Presentation overview
I presented Ransomware Down the Road in August 2018. The talk examined how ransomware and attacker monetization strategies were changing in the threat environment of that period.
- Mining
Resource consumption plus code and configuration supporting mining.
- Encryption
Content transformation tied to the responsible process.
- Destruction
Deletion or overwrite evidence and the resulting storage state.
- Exfiltration
Transfer evidence connected to the information that actually left.
Malware behavior and attacker incentives
The presentation traced ransomware evolution and discussed the rise of malicious cryptocurrency mining as a competing way to monetize compromised systems. It also examined the movement toward targeted ransomware attacks, where attackers could pursue larger payments.
The research connected payload choices with attacker incentives: changes in criminal economics help explain why malware behavior and targeting change over time.
Technical context: separating the ways an attacker profits
This analysis expands the historical theme for today’s archive. It does not add new findings to the August 2018 presentation or describe the current prevalence of particular payloads.
Malicious cryptocurrency mining and ransomware can share an initial foothold while using it differently. Mining attempts to consume computing resources over time. Encryption-based ransomware attempts to make information unusable and apply pressure for payment. Data theft creates another source of leverage, including cases where no encryption occurs.
These differences change what an investigation must establish. A process using substantial CPU is not enough to prove mining. Renamed files are not enough to prove encryption. Large outbound transfers are not enough to identify which information left the environment.
Distinguishing effect from attribution
| Question | Evidence that helps answer it |
|---|---|
| Was information encrypted? | File-content changes, recovery failures, and the responsible process. |
| Was information destroyed? | Deletion or overwrite events and the state of affected storage. |
| Was information transferred? | Network records correlated with file access and the sending process. |
| Was compute used for mining? | Program configuration, workload behavior, and corroborating communications. |
A ransom message can accompany encryption, deletion, or a bluff. The message alone does not prove that data is recoverable through payment. Similarly, association with a ransomware ecosystem does not establish that a particular artifact performed encryption.
Connecting findings to recovery
Response depends on the established effect. Restoring files can address availability loss, but it does not reverse disclosure of information already copied elsewhere. Removing a mining process can stop one workload while leaving the original access path intact. Investigation and recovery therefore need to address both the payload’s effect and the conditions that permitted it.
CISA’s StopRansomware Guide provides later guidance on prevention and response, including protecting and testing backups. It is supplementary reading for this archive, not a claimed reference from the 2018 presentation.
The analytical lesson is to connect attacker incentives with demonstrable behavior. A family name or an assumed business model should not replace evidence about what happened to the affected systems and data.
Continuing research
This historical presentation precedes my later StealBit investigation. The two records show different forms of research: a threat-landscape presentation and an evidence-based examination of a particular executable.
Archive record
This retrospective follows the August 2018 presentation entry in my technical work history. Its description of the threat landscape refers to that historical period.