A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions
Open accessAbstract
In recent years, ransomware has been one of the most notorious malware targeting end-users, governments, and business organizations. It has become a very profitable business for cybercriminals with revenues of millions of dollars, and a very serious threat to organizations with financial losses of billions of dollars. Numerous studies were proposed to address the ransomware threat, including surveys that cover certain aspects of ransomware research. However, no study exists in the literature that gives the complete picture on ransomware and ransomware defense research with respect to the diversity of targeted platforms. Since ransomware is already prevalent in PCs/workstations/desktops/laptops, and is becoming more prevalent in mobile devices, and has already hit IoT/CPS recently, and will likely grow further in the IoT/CPS domain very soon, understanding ransomware and analyzing defense mechanisms with respect to target platforms is becoming more imperative. In order to fill this gap and motivate further research, in this paper, we present a comprehensive survey on ransomware and ransomware defense research with respect to PCs/workstations, mobile devices, and IoT/CPS platforms. Specifically, covering 137 studies over the period of 1990-2020, we give a detailed overview of ransomware evolution, comprehensively analyze the key building blocks of ransomware, present a taxonomy of notable ransomware families, and provide an extensive overview of ransomware defense research (i.e., analysis, detection, and recovery) with respect to platforms of PCs/workstations, mobile devices, and IoT/CPS. Moreover, we derive an extensive list of open issues for future ransomware research. We believe this survey will motivate further research by giving a complete picture on state-of-the-art ransomware research.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The opening for cyber attackers grows as CIs have evolved their operational technologies.
“The opening for cyber attackers grows as CIs have evolved their operational technologies [16].”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [16]
Section 4.1.2 (p. 9) says industrial IoT and cyber-physical devices are used in critical infrastructure and are becoming more widespread, making them potential future ransomware targets. It does not establish that evolving operational technology has already increased openings for cyber attackers generally; its assessment concerns prospective ransomware targeting. (LLM, conf=0.83)
Experimental — accuracy not yet measuredMany types of malware are being developed by professional software development organizations and purchased by cyber attackers; this division of malware development and deployment depends on the growing cybercrime economy.
“Many types of malware are being developed by professional software development organizations and purchased by cyber attackers. This division of malware development and deployment depends on the growing cybercrime economy [16].”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [16]
Section 3.1 (p. 6) describes ransomware-as-a-service as a cybercrime business model in which ransomware kits can be purchased on underground markets. This supports a market for separately developed and deployed ransomware, but the paper does not establish that professional software development organizations produce many types of malware, or that this division depends on a growing cybercrime economy. (LLM, conf=0.87)
Experimental — accuracy not yet measuredMost commonly, e-mails are the delivery method of ransomware; malicious e-mails carry ransomware as an attachment, which contains malware; messages are often sent as spam broadcast or directed to specific individuals or organizations.
“Most commonly, e-mails are the delivery method of ransomware. Malicious e-mails carry ransomware as an attachment, which contains the malware. These messages are often sent as spam broadcast to as many e-mail addresses as possible or can be directed and tailored to specific individuals or organizations.”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [16]
Section 4.2 (p. 9) says malicious e-mails are the most common ransomware infection vector and describes spam campaigns with ransomware-containing attachments. Section 4.1.1 (p. 8) describes attacks on preselected organizations, but neither passage establishes that the e-mails themselves are tailored to specific individuals or organizations. Section 4.2 also notes that malicious links, rather than attachments, can deliver ransomware. (LLM, conf=0.85)
Experimental — accuracy not yet measuredAlthough current ransomware campaigns do not target CPS, the installation of more intelligent electronic devices in the field by CI makes CI and its CPS a more likely target for ransomware; as smart technologies expand, they will become a growing target; thus, ransomware targeting industrial CPS intelligent electronic devices will become more prevalent.
“Although current ransomware campaigns do not target CPS, the installation of more intelligent electronic devices in the field by CI makes the CI and its CPS a more likely target for ransomware. As smart technologies continue to expand and integrate into homes, transportation, buildings, and throughout cities, they will become a growing target in the future development of ransomware that targets”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [16]
Split into 2 atoms — 1 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredThe use of ransomware is incredibly profitable when successful, and society pays the price for these interruptions across critical CI sectors such as food, energy, water, etc.
“The use of ransomware is incredibly profitable when successful, and society pays the price for these interruptions across critical CI sectors such as food, energy, water, etc. [16,21,28,29].”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [16]
“Willingness to Pay” (p. 31) says successful attacks can bring thousands or millions of dollars in ransom, and “Victims of Ransomware” (p. 8) describes attacks that can stop an organization’s operations. The paper identifies energy and water infrastructure as potential targets (“Target Platforms,” p. 9), but says ransomware targeting those industrial systems was not prevalent at the time. It does not establish that ransomware interruptions have affected society across the listed critical-infrastructure sectors, including food. (LLM, conf=0.85)
Experimental — accuracy not yet measured
In Prime MotorX's perception layer, patch management failure and weak authentication in thermocouple firmware are exploited by ransomware and malware attacks.
