1. How Ransomware Has Changed

The history of ransomware is not merely the advancement of encryption technology. What has changed is monetization, intrusion routes, target selection, division of labor, material used for extortion, and the relationship with states and law enforcement. This chapter’s purpose is not to memorize individual family names, but to understand why today’s defensive design is necessary.

1.1 Prehistory: From Screen Locking to Encryption

The 1989 AIDS Trojan (PC Cyborg) is widely cited as an early example of ransom-demanding malware. It cannot be placed on the same level as today’s attacks, but the idea of linking restriction of user access to a demand for payment already existed. [S14] Afterward, “scareware” and locker-type malware spread, locking devices with fake warning screens and demanding payment disguised as a fine.

Defense at this stage leaned relatively heavily on removing malware from a single device and reinstalling it. In corporate environments, however, devices are connected to file sharing, authentication, business servers, backups, and external outsourcing partners. The nature of the problem changed once the victim was no longer a single individual but an entire organization.

1.2 Around 2013: The Combination of Encryption and Anonymous Payment

CryptoLocker, which appeared in 2013, is recorded — including in U.S. Department of Justice materials on an international joint takedown — as ransomware that encrypted victims’ important files and demanded payment. [S15] The combination of encryption with payment in cryptocurrency lowered the friction for attackers making and receiving demands across national borders.

How to read this fact: A single-cause account holding that the attack became viable simply because cryptocurrency exists is not accurate. When weak authentication, unpatched devices, invisible assets, excessive privilege, and unrecoverable backups are all present, extortion becomes viable regardless of the means of payment. Cryptocurrency is one factor that lowered the friction of monetization.

1.3 2016–2017: Self-Propagating Spread and Its Impact on Social Infrastructure

WannaCry, in 2017, affected a large number of organizations on a global scale. CISA explains that it exploited a vulnerability for which Microsoft had already released a patch, and self-propagated within networks. [S16] The UK NCSC characterizes WannaCry and the same year’s NotPetya as destructive attacks that combined encryption with self-propagation, and explains that in neither case was a decryption key obtainable through payment. [S17] This illustrates the danger of treating an attack, based on appearance alone, as “ordinary extortion that can be recovered from by paying.”

From this period on, practitioners learned the following two lessons.

1. In a network where lateral movement is possible, a single lapse in vulnerability management can become an organization-wide outage.
2. Before the question of “whether to pay” arises, the attack’s objective, its scope of impact, and the possibility of recovery must be verified.

Figure 2: The Shift in the Center of Gravity of the Threat

The figure organizes representative turning points and does not mean that old methods were uniformly replaced by new ones in each year. Encryption-centered attacks, data extortion, and RaaS, among others, continue to coexist today.

1.4 2018–2020: Human-Operated Intrusion and “Big Game Hunting”

During this period, the framing of “human-operated ransomware” became established — attackers who, after intruding into an organization, survey the environment and narrow their focus to high-value targets to inflict damage. Rather than simply distributing attachments broadly, attackers began surveying the administrative privileges and critical data they could reach, starting from obtained credentials, exposed remote-access surfaces, vulnerable perimeter devices, and outsourcing-partner connections.

What became a blind spot for defenders here were mechanisms that had been operated as exceptions for the sake of availability. Always-on VPNs, shared administrator accounts, old file servers, overlooked remote management tools, and unmonitored backup-management surfaces are convenient in normal times, but become amplifiers of a compromise once one occurs.

1.5 From 2019: Double Extortion, Triple Extortion, and No-Ware Ransom

Double extortion — stealing data in advance and demanding payment not only for decryption but also to halt publication — became widespread. Joint CISA advisories report double extortion combining theft and encryption for specific threat actors such as Play and Interlock. [S08][S20]

In addition to direct demands to the victim organization, examples are also known that combine contacting customers and business partners, additional pressure through DDoS, and publication on leak sites. However, the term “triple extortion” is a convenient classificatory label, and the same procedure is not used in every attack.

There is also no-ware ransom, which threatens to publish stolen data without encryption. Educational material from the Tokyo Metropolitan Government also introduces, as an example disclosed in 2024, a case reportedly involving extortion based on published data in which no unauthorized intrusion or data loss was confirmed. [S07] For this reason, upon receiving an extortion email, one should not conclude “no damage” based solely on the presence or absence of traces of encryption. At the same time, it is equally important not to confirm a leak based solely on the attacker’s claim.

Figure 3: Differences Among Extortion Models

1.6 From 2021: RaaS, the Supply Chain, and the Management Plane

RaaS is a model in which developers/operators and the parties who carry out intrusions divide the labor. As a result, intrusion capability, negotiation, encryption, leak-site operation, and money laundering may not be confined within a single group. Because renaming and realignment among groups also occurs, defenders need to verify not only “which group” was involved, but center their verification on “which entry point, which privileges, and which management plane were abused.”

At the same time, outsourcing partners, MSPs, SaaS, software distribution, cloud tenant management, and remote monitoring and management all create trust relationships that cross organizational boundaries. The Verizon 2025 DBIR reported that the proportion of breaches involving a third party had doubled from the previous year. [S03] This is not a conclusion that “outsourcing is dangerous.” It indicates the need to design connections, privileges, logging, deactivation upon termination, and incident notification through both contractual and technical means.

1.7 Four Invariant Principles Drawn from History

The purpose of looking back at history is not to predict “the next WannaCry.” It is to find, behind a surface that changes each time, the invisibility of assets, the concentration of privilege, unverified recovery, and neglected trust relationships.