Top Ransomware Examples and How They Hurt Organisations (Updated 2025)

Ransomware is malicious software (malware) designed to block access to data or computer systems—typically by encrypting files—until a ransom is paid. It has evolved into a billion-dollar cybercrime industry, targeting everything from individuals to hospitals, ports, and government agencies.

There are two primary types of ransomware:

• Crypto Ransomware: Encrypts vital data without disabling system functions.
• Locker Ransomware: Locks the entire system, allowing minimal interaction just enough to pay the ransom.

Below are the most notable ransomware attacks, past and present, along with the evolving tactics as of 2025.

---

🛑 Historical and High-Impact Ransomware Attacks

---

1. Ryuk (2018–2020)

• Target: US newspapers, hospitals, government systems
• Impact: Estimated losses over $640,000
• Tactic: Delivered via phishing emails with Trojans; encrypted files and disabled recovery tools
• Lesson: Use secure email gateways and offsite backups

---

2. SamSam (2018)

• Target: City of Atlanta, Port of San Diego, healthcare facilities
• Impact: Over $2 million in recovery costs
• Tactic: Exploited weak passwords and RDP access
• Lesson: Harden remote access protocols and enforce multi-factor authentication

---

3. WannaCry (2017)

• Target: NHS (UK), global enterprises
• Impact: Over $4 billion globally; 92 million pounds in the UK
• Tactic: Used EternalBlue exploit on outdated Windows systems
• Lesson: Apply security patches immediately

---

4. NotPetya (2016–2017)

• Target: Ukrainian infrastructure, Maersk, Merck, FedEx
• Impact: Over $10 billion in damages
• Tactic: Disguised as ransomware but acted more like destructive malware
• Lesson: Vet third-party software and segment networks

---

5. Bad Rabbit (2017)

• Target: Media and transport
• Tactic: Drive-by downloads from compromised websites disguised as Adobe Flash updates
• Lesson: Block malicious web traffic and monitor for fake installers

---

6. Locky (2016)

• Target: Engineering, design, and developer firms
• Tactic: Socially engineered phishing emails; encrypted 160+ file types
• Lesson: User training and endpoint protection are essential

---

7. TeslaCrypt (2015–2016)

• Target: Gamers, then businesses
• Tactic: Encrypted gaming and office files
• Update: The Authors later released a master decryption key
• Lesson: Always check if free decryption tools exist

---

8. Shade/Troldesh (2014–2019)

• Target: Broad sectors via spam email
• Tactic: Encrypted files; offered "discounts" for payment
• Update: Shutdown in 2019; 750,000+ decryption keys released
• Lesson: Email filtering and spam protection remain critical

---

9. CryptoLocker (2007–2014)

• Target: Worldwide
• Tactic: Phishing attachments and RSA encryption
• Resolution: Security agencies created a free decryption portal
• Lesson: Collaboration between law enforcement and private security works

---

10. GrandCrab (2018–2019)

• Target: Individuals and businesses
• Tactic: Sextortion threats and RaaS kits
• Update: Law enforcement released free decryption tools
• Lesson: Don’t pay ransoms; consult security firms first

---

🔄 Recent Ransomware Trends and Attacks (2023–2025)

---

11. MOVEit Transfer Exploit (Clop Group, 2023–2024)

• Target: 2,000+ organisations using MOVEit file transfer
• Impact: Data theft across governments, banks, and universities
• Tactic: Exploited zero-day vulnerability; data extortion without encryption
• Lesson: Patch third-party tools immediately and monitor vendor risks

---

12. LockBit 3.0 Takedown (2024 – Operation Cronos)

• Target: Global corporations, healthcare, and logistics
• Status: Takedown by FBI, Europol, and NCA; decryption tools released
• Tactic: Ransomware-as-a-Service (RaaS) with affiliates worldwide
• Lesson: Global cooperation can dismantle even dominant groups

---

13. BlackCat / ALPHV (2022–2024)

• Target: Reddit, hospitals, manufacturing
• Status: Disrupted by the FBI in December 2023; victims received free decryptors
• Tactic: Highly sophisticated ransomware with public leak sites
• Lesson: Monitor for RaaS operators and use immutable backups

---

14. Ransomware-as-a-Service (RaaS) Explosion

• Trend: Non-technical criminals can now launch ransomware attacks
• Tactic: Renting attack kits with support and profit-sharing models
• Lesson: Even small organisations must harden systems and adopt zero trust

---

✅ Defensive Strategies for 2025

To protect against ransomware in 2025, organisations should adopt a proactive, layered defense strategy:

• 🔒 Zero Trust Architecture: Never trust, always verify user access
• 🛡 Endpoint Detection and Response (EDR/XDR): Identify and isolate threats early
• 🔁 Regular Offline Backups: Test and store backups separately
• 📥 Phishing Simulations and Security Training: Strengthen human defences
• ⚙ Patch and Update Management: Prioritise known exploits
• 📊 Vendor Risk Monitoring: Assess supply chain security posture
• 📂 Immutable Storage: Ensure backups can’t be encrypted by attackers

---

📌 Conclusion

From CryptoLocker to LockBit and Clop, ransomware has evolved rapidly, becoming more professional and damaging. The key takeaway for 2025 is clear: No organisation is immune.

Only those who:

• Stay updated on new threats,
• Invest in prevention and training, and
• Prepare for worst-case scenarios

…will survive and recover from this growing cyber threat.