ransomware malware continues to use hybrid encryption schemes, but before doing so, it steals (copies externally) valuable data so that the leak can be used as additional leverage (even if a company has backups and the ability to recover, leaked data can no longer be recovered), and also because of the risk of detection by security tools of "noisy" mass file modification operations;
- paying the ransom does not guarantee the victim's data recovery (in some countries, there are now even legislative bans on paying ransom to hackers);
- Some time after the malicious command center is eliminated/captured, services from information security companies may appear for free decryption key acquisition. Therefore, if a company was attacked by outdated ransomware, it makes sense to contact specialized specialists to attempt data recovery;
- a wiper virus, aimed at destroying data and causing maximum damage, can be disguised as a ransomware virus in order to make it difficult to attribute the attackers and bring them a double benefit - both a ransom and the disabling of the victim company's infrastructure (hackers can be hired by competitors or the intelligence services of unfriendly states).
Today, ransomware attacks remain one of the most pressing and dangerous cyberthreats not only in Russia but worldwide. In the first six months of 2026, the number of ransomware attacks in the industrial sector increased 2.3-fold , with ransomware malware being a key target in industry. The oil and gas, construction, and building automation industries are leading the way . Last year, representatives of medium and large Russian organizations from various sectors named ransomware attacks as the most pressing cyberthreat, and approximately 20% of all attacks in 2025 were ransomware attacks. At the same time, the ransom demands are also growing: by the end of 2024, the average amount demanded by cyber extortionists was 14 million rubles, in 2025, ransom amounts ranged from 4 million rubles to 40 million rubles for large businesses, and already in early 2026, it was reported that attackers demanded a ransom of half a billion rubles from one of the Russian companies. Such figures are far from new worldwide: for example, according to some sources , the average global ransom paid in 2025 was $1 million, decreasing to almost $800,000 by 2026. However, in the UK, for example, the average ransom demanded reached $2.5 million. At the same time, the average cost of restoring infrastructure and business processes after an attack is estimated at $1.7 million, and for half of the victims, this procedure takes about a week. According to the IBM report "Cost of a Data Breach Report 2026", the number of ransomware attacks among other types of incidents increased over the year from 34% to 39%, while respondents expressed growing concern about the impact of such attacks on the company's reputation - in 41% of cases, attackers threatened to publish information about the hack and data leak from the victim company, which is especially sensitive in the case of theft of personal data and intellectual property. The scale of the problems and the level of impact of a successful ransomware attack can be clearly imagined by the example of a fairly frank discussion of the consequences of the cyberattack on the Russian insurance company VSK that occurred in late 2025, which, in addition to the complete collapse of the organization's business processes, also faced difficulties in quickly responding to the cyber incident. In general, the consequences of cyberattacks by ransomware become most noticeable in the public sphere, especially when the company's website and application stop working, interaction with counterparties and clients is disrupted, and accessibility becomes Services familiar to the masses. Examples of high-profile attacks include the incidents at the Vinlab chain of stores in 2025, the ransomware attack on SDEK in 2024, and the ransomware infection at the Miratorg agricultural holding in 2022.
The huge ransom amounts and effectiveness of ransomware attacks are fueling their continued development, and the following trends and characteristics can currently be noted:
1) Use of double ransomware schemes: Following the surge in popularity and a series of high-profile ransomware attacks in the late 2010s, companies adapted their protection and backup systems to the new threat. Security solutions began effectively detecting operations characteristic of encrypting large numbers of files on devices, and backups allowed for the rapid recovery of affected data. Attackers went further, employing the tactic of surreptitiously collecting and stealing (exfiltrating) sensitive corporate data from compromised infrastructure before actually encrypting it. This approach allowed the extortionists to demand double ransom from their victims: the first ransom was for decryption of the data, and the second ransom was for the attackers' promise not to publish the stolen data and to delete it. It is worth noting that subsequent investigations into the activities of similar ransomware groups revealed that, despite their promises, they did not delete the stolen data, but rather used it for further attacks or resold it to other hackers.
2) Triple extortion schemes and the use of legislation to exert pressure: Attackers have recently shifted to a triple extortion scheme, in which users or counterparties listed in the stolen datasets are asked to pay a ransom for non-disclosure of their own information. For example, by attacking a large legal or auditing firm, hackers gain access to highly sensitive information, and those listed in the data are willing to pay handsomely for the attackers' silence. However, that's not all – given the turnover-based fines for personal data leaks introduced on May 30, 2025, attackers have begun implementing schemes with an additional stage of extortion: the attacked company receives a warning from the extortionists about the stolen personal data of its employees or clients, followed by a ransom demand. Failure to pay will result in a complaint being filed with Roskomnadzor. Given the high fines for violating personal data protection laws and the potential reputational damage, companies may be willing to make deals with blackmailers – without any guarantees, of course. Moreover, transferring funds (regardless of the form – fiat or cryptocurrency) to unknown individuals carrying out malicious actions against the country's interests risks close scrutiny from the relevant authorities. It should also be noted that some countries have legal prohibitions on paying ransom to blackmailers. For example, in the United States, restrictions are in place under the sanctions enforcement agency (OFAC, Office of the United States Financial Action Task Force). of Foreign Assets Control, the US Treasury Department's Office of Foreign Assets Control) - if the ransom is paid to a cyber group that is under sanctions or linked to terrorist organizations, the victim company faces a multi-million dollar fine.
