COMP 6660 · Enterprise Cybersecurity Malware and Ransomware

00 Introduction

The first three lessons of Unit 3 examined analysis methods: how to understand risk, model threats, and assess vulnerabilities. This lesson begins the examination of specific attack classes — the ways adversaries actually translate opportunity into impact.

Malware is the oldest and most persistent expression of adversarial capability in enterprise security. For four decades, malware has evolved in step with the enterprise estate — from viruses that spread through floppy disks, to worms that exploited internet-facing services, to trojans delivered through email, to the ransomware that now dominates enterprise incident response. Each generation has exploited the weaknesses of its era and prompted the defensive innovations of the next.

The current generation — ransomware — is qualitatively different from what came before. Where earlier malware sought to steal data, recruit devices, or demonstrate capability, ransomware seeks to disrupt enterprise operations so severely that the victim pays to restore them. The consequences are measured not only in data loss but in operational shutdowns, in healthcare disruptions, in fuel shortages, and in organisational crises. Ransomware has become the primary concern of enterprise security programmes across sectors, and the primary subject of the insurance, regulatory, and law enforcement responses that have emerged over the past five years.

This lesson examines malware and ransomware in detail. It defines malware and surveys the principal families. It examines delivery chains — how malware reaches its target. It traces the evolution of ransomware from nuisance to enterprise crisis, and examines the lifecycle of a modern ransomware attack. It describes the criminal ecosystem that sustains ransomware operations. It examines the impact on the enterprise and the defences that determine whether an incident is recoverable. And it closes with case patterns and pitfalls.

01 Learning objectives

By the end of this lesson you should be able to:

These objectives contribute to Unit 3 outcomes U3.3 (attack techniques) and U3.4 (mitigation strategies), and to Module 2 outcomes M2.3 and M2.4. See the Unit 3 learning outcomes page for the full mapping.

02 What malware is

The term encompasses a broad range of software, from simple adware to sophisticated tooling used by nation-state actors. What unites the category is intent: the software is designed to act against the interests of the system's owner or user.

What malware is used for

Malware serves different purposes depending on the adversary's objectives. Common purposes include:

• Establishing access. Creating a persistent foothold in the environment, from which the adversary can operate.
• Stealing data. Exfiltrating credentials, intellectual property, personal data, or other valuable information.
• Encrypting or destroying data. Making data or systems unavailable, typically for extortion or disruption.
• Enabling lateral movement. Providing tools to move from the initial foothold to other systems.
• Enabling command and control. Establishing communication channels through which the adversary operates the compromised environment.
• Fraud. Manipulating transactions, redirecting payments, or misusing credentials for financial gain.
• Recruiting resources. Enrolling devices into botnets for use in further attacks, cryptocurrency mining, or traffic proxying.

Malware as a component of attack

Malware is rarely the whole of an attack. It is one component of a larger campaign that includes reconnaissance, initial access, privilege escalation, lateral movement, and the achievement of the adversary's objective. The kill chain model from Lesson 3.2 illustrates this: malware is used at multiple phases, but the campaign as a whole involves more than the malware itself.

This distinction matters for defence. An enterprise that focuses exclusively on detecting and blocking malware — through antivirus signatures, for example — addresses only one dimension of the campaign. Detecting the behaviour that surrounds the malware — unusual authentication, lateral movement, privilege escalation, data exfiltration — is equally important, and is addressed through the detection capabilities examined in Module 2, Unit 4.

03 Malware families

Malware is conventionally classified into families according to how it spreads and what it does. The families are not mutually exclusive — modern malware often combines characteristics of several — but the classification remains useful for understanding behaviour and for organising defences.

