{
	"id": "3f346cd4-a0fe-48d2-bda6-fc9c65e6b520",
	"created_at": "2026-04-06T00:11:42.429225Z",
	"updated_at": "2026-04-10T03:20:42.473034Z",
	"deleted_at": null,
	"sha1_hash": "b331ad2c67f7aeb1eae756f90d48df53d5f098f5",
	"title": "Everything to Know About Ransomware: The Anatomy \u0026 Investigations of Ransomware Attacks",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 682439,
	"plain_text": "Everything to Know About Ransomware: The Anatomy \u0026\r\nInvestigations of Ransomware Attacks\r\nArchived: 2026-04-05 13:41:30 UTC\r\nExecutive Summary ︎\r\nRansomware is a type of software that encrypts users’ data, ensuring that they can no longer recover it without\r\npayment. It has been around since about 1989 and has become a very lucrative business with a bleeding impact on\r\norganizations: Financial cost of pay-out, loss of reputation, agencies’ fines, permanent data loss, operational loss,\r\nclean-up/damage repair costs. As ransomware attacks rise alongside the massive adoption of technology and\r\ncryptocurrency, they have also evolved to implement non-monetary extortion threats and RaaS (Ransomware-as-a-Service) strategy to urge victims into submitting payments.\r\nIn this whitepaper, we will guide you through the anatomy of ransomware attacks—including the threat\r\nactors, their operational processes and roles, and more—as well as the investigative workflows, data, and\r\ntools that support effective ransomware investigations.\r\nKey Takeaways ︎\r\nAround since 1989, ransomware is a type of malware that encrypts the victim’s data and only giving them\r\naccess once payment, or a ransom, has been provided.\r\nIBM Ponemon Institute states that the average cost of a ransomware breach in 2021 was estimated at $4.62\r\nmillion. Chainalysis states in their 2021 report that ransomware payment size was over $118,000 in 2021,\r\nup from $88,000 in 2020 and $25,000 in 2019, with some large payments such as the record $40 million\r\nreceived by Phoenix Cryptolocker.\r\nThreat actors nowadays follow a collaborative operational model called “Ransomware-as-a-Service\r\n(RaaS)” and divide the operation into three roles: Operators, Affiliates, and Initial Combat Brokers.\r\nRansomware investigations usually involve the following steps: Mapping the threat landscape, identifying\r\nattach surface, threat hunting in internal networks, TTP investigations, and finally, follow-the-money\r\ninvestigations.\r\nMaltego provides a number of data integrations to aid the different steps in a ransomware investigation and\r\nhelps investigators easily visualize data relationships between data points from different data sources. \r\nUnderstanding Ransomware Threats ︎\r\nAlthough it has been the most remarkable cyberthreat in the last years, ransomware is not something new in the\r\ncybersecurity arena: The first malware asking for a ransom payment dates back to 1989. The invention of Bitcoin\r\nin 2008 (facilitating anonymous payments), the professionalization of cybercrime growing up heavily a few years\r\nlater (strong collaboration and exchange in dark web hacking forums and markets), and the massive adoption of\r\nhttps://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/\r\nPage 1 of 4\n\ntechnology (with relevant vulnerabilities and high-impact exploits from time to time) has probably generated the\r\n“perfect storm” for them.\r\nRansomware, as a malware specimen, is a relatively simple piece of software that encrypts a victim’s data, making\r\nit theoretically unrecoverable, and demanding payment in exchange for recovery. It is mainly used by threat actors\r\nduring the last stage of a network compromise. This means that, before its detonation, an initial entry vector was\r\nabused, and several steps were taken afterward to silently pivot and land into other highly relevant assets in the\r\norganization. During that breach, attackers will be trying to obtain enough privileges to launch data encryption and\r\nwipe everything out, including mirrored data and online backups, even hosted in alternative systems for business\r\ncontinuity purposes. It must be noted that their extortion activities do not just stop at asking a ransom for data\r\nrecovery, but also heavily pressuring victims by threatening to leak stolen information, including customer data,\r\nintellectual property, etc.\r\nIBM Ponemon Institute states that the average cost of a ransomware breach in 2021 was estimated at $4.62\r\nmillion. We are talking about a very lucrative business with a bleeding impact on organizations: Financial\r\ncost of pay-out, loss of reputation, agencies’ fines, permanent data loss, operational loss, clean-up/damage\r\nrepair costs.\r\nChainalysis states in their 2021 report that there were more active ransomware strains than any other year, at least\r\n140 of them received payments from victims at any point in 2021, compared to 119 in 2020, and 79 in 2019. The\r\nsame study indicates that ransomware payment size was over $118,000 in 2021, up from $88,000 in 2020 and\r\n$25,000 in 2019, with some large payments such as the record $40 million received by Phoenix Cryptolocker. One\r\nreason for the mentioned increase in ransom sizes is ransomware attackers’ focus on carrying out highly targeted\r\nattacks against large organizations.\r\nhttps://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/\r\nPage 2 of 4\n\nRansomware as a Service (RaaS) \u0026 RaaS Players ︎\r\nAs you will notice, there are many stages and different tools involved in a ransomware attack. The criminal\r\nhacking industry, as in any other software and services one, requires specialization and a strong partnership\r\nprogram as the most reasonable step to compete in this business. Nowadays, this is no longer a “Blue Ocean” as\r\nthere are many threat actors competing to compromise a big ecosystem.\r\nhttps://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/\r\nPage 3 of 4\n\nThe most common trend in this ecosystem is following a collaborative operational model known as\r\nRansomware as a Service (RaaS) with three clear roles: Operators, Affiliates, and Initial Access Brokers (IABs).\r\nDownload this whitepaper now to learn more about: ︎\r\nRaaS attack groups and the roles of Operators, Affiliates, and Initial Access Brokers\r\nAttack trends of RaaS and their Tactics, Techniques, and Procedures (TTPs)\r\nThe 6 aspects of a ransomware investigation\r\nTop OSINT Tools and data providers for ransomware investigations\r\nDownload the resource\r\nDon’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on\r\nupdates and news!\r\nHappy investigating!\r\nSource: https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/\r\nhttps://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.maltego.com/blog/chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1/"
	],
	"report_names": [
		"chasing-darkside-affiliates-identifying-threat-actors-connected-to-darkside-ransomware-using-maltego-intel-471-1"
	],
	"threat_actors": [],
	"ts_created_at": 1775434302,
	"ts_updated_at": 1775791242,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b331ad2c67f7aeb1eae756f90d48df53d5f098f5.pdf",
		"text": "https://archive.orkl.eu/b331ad2c67f7aeb1eae756f90d48df53d5f098f5.txt",
		"img": "https://archive.orkl.eu/b331ad2c67f7aeb1eae756f90d48df53d5f098f5.jpg"
	}
}