The AIDS Trojan Horse, created by Joseph L. Popp, introduced ransomware 34 years ago. However, ransomware remains a widely misunderstood phenomenon.

Ransomware is malicious software designed to block access to a computer system until a sum of money is paid. Despite its recent surge in popularity, ransomware is not a new phenomenon, especially for those working in cybersecurity for an extended period. The first recorded instance of computer ransomware dates to 1989 when Joseph L. Popp introduced the AIDS Trojan Horse, marking the first known cyberattack using ransomware.

Ransomware has emerged as a widespread threat; whereby legitimate users are denied access to their systems until a ransom is paid. Unfortunately, the damage has already been done when the affected user or organization detects the intrusion. Joseph L. Popps scheme involved the creation of floppy drives and offshore accounts, which were delivered to the intended targets. However, organizations failed to anticipate the evolving delivery methods employed by modern-day threat actors, who have access to advanced phishing techniques, cloud entry points resulting from misconfiguration, and other sophisticated tactics.

In the present day, it is possible for anyone with the appropriate techniques and knowledge of cryptography to develop advanced encryption software, which could be virtually unbreakable. Nevertheless, individuals with expertise in threat actors and experience on the dark web recognize that delivery can be more critical than the software itself when it comes to achieving the intended outcomes. This is evident in recruiting ransomware developers with a strong focus on delivery and methodologies, necessitating an understanding of backup technology and the ability to obtain credentials.

Its not uncommon for organizations to fall short in cybersecurity. I can attest to this as someone who experienced the global outbreak of the “I love you” worm while managing a cybercafe in Lagos, Nigeria during the early 2000s. from a threat actor perspective, the success of malicious code is contingent on its ability to reach the intended target. Without that, the code is rendered useless. To combat this, it’s crucial to prioritize the means of delivery, ensuring that malicious code including ransomware, can’t infiltrate or execute within your enterprise. To accomplish this, organizations must be familiar with threat actors in various delivery methods and techniques. It is worth noting that threat actors, like all humans, are prone to making mistakes, as evidenced by the few instances of malicious and ransomware codes encountered.