Modern malware characteristics

Regardless of family, modern malware shares several characteristics that shape defensive response:

• Modularity. Malware is frequently constructed from interchangeable modules — initial access, persistence, reconnaissance, exfiltration, encryption — allowing attackers to assemble the capability appropriate to a specific campaign.
• Living-off-the-land. Modern adversaries increasingly use legitimate tools — PowerShell, WMI, PsExec, and others — rather than custom malware, to avoid detection. This makes behavioural detection essential; signature-based detection cannot identify legitimate tools used maliciously.
• Encryption and obfuscation. Malware is frequently encrypted, packed, or obfuscated to evade static detection. Command and control traffic is often encrypted and disguised as legitimate traffic.
• Polymorphism. Some malware changes its signature on each infection, defeating signature-based detection. Behavioural detection is the countermeasure.
• Rapid evolution. Malware is updated frequently in response to defensive measures. A defensive control effective today may be bypassed by an update next week.
• Multi-platform. Malware increasingly targets multiple operating systems — Windows, Linux, macOS, containers — expanding the environments that require protection.

04 Delivery chains

Malware must reach its target to be effective. The mechanisms through which malware is delivered are its delivery chain. Understanding delivery chains matters because they are where many defences intervene.

Common delivery vectors

Stages of delivery

Modern malware delivery typically involves multiple stages, each designed to evade detection and to establish persistence before the primary payload is delivered.

05 The evolution of ransomware

Ransomware has evolved through several distinct phases over the past three decades. Understanding the evolution matters because the current form — enterprise-scale double extortion — is qualitatively different from earlier phases, and requires a different response.

Phase 1 — Early ransomware (late 1980s to early 2010s)

The earliest ransomware — from the AIDS trojan of 1989 onwards — relied on simple encryption and requested payment through unconventional means (physical mail, wire transfer). These early attacks targeted individuals, used weak encryption that was sometimes recoverable without payment, and generated modest income. They demonstrated the concept but did not constitute a serious enterprise threat.

Phase 2 — Cryptocurrency-enabled ransomware (early to mid-2010s)

The emergence of cryptocurrency transformed ransomware. Bitcoin provided a payment mechanism that was pseudonymous, difficult to reverse, and accessible to criminal actors. Ransomware operators could now demand and receive payment at scale, without the friction of traditional payment systems.

This phase saw the emergence of professional ransomware operations — well-designed malware, support infrastructure, and customer-service-style negotiation. Ransomware became a viable business model, and the number of operations grew substantially.

Phase 3 — Destructive and enterprise-focused (2017–2018)

In 2017, two incidents — WannaCry and NotPetya — demonstrated ransomware's potential for enterprise-scale disruption. WannaCry spread globally through an exploited Windows vulnerability, affecting hundreds of thousands of systems. NotPetya was disguised as ransomware but was in fact a wiper, causing billions of dollars in damage across enterprises that were not the intended target.

These incidents changed the perception of ransomware. It was no longer a nuisance affecting individuals; it was a systemic risk affecting enterprises, critical infrastructure, and public services.

Phase 4 — Double extortion and big-game hunting (2019–2021)

A critical evolution occurred around 2019. Ransomware operators began to exfiltrate data before encrypting it, and to threaten publication of stolen data if payment was not made. This double extortion model addressed the principal defence against early ransomware — restoring from backups. Even if the victim could recover from backups, the threat of data exposure remained.

Simultaneously, ransomware operators shifted from opportunistic attacks against any target to big-game hunting — targeted attacks against enterprises able to pay large ransoms. The attacks became more sophisticated, with careful reconnaissance, prolonged access before encryption, and negotiation over ransoms measured in millions of dollars.

Phase 5 — Industrialised ransomware and critical infrastructure (2021 onwards)

The current phase is characterised by industrialisation and by targeting of critical infrastructure and essential services. Ransomware operations have adopted corporate structures — Ransomware-as-a-Service (RaaS) makes the tools available to affiliates who conduct the attacks, and specialist services handle negotiation, payment, and money laundering.

The Colonial Pipeline attack in 2021 — examined in Lesson 1.6 — illustrated the potential impact on essential services. Since then, ransomware has affected healthcare systems, energy infrastructure, food distribution, and government services, producing consequences that extend well beyond the affected enterprise.

