Ransomware: how it began

The old version of ransomware… in a floppy disk

Ransomware can be described as “a subset of malware in which the data on a victim’s computer is locked — typically by encryption — and payment is demanded before the ransomed data is decrypted and access is returned to the victim.” Source

The first instance that falls under this definition, although occurring years before it was defined as such, was the AIDS Trojan. The malware received this name due to the victims targeted all being delegates at the 1989 World Health Organization AIDS conference in Stockholm.

They all received floppy disks (remember them?!) which contained malicious code which encrypted the names of all the files and hid all the directories on the drive after the system booted for the 90^th time after being infected. This resulted in the system being unusable.

Victims were presented with a note telling them that they had to send $189 to a postal address in Panama if they wanted their system to be restored. Whilst a far cry from modern ransomware attacks this attack is known as the first attempt to extort money from victims by preventing access to their files and systems. Fortunately, due to the weak encryption used by the Trojan, security researchers were able to release a free decryption tool.

Ransomware: a temporary trend

After the mid-2000s, ransomware continued to evolve and started utilizing stronger, often off the shelf, encryption mechanisms. The attacks were still limited primarily to individual home users often with ransoms asking for no more than a few hundred dollars. This can be attributed to the fact that the ransoms needed to be paid in the standard currency which didn’t offer any form of covertness for the criminals.

In 2012, a byline from an eWeek article read: “Rather than encrypt the entire hard drive, criminals are using fairly unsophisticated ransomware to lock a victim’s PC and then demand cash for the keys”. This was one of the few early observations of the emerging new threat that was ransomware – one of the myriads of business models that cybercrime was experimenting with at the time. The journalist ended the article with this sentence: “I think it is just a temporary trend until someone finds a better idea to make money easier”.

The comment about a ‘better idea to make money easier’ pointed to ransomware’s Achilles Heel at the time, namely that there was no easy way to receive payment from the ransomware victim, with the criminal forced to resort to the use of pre-paid cards or money transfers.

It would have seemed clear at the time that ransomware as a form of crime was unlikely to go anywhere because it was just too difficult to get payment from the victim. Nowadays, the final quote seems ironic. The trend, as it turns out, was anything but ‘temporary’, as the chart below illustrates…

Publicly reported ransomware incidents over time

Ransomware: the almost perfect cyber weapon

For the 2012 cybercrime ecosystem, ransomware was a natural pivot. It represented a business model that allowed for ‘direct monetization’, as opposed to stealing data for example, which would then need to be resold for any profit to be made.

Ransomware also had some advantages, notably that there is less need for the malware operator to maintain a Command and Control (C&C) channel with the infected machine.

But it still lacked one significant advantage. It could not use the cheap and reliable payment networks provided by the credit card companies to extract payment from its customers, which was the model at the time. There was no safe and efficient way to receive and verify payments from victims and that meant ransomware as a business model was essentially dead in the water.