AN IN-DEPTH ANALYSIS OF RANSOMWARE ATTACK TREND: EMERGING PATTERNS AND EFFECTIVE COUNTER MEASURES FOR CYBER SECURITY

Abstract

Ransomware has become one of the most costly global cyber threats to businesses, infrastructure, and individuals. The rapid evolution of ransomware has become more dangerous with the introduction of Ransomware-as-a-Service. Even with advancements in security, most organizations are left vulnerable to cyber attacks due to lack of knowledge regarding evolving trends, inadequate and insufficient defensive measures, and poorly integrated defense mechanisms. This research examines the lifecycle, trends, and techniques of contemporary ransomware and analyzes both defensive and response mechanisms. This study utilizes a mixed method approach whereby the public reporting of ransomware incidents is quantitatively analyzed, and the remaining portions of the analysis are qualitatively aided by the expertise of the security professionals. The investigation focuses on the range, sophistication, and aggressiveness of the techniques employed by ransomware actors during the phases of initial access, lateral movement, the theft and encryption of data, and demand for payment. This study also seeks to understand the range, sophistication, and aggressiveness of countermeasures to ransomware attacks in addition to identifying the most critical barriers concerning the preparedness of organizations. The most frequently identified barriers were unpatched systems, inadequate access controls, susceptibility to phishing, and a weak incidents response. PhD candidate posits a deterrence and response model to ransomware that combines threat intelligence and tiered ransom assessments integrated with behavioral analysis of ransomware and methodical gaps identified through a critical and cooperative threat analysis. This study combines technical, malware and ransomware, and organizational defense analysis. Additionally, this study offers new insights into cybersecurity and ransomware policies and provides additional protective measures to better strengthen organizations against ransomware attacks.