Ransomware attacks have increased. Cases in which hackers hijack company information and demand ransom payments to return it, often extorting business owners with threats of data exposure. Part of the growth is explained by the pandemic. Since January this year, attacks have increased by almost four times in Brazil.

The media and the qualified media have started to comment more on the subject. But this security problem is not new.

The first references to attacks appeared in the mid-1980s. One of the first ransomware was a DOS virus called Casino that, every April 15, copied data from RAM and the FAT file system, and erased the entire contents of the hard drive. The user did not receive a ransom demand. Instead, Casino would display a slots-style game on the screen, and the message that the data would only be recovered if the victim managed to score.

In the 1990s, another ransomware, known as PC Cyborg, began to be distributed by floppy diskettes. It encrypted the C:\ drive and demanded payment in cash. In practice, what PC Cyborg did was simply rewrite the autoexec.bat system file, hide folders, and encrypt the filenames of files on the C:drive.

In 2005 the first modern pests appeared: Krotten, Cryzip and MayArchive. These, in fact, used RSA encryption to block data. They also demanded ransom payments.

And before continuing with the timeline, it is important to say that, in the same way as biological viruses, computer viruses evolve over time and so several variants are born. With this, they become more complex and difficult to combat, gaining a greater power of devastation.

So it was with ransomware. And the whole world felt the impact of this evolution.

On 12 May 2017, the virus starred in the largest cyberattack in history. A ransomware, known as WannaCry, claimed more than 200,000 victims in 250 countries. And it damaged all segments of the economy. How did it get this far? The creator of this variation, besides using the modus operandi of a ransomware, combined characteristics of another group of virus known as worm, which has the ability to spread automatically through computer networks, even over the internet, exploiting computer vulnerabilities. In other words, the perfect scenario for a massive and rapid contagion.

A virus that can multiply itself, and which hijacks user data, has given rise to a new category of ransomware, known as worm ransomware.

But if this family of viruses has existed for so long, why has it only become so widespread in recent years?

The reason is simple. In past decades, the internet was not so developed, which restricted the path of the virus to archaic vectors, such as floppy disks and pen drives. It is as if a car with a good engine only found bad roads to travel, which changes its performance. Today, the internet is equivalent to a highway that, besides having the best asphalt, shortens the route because it is also a shortcut.

To understand more about how ransomware works and how to protect yourself, our e-book "Understanding the Enemy - A quick guide to ransomware, data hijacking, and why businesses are at risk" is available at no cost. Just click on this link.