Social Engineering and Malicious Software

Ransomware is malware that encrypts a victim's files or locks access to a system, then demands payment — usually in cryptocurrency — in exchange for a decryption key. Its mechanics typically involve an initial foothold gained through phishing, an exposed remote-access service, or an unpatched vulnerability, followed by lateral movement across a network before the encryption payload is triggered. The WannaCry outbreak of May 2017 spread using the EternalBlue exploit against unpatched Windows systems, disrupting hospitals across the United Kingdom's National Health Service and infecting roughly 200,000 computers in over 150 countries; it is generally attributed to North Korea's Lazarus Group. A month later, the NotPetya attack, which masqueraded as ransomware but was designed primarily to destroy data, was attributed by the United States, United Kingdom, and other governments to Russia's military intelligence agency, the GRU; it crippled companies including the shipping giant Maersk and the pharmaceutical company Merck, causing an estimated ten billion dollars in global damages. In May 2021, the DarkSide ransomware group forced Colonial Pipeline, which supplies nearly half the fuel used on the U.S. East Coast, to shut down operations; the company paid roughly 4.4 million dollars in ransom, a portion of which the FBI later recovered by tracing the cryptocurrency wallet.