The current phase also includes:

• Triple extortion. In addition to encryption and data theft, attackers may threaten to attack customers or partners of the victim, or to launch denial-of-service attacks, if the ransom is not paid.
• Regulated-industry targeting. Attackers specifically target enterprises with strong regulatory obligations, knowing that the consequences of disclosure are severe and that payment may be the least-bad option.
• Critical infrastructure focus. Attacks on hospitals, energy, water, and transport produce consequences that increase the pressure to pay.
• Regulatory and law enforcement response. Governments have begun to treat ransomware as a national security concern, with sanctions, law enforcement action, and regulatory requirements emerging in response.

06 The ransomware lifecycle

A modern ransomware attack follows a recognisable lifecycle. Understanding the lifecycle is prerequisite to understanding where defences can intervene — and where they must.

07 The ransomware ecosystem

Ransomware is not the work of isolated individuals. It is sustained by an ecosystem of specialised criminal services, each performing a distinct function and each monetising its contribution to the attack. Understanding the ecosystem matters because it explains why ransomware is so resilient to disruption — disabling one operation does not eliminate the ecosystem that supports it.

Roles in the ecosystem

Implications of the ecosystem

• Disruption is difficult. Takedowns of specific ransomware groups — through law enforcement action, arrests, or infrastructure seizures — disrupt operations but do not eliminate the ecosystem. Operations frequently re-emerge under new names or through new affiliates.
• Attacks are increasingly commoditised. The RaaS model reduces the technical barrier to conducting ransomware attacks. Affiliates do not need to be skilled developers; they need to be capable intruders.
• Attribution is complicated. An attack may involve multiple parties — the access broker, the affiliate, the developer, the negotiator — making attribution to a single actor difficult.
• The enterprise's response must consider the whole ecosystem. The negotiation phase involves specific actors with specific incentives. Understanding the ecosystem informs the enterprise's negotiation strategy and its decisions about payment.
• Payment fuels the ecosystem. Ransoms paid to one operation fund the development of tools and services that support others. This creates a policy tension — between the interests of individual victims and the collective interest in reducing ransomware activity — that is examined in Module 3.

08 Enterprise impact

The impact of a ransomware incident extends far beyond the encryption of data. Understanding the full range of impact is essential to assessing the enterprise's exposure and justifying investment in resilience.

Dimensions of impact

Post-incident escalation

The impact of a ransomware incident frequently continues well after the encryption has been resolved. Common post-incident consequences include:

• Regulatory investigation. Regulators increasingly investigate ransomware incidents to determine whether the enterprise's security practices were adequate.
• Litigation. Customers, partners, or shareholders may sue for damages, alleging negligence or breach of obligations.
• Executive and board scrutiny. Senior leadership may face questions about the enterprise's security investment, its response, and its decision-making during the incident.
• Insurance disputes. Cyber insurance claims may be contested, particularly if the enterprise's security practices did not meet the insurer's expectations.
• Customer attrition. Loss of customers who lose confidence in the enterprise's security.
• Partner and supplier consequences. Loss of partner relationships, increased scrutiny from suppliers, or contractual consequences for breach of obligations.

09 Defences against ransomware

Defences against ransomware operate across the whole attack lifecycle. No single control is sufficient; effective defence is layered, with controls that reduce the likelihood of each phase and that detect and disrupt the attack when prevention fails.

Defensive controls by lifecycle phase

The four defensive priorities

Across this range, four defensive priorities emerge as most consequential. Enterprises that address all four have substantially reduced their exposure; enterprises that address none have not.

Response decisions

When a ransomware incident occurs, several decisions must be made — often under time pressure and with incomplete information. Enterprises that have pre-established their decision framework and their decision authority respond more effectively than those that improvise.