“In this scenario, the exploited vulnerabilities are Patch Management Failure and Weak Authentication.The launched attacks include Ransomware [45], [46], and Malware [47], with the target being the Firmware.”
From A Critical Overview of Industrial Internet of Things Security and Privacy Issues Using a Layer-Based Hacking Scenario (2023) · cites this paper as [45]
A ransomware's malicious action is to either encrypt, lock, or exfiltrate data, and ransomware will be specialized for the target platform; mostly, they target PC/workstations with a Windows operating system.
“A ransomware’s malicious action is to either encrypt, lock, or exfiltrate data, and the ransomware will be specialized for the target platform. The variety of operating systems means that system-specific libraries and functions will be used by the ransomware to perform malicious actions. Mostly, they will target PC/workstations with a Windows operating system [16].”
From Impact, Vulnerabilities, and Mitigation Strategies for Cyber-Secure Critical Infrastructure. (2023) · cites this paper as [16]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 158 · Cited by 297
Research works printed but not linked: 11
- [30][30] S. Aurangzeb, M. Aleem, and A. Iqbal, M.and Islam. 2017. Ransomware: A Survey and Trends. Journal of Information Assurance and Security 12 (06 2017). -
- [36][36] J. Bates. 1990. High level-programs and the AIDS Trojan. Virus Bulletin (1990). -
- [37][37] J. Bates. 1990. Trojan horse: AIDS information introductory diskette version 2.0. Virus Bulletin (1990). -
- [43][43] J. Chandra, R. Kumar, and A. Vidyapeetham. 2017. On the efficacy of Android ransomware detection techniques: a survey. International Journal of Pure and Applied Mathematics 115 (2017). -
- [54][54] A. Continella, A. Guagnelli, G. Zingaro, G. Pasquale, A. Barenghi, S. Zanero, and F. Maggi. 2016. ShieldFS: A SelfHealing, Ransomware-Aware Filesystem. In Proceedings of the 32nd Annual Conference on Computer Security Applications (ACSAC '16) . ACM, 336-347. -
- [84][84] J. Huang, J. Xu, X. Xing, P. Liu, and M. K. Qureshi. 2017. FlashGuard: Leveraging Intrinsic Flash Properties to Defend Against Encryption Ransomware. In 2017 ACM SIGSAC Conference on Computer and Communications Security . -
- [107][107] S-H Kok, Azween Abdullah, N. Jhanjhi, and Mahadevan Supramaniam. 2019. Ransomware , Threat and Detection Techniques : A Review. IJCSNS International Journal of Computer Science and Network Security 19. -
- [108][108] E. Kolodenker, W. Koch, G. Stringhini, and M. Egele. 2017. PayBreak: Defense Against Cryptographic Ransomware. In Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security . -
- [130][130] D. Matos, M. Pardal, G. Carle, and M. Correia. 2018. RockFS: Cloud-backed File System Resilience to Client-Side Attacks. Middleware '18: Proceedings of the 19th International Middleware Conference . -
- [140][140] A. Naseer, R. Mir, A. Mir, and M.Aleem. 2020. Windows-based Ransomware: A Survey. Journal of Information Assurance and Security 15 (2020). -
- [185][185] M. Taylor, K. Smith, and M. Thornton. 2017. Sensor-based Ransomware Detection. In Future Technologies Conference . -
- Authors
- Oz, H., Aris, A., Levi, A., & Uluagac, A. S.
- Affiliations
- Florida International University (US)
- Cyber-Physical Systems Security Lab, Department of Electrical & Computer Engineering, Florida International University, Miami, Florida, USA
- Sabancı Üniversitesi (TR)
- Venue
- ACM Computing Surveys
- Published
- 2022-01-31
- Volume
- 54
- Issue
- 11s
- Pages
- 1-37
- ISSN
- 0360-0300 (ISSN-L)
- 1557-7341
- OpenAlex
- W3132588576
- Cited by
- 297
- References
- 158
- Citations by year
- 2026: 46 · 2025: 70 · 2024: 83 · 2023: 58 · 2022: 29 · 2021: 11
- FWCI
- 27.67
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM Computing Surveys (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Sabanci University (submittedVersion)
- arXiv (Cornell University)
- Funders
- US National Science Foundation Awards (NSF-CAREER-CNS-1453647, NSF-1718116)
- Topics
- Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Physical Sciences › Computer Science › Information Systems › Digital and Cyber Forensics
- Keywords
- ransomware, ransomware families, ransomware defense, ransomware detection, data recovery, critical infrastructure protection, cybercrime
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
