Threat Brief: Why Ransomware Hurts So Much and Is So Hard to Stop
Summary: Unit 42 researcher Bryan Lee notes that active ransomware variants have grown from fewer than one hundred in 2016 to at least 150 today, possibly hundreds more. The report attributes ransomware's potency to three technical factors: it executes with the compromised user's privileges so any file that user can reach, including network shares and backups, is fair game; it targets specifically the files users care about most; and it wastes little time on files that don't matter to the victim.
What you should know: Because ransomware runs as the user, the operating system cannot stop it without raising 'Are you sure?' prompts on everyday file operations - and the Vista experience showed users disable or click through those. A single encrypted file, such as an accounting report due at deadline, can be enough to make an attack fully successful and push a victim toward paying.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026