Key decisions include:

• Whether to pay. Payment does not guarantee recovery, may encourage further attacks, may violate sanctions in some jurisdictions, and may affect insurance coverage. The decision should be made by appropriate authority — not by the security team alone — with legal, financial, and regulatory implications considered.
• Whether to shut down operations. Shutting down systems prevents further spread but disrupts operations. The decision depends on whether the enterprise can operate in a degraded state, on the potential for further harm, and on regulatory and safety considerations.
• Whether to disclose. Regulatory requirements, customer expectations, and reputational considerations all bear on disclosure. Timely and transparent communication is generally better than delayed or partial disclosure.
• How to communicate. Communication with employees, customers, partners, regulators, and the media must be coordinated. A pre-established communication plan with clear spokespersons prevents confusion and inconsistency.
• Whether to engage external expertise. Incident response firms, negotiators, legal counsel, and communications specialists are frequently engaged. Pre-established relationships allow rapid engagement when an incident occurs.

10 Case patterns

The patterns of ransomware attacks have become well documented. Several recur across incidents and are worth understanding.

Pattern 1 — Initial access through compromised credentials

Credentials are the most common initial access vector for ransomware. Attackers obtain credentials through phishing, infostealers, credential markets, or exploitation of exposed services. Once in possession of valid credentials, they enter the environment as legitimate users — invisible to perimeter controls and frequently to detection.

The pattern illustrates why identity is the primary control plane and why phishing-resistant authentication, credential monitoring, and anomalous authentication detection are essential defences.

Pattern 2 — Dwell time measured in days or weeks

In a typical ransomware incident, the attackers are inside the environment for days or weeks before encryption. During this period, they escalate privilege, move laterally, exfiltrate data, and disable defences. This extended dwell time is what makes detection so consequential — a single successful detection during this period can prevent the incident.

The pattern illustrates why detection capability determines ransomware impact, and why enterprises that rely on perimeter defence alone discover ransomware incidents only when it is too late to prevent them.

Pattern 3 — Backup systems as a target

Before deploying ransomware, attackers frequently target the enterprise's backup systems — deleting backups, encrypting them, or compromising the credentials and systems used to restore them. This pattern converts a recoverable incident into a crisis, because the enterprise's principal defence against ransomware is rendered inoperable.

The pattern illustrates why backup systems must be isolated from production environments, held in immutable or offline storage, and protected with the same rigour as the most critical systems.

Pattern 4 — Privilege escalation through identity infrastructure

Active Directory and other identity infrastructure are frequent targets. Compromise of identity infrastructure provides the attackers with the keys to the environment — the ability to create accounts, escalate privilege, disable controls, and deploy across the estate.

The pattern illustrates why directory services and their administrative accounts warrant the strongest controls in the enterprise, and why monitoring of privilege use is essential.

Pattern 5 — Double extortion as standard

Modern ransomware almost universally combines encryption with data exfiltration and extortion. Even enterprises that can recover from backups face the threat of data exposure — and the regulatory, litigation, and reputational consequences that follow.

The pattern illustrates why ransomware resilience requires more than backup capability, and why data-loss prevention, exfiltration detection, and regulatory response planning are essential components of ransomware defence.

Pattern 6 — Critical infrastructure and essential services as targets

Attackers increasingly target critical infrastructure and essential services — healthcare, energy, food distribution, government — because the consequences of disruption increase the pressure to pay. These attacks extend consequences beyond the affected enterprise to patients, customers, and communities.

The pattern illustrates why ransomware has become a national security concern, and why regulatory and law enforcement responses have become more active.

Pattern 7 — Repeated attacks on the same target

Enterprises that pay ransoms are frequently targeted again — sometimes by the same operation, sometimes by others who learn of the payment. Paying a ransom does not purchase safety; it often purchases a period of respite before the next attack.

The pattern illustrates the strategic problem with payment, and the reasons why many enterprises and many jurisdictions discourage or prohibit it.

11 Common pitfalls

Defences against malware and ransomware fail in predictable ways. Recognising the pitfalls accelerates improvement.

