Ransomware is continuously evolving and has recently seen record-breaking payouts. This paper describes developments in corporate ransomware which have contributed to this continued rise. It provides an interdisciplinary case study of a ransomware campaign conducted in northern Europe during 2023 and 2024. We argue that underlying factors, including the broad rollout of personal cloud backups, have caused modern ransomware groups to shift towards expending more effort per attack in order to attack bigger targets. We perform an analysis of such an attack using a combination of internal and open sources, as well as using forensic techniques. The analysis shows how the attackers approach high-value targets, use both traditional crypto-ransomware tools and hacking, and utilize multiple avenues of extortion to negotiate the highest possible ransom.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Understanding Corporate Ransomware – A Case Study in the Nordics

  • Emil Larsson,
  • Meiko Jensen

摘要

Ransomware is continuously evolving and has recently seen record-breaking payouts. This paper describes developments in corporate ransomware which have contributed to this continued rise. It provides an interdisciplinary case study of a ransomware campaign conducted in northern Europe during 2023 and 2024. We argue that underlying factors, including the broad rollout of personal cloud backups, have caused modern ransomware groups to shift towards expending more effort per attack in order to attack bigger targets. We perform an analysis of such an attack using a combination of internal and open sources, as well as using forensic techniques. The analysis shows how the attackers approach high-value targets, use both traditional crypto-ransomware tools and hacking, and utilize multiple avenues of extortion to negotiate the highest possible ransom.