Ransomware
The modern extortion threat — targeted, data-stealing and supply-chain driven.
Short answer: Ransomware is malware that encrypts a victim’s data and demands payment. Modern ransomware also exfiltrates data to force payment (double extortion) and targets backups and cloud estates.
Evidence: CISA · MITRE ATT&CK · Vendor advisories · Human reviewed
Definition
Ransomware is malware that encrypts a victim’s data and demands payment. Modern ransomware also exfiltrates data to force payment (double extortion) and targets backups and cloud estates.
Major Entities
- CVE — CVE-2023-23397 (MOVEit-adjacent)
- CVE CVE-2021-44228 — CVE-2021-44228 (Log4Shell)
Timeline
- — MOVEit campaign mass exploitation
- — Double-extortion becomes dominant model
Latest Intelligence
- LockBit leak-site escalation
- New affiliate model for initial access
Evidence & Sources
CISA · MITRE ATT&CK · Vendor advisories · NVD · CISA KEV · MITRE ATT&CK
Related Intelligence
- Threat actor: LockBit
- Threat actor: Clop
- Threat actor: BlackCat
- Campaign: MOVEit Transfer zero Day campaign
- Campaign: Citrix Bleed intrusions
- Research: Leak-site economics quantified
- Research: Ransomware recovery playbooks
Next Actions
Part of the OpenTrojan Security Knowledge Hub 2.0: <a href="/security/malware/">Malware</a> · <a href="/security/threat-intelligence/">Threat Intelligence</a> · <a href="/security/vulnerability-management/">Vulnerability Management</a> · <a href="/security/cloud-security/">Cloud Security</a> · <a href="/security/identity-security/">Identity Security</a> · <a href="/security/supply-chain/">Supply Chain</a> · <a href="/security/incident-response/">Incident Response</a> · <a href="/security/zero-day/">Zero Day</a> · <a href="/security/nation-state-threats/">Nation State Threats</a>