Pitfall 1 — Reliance on signature-based detection

Assuming that endpoint antivirus provides adequate malware defence. Modern malware uses low-signature payloads, living-off-the-land techniques, and encryption to evade signature detection.

Mitigation: Deploy behavioural detection (EDR), network monitoring, and layered controls. Treat signature-based detection as one layer, not the whole defence.

Pitfall 2 — Backups that have never been tested

Maintaining backups that have never been restored, and assuming they will work when needed. Backups that cannot be restored provide no protection.

Mitigation: Test restoration regularly. Verify that backups are complete, accurate, and restorable within the enterprise's recovery objectives.

Pitfall 3 — Backups connected to production

Backups stored in environments connected to production, with the same credentials and access paths. Attackers target backups before encrypting; connected backups are vulnerable.

Mitigation: Isolate backups — offline, immutable, or in air-gapped storage. Protect backup credentials and access paths separately from production.

Pitfall 4 — Over-reliance on perimeter defence

Assuming that perimeter controls will prevent intrusion. Modern ransomware frequently enters through identity, third parties, or exposed services that perimeter controls do not address.

Mitigation: Adopt the assume-breach posture. Design architecture and controls on the basis that intrusion will sometimes succeed, and focus on containment, detection, and recovery.

Pitfall 5 — No rehearsal of incident response

Maintaining incident response plans that have never been exercised. Ransomware incidents reveal whether the plan actually works — and unrehearsed plans frequently do not.

Mitigation: Conduct regular tabletop exercises. Rehearse the decisions — payment, shutdown, disclosure, communication — under realistic conditions.

Pitfall 6 — Underestimating cost

Assessing ransomware risk based on the likely ransom. The ransom is frequently a small fraction of total cost, which includes disruption, recovery, regulatory consequence, and reputational damage.

Mitigation: Assess ransomware risk across all impact dimensions. Base investment decisions on the full cost of a serious incident, not on the ransom alone.

Pitfall 7 — No decision framework for payment

Entering a ransomware incident without a pre-established framework for whether to pay — who decides, under what circumstances, with what legal and regulatory input.

Mitigation: Establish the decision framework in advance. Include legal, financial, and communications perspectives. Rehearse the decision through tabletop exercises.

Pitfall 8 — Assuming payment will resolve the incident

Treating payment as a resolution. Payment does not guarantee recovery, may not prevent data publication, may not prevent repeated attacks, and may violate sanctions or affect insurance coverage.

Mitigation: Understand that payment is one option among several, with significant limitations and consequences. Assess the full implications before deciding.

12 Key concepts

The terms below are used throughout Module 2. Capture them in your own words as you work through the lesson.

Malware

Malicious software — any software designed to cause harm, gain unauthorised access, disrupt operations, or otherwise interfere with the legitimate functioning of a system.

Virus

Malware that attaches to legitimate files and spreads when those files are executed. Historically dominant; now less common in enterprise environments.

Worm

Malware that self-propagates across networks without requiring user action, typically by exploiting vulnerabilities in network services.

Trojan

Malware disguised as legitimate software. The user is induced to execute it, often believing it to be useful or benign.

Ransomware

Malware that encrypts or exfiltrates data and demands payment for its release or non-disclosure. Modern ransomware typically combines encryption with data theft.

Infostealer

Malware that collects credentials, session tokens, cryptocurrency wallets, and other valuable data from infected systems. Frequently deployed as an initial step in larger campaigns.

Remote access trojan (RAT)

Malware that provides the adversary with remote control of the compromised system — file access, command execution, screen capture, and keylogging.

Rootkit

Malware designed to conceal its presence — and that of other malware — by modifying the operating system or firmware. Difficult to detect and remove.

Wiper

Malware that destroys data or makes systems unusable without any extortion mechanism. Used for disruption rather than financial gain.

Delivery chain

The mechanisms and stages through which malware reaches its target — including the initial delivery vector, detection evasion, secondary payload retrieval, installation, and objective execution.

