Explanation for beginners:
Made up of the terms “ransom” and “ware”, the suffix of the word software, ransomware is malicious software that, once introduced into a computerized system, blocks its use and displays on the screen a ransom demand message in exchange for restoring control of a device or a fleet of devices.
This can apply to a single computer, or to a fleet of computers, immobilizing all these devices while the malware (malicious software) is being removed, either by paying the ransom, or by finding the right IT team to get rid of the problem.
In more advanced terms:
In other words, ransomware is a type of malicious software that encrypts a victim’s files, making the data inaccessible until a ransom is paid to obtain the decryption key.
These attacks can paralyze companies, hospitals and even critical infrastructure. Ransomware often spreads through phishing or unpatched software vulnerabilities.
Ransomware, how does it work?
To illustrate the impact of ransomware, let’s consider a simulation where a company is attacked.
For this example, we propose a 5-step sequence:
- Initial infection: an employee opens a phishing email containing a malicious link. By clicking on it, ransomware is quietly installed on their computer.
- Data encryption: the ransomware starts encrypting the user’s files, then quickly spreads to other machines on the network.
- Ransom demand: the user sees a message on the screen demanding a ransom in bitcoins to decrypt the files. The company’s critical files are now inaccessible.
- Paralysis of operations: the company’s operations are interrupted, leading to significant financial losses and damage to reputation.
- Resolution: the company must choose between paying the ransom (with no guarantee of recovering the files) or restoring the data from backups, if they exist and are recent.
Ransomware, one of hackers’ favorite tools
On the podium of the malicious practices most used by hackers targeting companies in 2023, there are:
- account hacking, which accounts for 23.5% of attacks,
- phishing, which accounts for 21.2% of attacks,
- ransomware which accounts for 16.6% of cyberattacks.
Ransomware is moreover often coupled with the other two cyberattacks on the podium; in fact, 81% of ransomware attacks are carried out by email according to Altospam
Why so much enthusiasm for this type of cyberattack?
Because it can pay off big,
Of the 46% of companies that suffered damage following a ransomware attack, 67% said their total losses amounted to between 1 and 10 million dollars, according to a global study on the economic impact of ransomware conducted by Cybereason.
Because it is relatively easy to set up,
The least experienced cybercriminals can launch attacks by buying ransomware kits on the dark web from more experienced cybercriminals, according to information from Threatdown. This type of model is called Ransomware as a Service (RaaS).
What is Ransomware as a Service (RaaS)?
Hackers develop ransomware attack models and sell them to affiliates. The latter then use them independently to launch ransomware attacks.
It is a genuine business model since the hacker who created the RaaS receives a service commission for each ransom collected by the hackers who use the ransomware he created.
Ransomware in France, in figures and statistics (2023)
The percentage of French organizations hit by ransomware in 2023 is 74%, an increase of +10% compared to 2022, according to the 2024 “State of Ransomware” report following a survey conducted by Sophos.
Companies – Ransomware ranks third among the cyberattacks most used by hackers in France in 2023, indicates Cybermalveillance.gouv.fr in its “2023 review of cyberattacks against companies“
Local authorities – Ransomware ranks second among the cyberattacks most used by hackers in France in 2023, indicates Cybermalveillance.gouv.fr in its “2023 review of cyberattacks against companies“
The total number of ransomware attacks brought to the attention of ANSSI is 30% higher than that observed over the same period in 2022, according to the “Cyber Threat Overview 2023” report by CERT-FR (the government center for monitoring, alerting and responding to computer attacks)
France is the 6th most affected country in the world by ransomware-type attacks in 2023, and the 3rd in Europe behind Germany and Italy, according to SOSransomware via its “2023 ransomware attacks review“. (This ranking does not take into account the position of the United Kingdom).
Of the 28% of companies that paid a ransom in 2022, 80% of them were hit again, according to a study carried out by Cybereason among a panel of surveyed companies.
Ransomware worldwide, in figures and statistics (2023)
In 2023, 1 in 10 organizations worldwide was affected by ransomware attack attempts, an increase of 33% compared to the previous year, according to research conducted by CheckPoint for the year 2023
The sectors most affected by ransomware attacks in 2023 were, according to the CheckPoint study:
- education/research with 22% of organizations suffering this type of attack,
- followed by government/military for 16% of targeted organizations,
- healthcare with 12% of targeted organizations.
In 2023, a 55.5% increase in the number of victims per ransomware attack was recorded compared to the previous year, states Cyberint in its report on ransomware trends in 2023
In 2023, ransomware payments reached $1.1 billion, according to a 2024 ransomware study conducted by Chainalysis
By 2031, ransomware will cost victims $265 billion per year and will attack a business, a consumer or a device every 2 seconds, according to forecasts by Cybersecurity Ventures