3) Multi-pronged pressure: To enhance the negative impact of a ransomware attack, attackers simultaneously launch a DDoS attack on the company's web resources, which causes customer anxiety and consumes the resources of information security specialists. This can also be used to conceal and distract attention during the hacking of the company and the launch of the ransomware. Furthermore, attackers conduct attacks on the most critical days for the company – weekends, holidays, or peak customer seasons (e.g., New Year's Eve or March 8th). If the files fail to be encrypted or the hackers realize they have been discovered, they can initiate a mechanism to destroy the compromised infrastructure – this will help them cover their tracks and harm the victim.
4) Harmful Use of AI: Attackers are increasingly using AI to create believable phishing scams. Social engineering and credential compromise (along with exploiting vulnerabilities and hacking contractors and suppliers) are often the primary attack vectors for ransomware when penetrating protected infrastructure. While phishing emails could previously be easily identified by spelling or stylistic errors, AI now helps hackers craft flawless messages that mimic the style and manner of communication of a specific industry or company. Furthermore, AI enables attackers to develop malware code (disguising it as a legitimate tool for sanctioned pentesting), quickly navigate the attacked infrastructure and select priority targets, analyze stolen file arrays and find the most sensitive information, and assess a company's solvency and demand a feasible ransom. Various AI assistants have significantly lowered the barrier to entry into the illegal cyberextortion business – now even the least skilled attacker can create their own ransomware using vibe coding, and with the help of AI agents, they can carry out all stages of an attack.
5) Damage to reputation even in the absence of evidence of an attack: the attackers have built their infrastructure not only for hacking, but also for publishing stolen files. Specially created Data Leak Leak sites (DLS) look like the pages of leading media outlets – announcements of upcoming leaks, victim comments, intriguing details, distribution of full leak dumps, and links to the most interesting stolen documents. Extortionists spread information about the latest leak and the victim through various channels – from classic hacker forums to specially created Darknet sites and messenger channels. As a result, damage to a company's reputation can be inflicted even without a hack – simply by spreading news of a "megaleak" and publishing a fake sample created from a combination of leaks from other companies, confusing information security specialists with an intensive search for traces of a hack that never occurred (and, likely, launching a real attack at this unfortunate time for the company).
To prevent ransomware attacks and reduce damage in the event of a successful infection, there are a number of recommendations:
1) Develop a cyber incident response plan in advance , include a ransomware attack response scenario, prepare communication and escalation matrices, and be prepared to involve the legal department in the event of a personal data leak and the PR department in the event of a customer service disruption. Conduct regular training, cyber exercises, and drills with all company personnel to prepare for immediate action in the event of a ransomware attack.
2) Implement a backup and recovery process for data in the event of an incident, regularly test your backups, use offline backup systems (ransomware can delete or encrypt backups accessible from your infrastructure), and remember to protect your backups (storage, transfer, and destruction). For quick recovery, use pre-created "golden images" with pre-installed corporate software.
3) Implement a Zero Trust model in your infrastructure, which includes:
- control of employee and administrator accounts, including minimization of privileges, implementation of a role-based or attribute-based access control model, multi-factor authentication, provision of access based on an assessment of the risk of account compromise, provision of time-limited and privilege-limited access for administrators, outsourcers and contractors, as well as control of their actions;
- inventory and control of devices connecting to the infrastructure, including checking the installed security tools and the absence of malicious activity on the devices (posturing);
- network microsegmentation, encryption of internal traffic, implementation of conditional network access (conditional access), ensuring network security at the L7 level (application control);
- management of secure software development, verification of installed software and updates, vulnerability management;
- control and prevention of data leaks, monitoring the state of infrastructure, implementation of cyber incident response processes.
4) Establish a vulnerability and configuration management process, including scanning the perimeter and internal infrastructure, identifying vulnerabilities and insecure settings, and making decisions on each vulnerability/setting based on its priority and asset criticality. Leverage cyberthreat intelligence data and implement recommendations and best practices from vendors and information security companies for secure system configuration.
5) Train your staff: Develop a cybersecurity training program with induction sessions for new employees, training sessions, regular seminars, drills, and test phishing emails. Explain current cyberthreats, explain the dangers of ransomware, and explain the response procedures if signs of a ransomware infection are detected. Schedule separate training sessions for IT specialists and senior managers, and develop a relevant training program for them.
6) Ensure secure interactions with suppliers and contractors, including an audit of the maturity of their information security processes and the level of training of their information security specialists and incident response teams. Check the level of rights granted to them in your systems, audit account use, and use PAM (Privileged) class systems. Access Management) to oversee their work, and revoke their authority after project completion. Enter into legally binding agreements for the transfer of confidential information, define areas of responsibility in the event of a cyberattack, obtain contact information for information security specialists from your counterparties, and discuss the possibility of involving them in monitoring by your or a third-party SOC.
7) Use recommendations and best practices for combating ransomware:
- Recommendations for protecting a company's information infrastructure from computer attacks using encryption programs from the National Center for Cybersecurity and Information Security;
- Recommendations by protection from ransomware viruses (Institute for Security and Technology – Blueprint for Ransomware Defense);
- Recommendations from the American agency CISA "Stop Ransomware Guide";
- NIST documents:
-
NIST IR 8374 Rev. 1 "Ransomware Risk Management: A Cybersecurity Framework 2.0 Community Profile";
-
NIST SP 1800-41 "Responding to and Recovering from a Cyber Attack: Cybersecurity for the Manufacturing Sector";
-
NIST SP 1800-25 "Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events";
-
NIST SP 1800-26 "Data Integrity: Detecting and Responding to Ransomware and Other Destructive Events";
-
NIST SP 1800-11 "Data Integrity: Recovering from Ransomware and Other Destructive Events."
8) Implement appropriate information security systems: in addition to IAM systems (for account management), DLP (to prevent leaks during data exfiltration by ransomware), and ZTNA solutions (to implement a zero-trust model), Security Vision products such as:
.jpg)