Living-off-the-land

The use of legitimate tools — PowerShell, WMI, PsExec, and others — for malicious purposes, to avoid detection by signature-based systems.

Double extortion

A ransomware model in which the attackers exfiltrate data before encrypting it, and threaten publication if payment is not made. Addresses the defence of restoring from backups.

Triple extortion

An extension of double extortion in which the attackers also threaten customers, partners, or other third parties of the victim, or threaten additional attacks such as denial of service.

Big-game hunting

The targeting of large enterprises able to pay substantial ransoms, rather than opportunistic attacks against any target.

Ransomware-as-a-Service (RaaS)

A criminal business model in which ransomware developers license their tooling to affiliates who conduct the attacks, in exchange for a share of the ransom. Lowers the technical barrier to conducting ransomware attacks.

Initial access broker

A criminal specialist who acquires access to enterprise networks and sells it to other criminals who conduct the primary attack. A form of criminal specialisation.

Dwell time

The period between initial compromise and detection, or between initial access and encryption in a ransomware attack. A key metric for detection capability and a primary determinant of incident severity.

Assume breach

A design posture that assumes the adversary is already inside the environment. Drives architecture that limits lateral movement, detects intrusions early, and contains impact.

Immutable backup

A backup that cannot be modified or deleted for a defined retention period — protecting it from ransomware that seeks to destroy backups before encrypting production data.

Cyber insurance

Insurance covering the financial consequences of cyber incidents, including ransomware. Coverage varies; exclusions, sub-limits, and requirements (such as specific security controls) are common.

13 Activities

The activities below help you test your understanding and prepare for the unit discussion and Assignment 2. They are not graded, but completing them will substantially improve your preparation.

14 Self-check

Answer the questions below before moving to Lesson 3.5. If you cannot answer a question confidently, revisit the corresponding section.

15 Summary

This lesson has examined malware and ransomware — the attack classes that dominate enterprise incident response in the current era. The essential points are:

• Malware is an instrument, not an objective. It is one component of a broader attack campaign. Defences that focus on behavioural detection across the whole campaign are more effective than defences that focus on identifying the malware itself.
• Malware families reflect different behaviours. Viruses, worms, trojans, ransomware, infostealers, RATs, rootkits, wipers, and cryptominers. Modern malware combines characteristics and increasingly uses living-off-the-land techniques.
• Delivery chains are multi-stage. Initial delivery, detection evasion, secondary payload retrieval, installation, and objective execution. Multi-stage delivery defeats signature-based detection and requires behavioural analysis.
• Ransomware has evolved through five phases. From individual nuisance to enterprise crisis. Each phase has been more consequential than the last.
• The ransomware lifecycle is well understood. Reconnaissance, initial access, persistence, privilege escalation, lateral movement, data exfiltration, defence evasion, deployment, extortion, and post-incident. Dwell time is the critical window.
• Ransomware is sustained by a criminal ecosystem. Developers, affiliates, access brokers, negotiators, launderers, infrastructure providers, and data brokers. The ecosystem produces resilience that individual operations do not have.
• Impact extends beyond the ransom. Operational disruption, recovery cost, data loss, regulatory consequence, litigation, reputational damage, and human impact. The ransom is frequently a small fraction of total cost.
• Four defensive priorities determine resilience. Identity hardening, backup and recovery, detection and response, and segmentation with least privilege. Enterprises that address all four are substantially more resilient than enterprises that address none.
• Response decisions must be pre-established. Whether to pay, whether to shut down, whether to disclose, and how to communicate — rehearsed through tabletop exercises, before the incident occurs.
• Common pitfalls recur. Signature-only detection; untested backups; connected backups; perimeter-only defence; unrehearsed response; underestimating cost; no payment decision framework; assuming payment resolves the incident.

These ideas prepare for Lesson 3.5, which examines social engineering and phishing — the delivery mechanism for the majority of malware campaigns and one of the most reliable initial access vectors for enterprise attackers.